General WEP password cracking in Linux Command Line (or non-BT platform)

I have seen many tutorials on the Internet. Although they are aimed at cainiao like us, there are usually a few operations that I did not explain. Here I will write a few steps based on my actual situation, which is not completely original, but try to explain some possible situations and hope to help you.

First of all, there is a problem with the Platform selection. Online recommendations are based on LINUX's BT3/4. BT series, but I feel a bit misunderstood and I am suspected of advertising for USB NICs.
First, BT is so powerful that it is not just a little bit of wireless cracking functions. Many security tools such as Bluetooth and network may find that BT functions are distorted on the Internet. the interfaces of BT3 and BT4 are the same, but the essence is not the same. bt3 is based on slax, while slax is also based on wifislax. bt4 is based on ubuntu, while nubuntu is also based on ubuntu. some operation commands are not the same, so if you fail to check whether the system is wrong or not, you can relax your eyes and never stare at BT.

The second is the disadvantage of BT. It is more challenging for hardware, especially for network cards and video cards (why graphics cards cannot be understood). If the system is not able to install the following cracking processes, it is nothing to say. The NIC represents UBS, and the driver cannot be used. The graphics card represents ATI, especially the ATI wide-screen notebook, which can basically be abandoned. If you can install the best BT, you can not I recommend a few, one is UBUNTU9.04 (currently the latest is 9.10), one is the CDlinux-0.9.4-wireless (currently the latest is 0.95 ), also is the beini-1.0-rc5.1 (currently the latest, not how to try ). UBUNTU9.04 is selected because it has good adaptability to hardware. It is possible to identify the NIC graphics card that cannot be recognized by BT series. You do not need to buy a USB Nic to only break the WEP password, and still cannot be identified! In addition, it is easy to use "wubi" to install it on the hard disk. If someone tries wubi and cannot install 9.10 (it seems like grub boot upgrade) or use other methods to install ubuntu dual-system hard disk and restore XP. When the mbr encounters a problem, it will immediately scratch the wall and I will agree with my point of view ..., the specific point is xinyang-ubuntu-9.04-chinese-customize-release this revision, also called "New oxygen ". CDlinux0.94 has a lot of software not found in 0.95. Why. 0.95 does not exist in some 0.94, So my suggestion is to download it at the same time, and then put "local" in 0.95 ", in the "extra" folder, some modules are packaged as image files in the 0.94 folder, so that the advantages of the two can be set, one feature of 0.95 is to extract the "feedingbottle" in "Beini", which is very convenient.

 

After the system is selected, install ubuntu. the ubuntu "wubi" is relatively simple. Note that the non-system disk to be installed is set to the NTFS format and a new folder is created, named "iso" put the image file with the installation file in the iso folder, the image file xinyang-ubuntu-9.04-chinese-customize-release. iso is renamed as installation. iso and wubi should not be officially used. Otherwise, all the image files downloaded will be available until the hair is white... we recommend the "wubi-hd" revision. CDLinux can directly decompress the package to drive C, and then edit "boot. ini "," menu ", but the disadvantage of CDLinux is that after the operation, the content will be lost after the next restart. Remember to manually copy useful items to other non-system disks, it should be a problem of the system itself, but it doesn't matter if it is used only for wireless cracking.

The following are the major steps for wireless cracking. I want to rewrite the command line, because LINUX is too disgusting, especially for software installation, and everyone does what they want, but the result is not free. It is typical to install "spoonwep" in different systems, tossing the dead. The command line is troublesome, but it is common, and it is not difficult for a lazy copy...

There are eight entries in total, which are explained below. For example, if I use ubuntu as an example, it is best to "connect to the Internet" in advance.

"Sudo apt-get install aircrack-ng" and so on. Download required software. CDLinux does not need to be used, but the command line of CDLinux does not seem to be able to copy the file. It's hard to do it manually.

1) ifconfig-
2) airmon-ng start wifi0 6
3) airodump-ng -- ivs-w name-c 6 ath1
4) restart the terminal. Do not disable the previous one. aireplay-ng-1 0-e ap_essid-a ap_mac-h XXXXXXXX ath1-1 is-one.
5) aireplay-ng-5-B ap_mac-h XXXXXXXXXX ath1
6) packetforge-ng-0-a ap_mac-h XXXXXXXXXX-k packet 255.255.255-l packet 255.255.255-y fragment-XXXXX-XXXXXX.xor-w mrarp
7) aireplay-ng-2-r mrarp-x 1024 ath1
8) re-open the terminal, do not close the front, aircrack-ng-n 64-B ap_mac name-01.ivs

 

1) ifconfig-
1) this command is used to find the Mac address of your wireless network card. Note that the wired network card is usually eth0, And the built-in wireless network card in the notebook may be eth1, wifi0, and wlan0, after the virtual machine is installed, there is a virtual network card of the virtual machine. The usb NIC also has its own name. I used wlan0 as an example.

2) airmon-ng start wifi0 6
2) This command is used to place your wireless network card in the Monitor mode, which is similar to the effect of an AP. Therefore, you can capture other packets.

The first ifconfig-a command can be seen. The 6 following wifi0 is the channel of the AP to be cracked, the most common. It may also be 11,1. After the command is run successfully, you will see an Ath1 prompt (if you are an Athoes wireless network card, this is the option, and others may be mon0) this is your Nic code used for cracking. In short, this command puts your wireless network card in monitoring mode and specifies the monitoring channel. If you find that the channel is wrong, it doesn't matter. You can run it again, but at this time, it may become ath2... ath3 and so on, but it seems that it can run up to three times, and then it will fail.

For example, sudo airmon-ng start wlan0 6 is shown as follows:

Interface Chipset Driver

Mon0 Unknown iwlagn-[phy0]
(Monitor mode enabled on mon0

6 is the channel you need to monitor. It must be the same as that in the second command. ath1 is the alias that appears in step 2.

3) airodump-ng -- ivs-w name-c 6 ath1
3) this command is critical. After you run it, all the APS of this channel will be listed. "Name" can be changed at will. It doesn't matter if you write your name.
There are a lot of content displayed. Here is a brief introduction:
BSSID: Actually the Mac address of the AP.
PWR: the AP signal size. Generally, smaller than 10 is troublesome, but it is not impossible. I have seen negative values...
RXQ: Interference size
Beacons
# Data: This is important because it receives special packets that can be used to crack. If the packet remains unchanged, it indicates that there is no client connection and it may be difficult to crack it. If the other party has a large file to download, so the jump speed is very fast,

In 10 minutes, enough packets can be cracked. If the attack is slow, some special methods are needed to crack the attack. Cracking usually takes tens of thousands of data, but you don't have to worry about it. The most exaggerated is that you only need to wait a while for more than two data entries (see later)
CH: Channel
MB: the network connection speed is 54 MB.
ENC, CIPHER, AUTH
These are encryption methods. We will only discuss how to display them as WEP and WEP + OPN.
ESSID: This is the AP name and will be used later. If it is a Chinese character, it seems that there will be problems. Therefore, ESSID in Chinese can be used to prevent other users from cracking attacks.
This window is open. You do not need to close it. You need to open a terminal window again for subsequent commands.

Example: sudo airodump-ng -- ivs-w name-c 6 mon0

4) restart the terminal. Do not disable the previous one. aireplay-ng-1 0-e ap_essid-a ap_mac-h XXXXXXXX ath1-1 is-one.
4) after "aireplay-ng", the number 1 is not the letter l. The keyboard-hitting comrades paid attention to it.
At the beginning of this step, we will do some real cracking work, mainly for those clients that only connect and have no traffic. This AP, # Data growth is very slow, it usually takes a long time to obtain enough packages. In this case, aireplay-ng is required. As the name suggests, this software is Replay, that is, simulate packet sending.

First, explain the command:
-E ap_essid, "ap_essid" is-e followed by the essid to be cracked, 3 steps are visible, or the simplest windows directly view the wireless network can be such as TP-LINK, linksys, pay attention to the case.
-A ap_mac: "ap_mac" is the Mac address of the AP you want to crack after-a. You can see it in step 3 BSSID. It may also be displayed as "xx-xx", "xx: xx", without ":" or.
-H XXXXXXXXXX is after-h, add the Mac address of your "self" wireless network card, you can get it in the first step.
If Successful, the Successful:> is displayed. Otherwise, make the signal strength greater than 10.

Example: aireplay-ng-1 0-e TP-LINK-a 001900123456-h 001900345678 mon0

 

5) aireplay-ng-5-B ap_mac-h XXXXXXXXXX ath1
5) This is the execution of a command, which is related to # data package. If # Data is not added, the command will be executed until a # Data package is captured. After the capture, the program will ask if you need to use this package to simulate attacks. Answer Y. If the attack succeeds, it will be shown as a success. The failure is often caused by poor signal. If the attack fails (usually due to a problem with the captured packet), the program will retry N times, or automatically start capturing the package again and continue. After successful completion, will display a file name: fragment-XXXXX-XXXXXX.xor this file name, XXXXX is a number, is a file. It will be used immediately. This step is the most likely to fail. Keep the signal better.

Example: sudo aireplay-ng-5-B 001900123456-h 001900345678 mon0

 

6) packetforge-ng-0-a ap_mac-h XXXXXXXXXX-k packet 255.255.255-l packet 255.255.255-y fragment-XXXXX-XXXXXX.xor-w mrarp
6) more parameters, fragment-XXXXX-XXXXXX.xor is the fifth step of the display that file name. The rest are the same as the previous one.
This step will soon be completed, showing what the generated file to mrarp is, in fact, the preparation process for cracking the package.

Example: sudo packetforge-ng-0-a 001900123456-h 001900345678-k packet 255.255.255-l packet 255.255.255-y fragment-1226-122412.xor-w mrarp

7) aireplay-ng-2-r mrarp-x 1024 ath1
7) ath1 is the name of your wireless network card, 1024 is the attack speed, and 1024 is the maximum value. If your wireless network card is not MiniPCI, we recommend that you set it to 512, this is not easy to crash.

When this step starts, you will see the # Data behind the AP you cracked in the first terminal window is growing rapidly! (The precursor to success) is generally 200 ~ The speed is 400 per second. You only need to wait.

Example: sudo aireplay-ng-2-r mrarp-x 51