Is it possible to crack a WPA/WPA2 secured WiFi password?
Yes! Until & unless you have a fairly strong password which is a combination of letters, numbers and special characters which will make it very very difficult to launch a dictionary attack against your password.
So is it really that simple to break into someone's WiFi network?
Not really, but a little knowledge about a few software can make it quite simple.
Lets have a look at the anatomy of the attack. There are a few steps to gain access to a WiFi network:
1. We need to put our WiFi adapter in monitor mode [ read more ] so that we can capture EVERY wifi packet around us.
2. Note the MAC ADDRESS of the target Access Point & the target machine using "airmon-ng" software.
3. Deauthenticate the target user from the Access Point ( WiFi Network ) it is connected to...using aireplay-ng.
4. The above step will force the user to reconnect to the AccessPoint and at that moment we will capture the WPA handshake [ read more ] using airodump-ng.
Do not be excited, as this WPA handshake is not human readable. We need to further crack it using aircrack-ng with the help of a dictionary or a text file containing many many combinations of passwords. And if the text file contains the passphrase ( the WiFi password ) it will show up on the screen.
*This is just for educational purpose and building your knowledge. I request you to NOT/NEVER use such technique to break into someone's WiFi network.
Today you might be an attacker but someday you can be a victim as it is almost impossible to prevent deauthentication attack.
So lets not misuse it.
Below I will show the attack in detail on How it is actually performed.
I am sorry if you are using Windows. It is always better to have Linux installed on your system to practice such kinds of attack. If you don't have Linux I would suggest you to download from the internet. It is always FREE.
If you are using Linux, most probably you will be having the necessary software already installed. ie: airmon-ng, airodump-ng, aireplay-ng, aircrack-ng.
If NOT, you can type the following command which should work:
On your terminal:
type: sudo apt-get install aircrack-ng
This command should install all the software we need for the attack.
First we will need to put our WiFi adapter in monitor mode.
Command: airmon-ng start wlan0* [ this commands tells the network adapter to run into monitor mode ]
Explanation: *wlan0 is the name of my WiFi adapter. Your WiFi adapter name may differ. [ Please check using the command "ifconfig"] .
After running this command you will have one more interface called mon0 in addition to wlan0. mon0 is the same interface as wlan0 but in monitor mode.
After putting our interface in monitor mode, we need to know the BSSID ( MAC address ) of the AccessPoint and also the MAC address of the target machine. We can find all this information by running the following:
Command: airodump-ng mon0 --write "fileName" [ you can replace 'fileName' with whatever name you wish ]
Explanation: Running this command will show something like this:
..image here..
Also we have provided " --write " option to the airodump-ng command so that we can capture all the packets in a ' .cap ' file.
*Note: We can provide --bssid "AccessPoint's MAC address" option to airodump command so that it will capture only packets belonging to specific AccessPoint.
eg: airodump-ng mon0 --bssid 00:AA:BB:22:CC:DD --write newFile
This command will capture network packets only belonging to the MAC Address provided ( AccessPoint ).
Tip: How to find a WiFi Network's MAC address?
run the command sudo iwlist wlan0 scan
A list will be displayed from which you can get the target AccessPoint's MAC address.
moving on....
Now we are all set up. Network adapter is in monitor mode. Capturing the network packets belonging to the target AccessPoint.
Only thing remains is the last step: De authenticate the user connected to that AccessPoint.
To accomplish this, run the following:
Command: aireplay-ng --deauth 24 -a "AccessPoint's MAC Address" -c "Clients MAC Address" mon0
Explanation: By mentioning --deauth 24 we tell aireplay to send 24 [ you can send as much packet you wish ] spoofed deauthentication packets to the access point which we define by the option -a followed by the AccessPoint's MAC address. Which MAC address to spoof? That we mention by using the -c option followed by the victim's MAC address.
After running this command it will show something like this:
..image here..
By this we can be assured that the victim has been disconnected from the AccessPoint.
And when the victim tries to reconnect to the AccessPoint we would have captured the "WPA 4 way handshake" [ more on this here ]. After this you can press CNTRL+D ( interrupt ) airodump-ng as we have already captured the packet containing the passphrase.
Now that we have captured the WPA handshake [ which contains the passphrase ] its time to crack it using aircrack-ng.
Command: aircrack-ng newFile -w dictionary.txt
Explanation: Running aircrack-ng mentioning the filename in which we have captured the network packets earlier. The -w command tells aircrack to use the passwords in the text file [ dictionary.txt ] to crack the passphrase. When it matches the passphrase it will show up on the screen like this:
..image here..
For testing purpose you can try to break into your own WiFi network by making a text file containing your own password along with some random names so that you understand how aircrack successfully cracks the passphrase.
Note: It is very difficult to simply break into any WiFi network out there. People have become very careful & cautious regarding their WiFi passwords. This attack is to demonstrate how simple it is to break in to a WiFi network which uses a poor WiFi password, for example simple dictionary words, name of person, name of places, celebrity names etc.
Yes! Until & unless you have a fairly strong password which is a combination of letters, numbers and special characters which will make it very very difficult to launch a dictionary attack against your password.
So is it really that simple to break into someone's WiFi network?
Not really, but a little knowledge about a few software can make it quite simple.
Lets have a look at the anatomy of the attack. There are a few steps to gain access to a WiFi network:
1. We need to put our WiFi adapter in monitor mode [ read more ] so that we can capture EVERY wifi packet around us.
2. Note the MAC ADDRESS of the target Access Point & the target machine using "airmon-ng" software.
3. Deauthenticate the target user from the Access Point ( WiFi Network ) it is connected to...using aireplay-ng.
4. The above step will force the user to reconnect to the AccessPoint and at that moment we will capture the WPA handshake [ read more ] using airodump-ng.
Do not be excited, as this WPA handshake is not human readable. We need to further crack it using aircrack-ng with the help of a dictionary or a text file containing many many combinations of passwords. And if the text file contains the passphrase ( the WiFi password ) it will show up on the screen.
*This is just for educational purpose and building your knowledge. I request you to NOT/NEVER use such technique to break into someone's WiFi network.
Today you might be an attacker but someday you can be a victim as it is almost impossible to prevent deauthentication attack.
So lets not misuse it.
Below I will show the attack in detail on How it is actually performed.
I am sorry if you are using Windows. It is always better to have Linux installed on your system to practice such kinds of attack. If you don't have Linux I would suggest you to download from the internet. It is always FREE.
If you are using Linux, most probably you will be having the necessary software already installed. ie: airmon-ng, airodump-ng, aireplay-ng, aircrack-ng.
If NOT, you can type the following command which should work:
On your terminal:
type: sudo apt-get install aircrack-ng
This command should install all the software we need for the attack.
First we will need to put our WiFi adapter in monitor mode.
Command: airmon-ng start wlan0* [ this commands tells the network adapter to run into monitor mode ]
Explanation: *wlan0 is the name of my WiFi adapter. Your WiFi adapter name may differ. [ Please check using the command "ifconfig"] .
After running this command you will have one more interface called mon0 in addition to wlan0. mon0 is the same interface as wlan0 but in monitor mode.
After putting our interface in monitor mode, we need to know the BSSID ( MAC address ) of the AccessPoint and also the MAC address of the target machine. We can find all this information by running the following:
Command: airodump-ng mon0 --write "fileName" [ you can replace 'fileName' with whatever name you wish ]
Explanation: Running this command will show something like this:
..image here..
Also we have provided " --write " option to the airodump-ng command so that we can capture all the packets in a ' .cap ' file.
*Note: We can provide --bssid "AccessPoint's MAC address" option to airodump command so that it will capture only packets belonging to specific AccessPoint.
eg: airodump-ng mon0 --bssid 00:AA:BB:22:CC:DD --write newFile
This command will capture network packets only belonging to the MAC Address provided ( AccessPoint ).
Tip: How to find a WiFi Network's MAC address?
run the command sudo iwlist wlan0 scan
A list will be displayed from which you can get the target AccessPoint's MAC address.
moving on....
Now we are all set up. Network adapter is in monitor mode. Capturing the network packets belonging to the target AccessPoint.
Only thing remains is the last step: De authenticate the user connected to that AccessPoint.
To accomplish this, run the following:
Command: aireplay-ng --deauth 24 -a "AccessPoint's MAC Address" -c "Clients MAC Address" mon0
Explanation: By mentioning --deauth 24 we tell aireplay to send 24 [ you can send as much packet you wish ] spoofed deauthentication packets to the access point which we define by the option -a followed by the AccessPoint's MAC address. Which MAC address to spoof? That we mention by using the -c option followed by the victim's MAC address.
After running this command it will show something like this:
..image here..
By this we can be assured that the victim has been disconnected from the AccessPoint.
And when the victim tries to reconnect to the AccessPoint we would have captured the "WPA 4 way handshake" [ more on this here ]. After this you can press CNTRL+D ( interrupt ) airodump-ng as we have already captured the packet containing the passphrase.
Now that we have captured the WPA handshake [ which contains the passphrase ] its time to crack it using aircrack-ng.
Command: aircrack-ng newFile -w dictionary.txt
Explanation: Running aircrack-ng mentioning the filename in which we have captured the network packets earlier. The -w command tells aircrack to use the passwords in the text file [ dictionary.txt ] to crack the passphrase. When it matches the passphrase it will show up on the screen like this:
..image here..
For testing purpose you can try to break into your own WiFi network by making a text file containing your own password along with some random names so that you understand how aircrack successfully cracks the passphrase.
Note: It is very difficult to simply break into any WiFi network out there. People have become very careful & cautious regarding their WiFi passwords. This attack is to demonstrate how simple it is to break in to a WiFi network which uses a poor WiFi password, for example simple dictionary words, name of person, name of places, celebrity names etc.
No comments:
Post a Comment