wifite – Mass Wifi WEP/WPA Key Cracking Tool

wifite is created to to attack multiple WEP and WPA encrypted networks at the same time. This tool is customizable to be automated with only a few arguments and can be trusted to run without supervision.

Features

• sorts targets by power (in dB); cracks closest access points first
• all WPA handshakes are backed up (to wifite.py’s working directory)
• mid-attack options: stop during attack with Ctrl+C to use (continue, move onto next target, skip to cracking, exit)
• numerous filters to specify exactly what to attack ( wpe/wpa/both, above certain signal strengths, channels, etc)
• very customizable settings (timeouts, packets/sec, etc)
• SKA support (untested)
• finds devices in monitor mode; if none are found, prompts for selection
• all passwords saved to log.txt
• switching WEP attacks does not reset IVS
• displays session summary at exit; shows any cracked keys

You can download wifite here:
wifite.py

Read More

OSWA Assistant – Wireless Hacking & Auditing LiveCD Toolkit

The OSWA-Assistant is a no-Operating-System-required standalone toolkit which is solely focused on wireless auditing. As a result, in addition to the usual WiFi (802.11) auditing tools, it also covers Bluetooth and RFID auditing. Using the toolkit is as easy as popping it into your computer’s CDROM and making your computer boot from it!

This toolkit is a contribution to the wireless security/auditing community and, as the “Assistant” moniker implies, and is designed for the following groups of people:

• IT-security auditors and professionals who need to execute technical wireless security testing against wireless infrastructure and clients;
• IT professionals who have responsibility for ensuring the secure operation and administration of their organization’s wireless networks;
• SME (Small & Medium Enterprise) and SOHO (SmallOffice-HomeOffice) businesses who do not have either the technical expertise or the resources to employ such expertise to audit their wireless networks;
• Non-technical-users who run wireless networks at home and who would like to audit the security of their wireless home networks and laptops but don’t know how.

You can download OSWA Assistant here:
oswa-assistant.iso

Read More

Kismet – Wireless Network Hacking, Sniffing & Monitoring

For some reason I’ve never posted about Kismet, and I don’t like to assume everyone knows everything. So for those who may not have heard of it, here’s Kismet.

Kismet is one of foundation tools Wireless Hacking, it’s very mature and does what it’s supposed to do.
Kismet is an 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. Kismet will work with any wireless card which supports raw monitoring (rfmon) mode, and can sniff 802.11b, 802.11a, and 802.11g traffic.
Kismet identifies networks by passively collecting packets and detecting standard named networks, detecting (and given time, decloaking) hidden networks, and infering the presence of nonbeaconing networks via data traffic.
Features

• Ethereal/Tcpdump compatible data logging
• Airsnort compatible weak-iv packet logging
• Network IP range detection
• Built-in channel hopping and multicard split channel hopping
• Hidden network SSID decloaking
• Graphical mapping of networks
• Client/Server architecture allows multiple clients to view a single
• Kismet server simultaneously
• Manufacturer and model identification of access points and clients
• Detection of known default access point configurations
• Runtime decoding of WEP packets for known networks
• Named pipe output for integration with other tools, such as a layer3 IDS like Snort
• Multiplexing of multiple simultaneous capture sources on a single Kismet instance
• Distributed remote drone sniffing
• XML output
• Over 20 supported card types

If you need to get funky with a wireless network, grab Kismet for a start.

You can download the latest stable source here:
kismet-2007-10-R1.tar.gz (sig)

Read More

KisMAC – Free WiFi Stumbler/Scanner for Mac OS X

KisMAC is an opensource and free stumbler/scanner application for Mac OS X. It has an advantage over MacStumbler/iStumbler/NetStumbler in that it uses monitor mode and passive scanning.
KisMAC supports several third party PCMCIA cards – Orinoco, PrismII, Cisco Aironet, Atheros and PrismGT. USB Prism2 is supported as well, and USB Ralink support is in development. All of the internal AirPort hardware is supported as well.
System Requirements

• Mac OS 10.4
• A Mac with a supported PCMCIA, USB or internal AirPort

Features

• Reveals hidden/cloaked/closed SSIDs
• Shows logged in Clients (with MAC Addresses, IP addresses and signal strengths)
• Mapping and GPS support
• Can draw area maps of network coverage
• PCAP import and export
• Support for 802.11b,g,n
• Different attacks against encrypted networks
• Deauthentication attacks
• AppleScript-able
• Kismet drone support (capture from a Kismet drone)

Active mode, also referred to as managed mode, sends probe requests and is pretty boring.

Passive mode is more commonly known as monitor mode, and passively monitors what’s already in the air without interfering in it.

Active attacks like deauth and reinjection (where supported) require your device to be in monitor or passive mode.

You can download KisMAC here:
KisMAC

Read More

WifiZoo v1.2 – Gather Wifi Information Passively

WifiZoo is a tool to gather wifi information passively. Similar to dsniff but for wireless work, the author wanted to do something wifi-related somewhat helpful in wifi pentesting. Something of an extension of Ferret from Errata.

It’s essentially a tool to get information from open wifi networks without joining any network, and covering all wifi channels. Most of the packet parsing is done by Scapy.

WifiZoo does the following:

• Gathers bssid->ssid information from beacons and probe responses
• Gathers list of unique SSIDS found on probe requests
• Gathers the list and graphs which SSIDS are being probed from what sources
• Gathers bssid->clients information and outputs it in a file
• Gathers ‘useful’ information from unencrypted wifi traffic (like passwords/credentials etc)

Requirements

• Python
• Scapy
• Kismet (if you want to do channel hopping)
• Logs are stored in ./logs/ (so make the directory)

You can download WifiZoo here:
wifizoo_v1.2.tgz
Or you can read more here.

Read More

aircrack-ng – WEP and WPA-PSK Key Cracking Program

aircrack is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured. It implements the standard FMS attack along with some optimizations like KoreK attacks, thus making the attack much faster compared to other WEP cracking tools. In fact, aircrack is a set of tools for auditing wireless networks.

Aircrack-ng is the next generation of aircrack with lots of new features:

Better documentation (wiki, manpages) and support (Forum, trac, IRC: #aircrack-ng on Freenode).

More cards/drivers supported

• New WEP attack: PTW
• More OS and platforms supported
• Fragmentation attack
• Improved cracking speed
• WEP dictionary attack
• Capture with multiple cards
• New tools: airtun-ng, packetforge-ng (improved arpforge), wesside-ng and airserv-ng
• Optimizations, other improvements and bug fixing

Download the latest version of aircrack-ng here:
Linux – aircrack-ng-0.9.1.tar.gz
Windows – aircrack-ng-0.9.1-win.zip
Or you can read more here.
Remember you need this to use aircrack-ptw – the fast WEP cracking tool.

Read More

aircrack-ptw – Fast WEP Cracking Tool for Wireless Hacking

WEP is a protocol for securing wireless LANs. WEP stands for “Wired Equivalent Privacy” which means it should provide the level of protection a wired LAN has. WEP therefore uses the RC4 stream to encrypt data which is transmitted over the air, using usually a single secret key (called the root key or WEP key) of a length of 40 or 104 bit.

A history of WEP and RC4

WEP was previously known to be insecure. In 2001 Scott Fluhrer, Itsik Mantin, and Adi Shamir published an analysis of the RC4 stream cipher. Some time later, it was shown that this attack can be applied to WEP and the secret key can be recovered from about 4,000,000 to 6,000,000 captured data packets. In 2004 a hacker named KoReK improved the attack: the complexity of recovering a 104 bit secret key was reduced to 500,000 to 2,000,000 captured packets.

In 2005, Andreas Klein presented another analysis of the RC4 stream cipher. Klein showed that there are more correlations between the RC4 keystream and the key than the ones found by Fluhrer, Mantin, and Shamir which can additionally be used to break WEP in WEP like usage modes.




The aircrack-ptw attack

The aircrack team were able to extend Klein’s attack and optimize it for usage against WEP. Using this version, it is possible to recover a 104 bit WEP key with probability 50% using just 40,000 captured packets. For 60,000 available data packets, the success probability is about 80% and for 85,000 data packets about 95%. Using active techniques like deauth and ARP re-injection, 40,000 packets can be captured in less than one minute under good condition. The actual computation takes about 3 seconds and 3 MB main memory on a Pentium-M 1.7 GHz and can additionally be optimized for devices with slower CPUs. The same attack can be used for 40 bit keys too with an even higher success probability.

We believe that WEP should not be used anymore in sensitive environments. Most wireless equipment vendors provide support for TKIP (as known as WPA1) and CCMP (also known as WPA2) which provides a much higher security level. All users should switch to WPA1 or even better WPA2.

You can download aircrack-ptw here:
aircrack-ptw-1.0.0.tar.gz

Or read more here.
Find an aircrack-ptw How To here.

Please note aircrack-ptw should be used together with the aircrack-ng toolsuite.

Read More

Wep0ff – Wireless WEP Key Cracker Tool

Wep0ff is new tool to crack WEP-key without access to AP by mount fake access point attack against WEP-based wireless clients.

It uses combination of fragmentation and evil twin attacks to generate

traffic which can be used for KoreK-style WEP-key recovery.

This tool can be used to mount fake access point attack against WEP-based wireless clients.

This code tested patched madwifi-old drivers with athraw support, but also works with madwifi-ng. With madwifi-ng you need to create two virtual interfaces: one in master mode (for fake AP) and second in monitor mode (to listen on).

How to Use:
 

1. Setup fake AP with KARMA tools or iwconfig

iwpriv ath0 mode 2
iwconfig ath0 mode master essid foo enc 1122334455 channel 7
echo 1 > /proc/sys/dev/ath0/rawdev
echo 1 > /proc/sys/dev/ath0/rawdev_type
ifconfig ath0
up ifconfig ath0raw up

2. Start this program (./wep0ff ath0raw 00:01:02:03:04:05)
3. Wait until client connect to fake access point
4. Launch airodump-ng to collect packets
5. Launch aircrack-ng to recover WEP key

You can download it here:

Wep0ff

Read More

Real Wifi RFID Hacking

James Van Bokkelen is about to be robbed. A wealthy software entrepreneur, Van Bokkelen will be the latest victim of some punk with a laptop. But this won’t be an email scam or bank account hack. A skinny 23-year-old named Jonathan Westhues plans to use a cheap, homemade USB device to swipe the office key out of Van Bokkelen’s back pocket.

“I just need to bump into James and get my hand within a few inches of him,” Westhues says. We’re shivering in the early spring air outside the offices of Sandstorm, the Internet security company Van Bokkelen runs north of Boston. As Van Bokkelen approaches from the parking lot, Westhues brushes past him. A coil of copper wire flashes briefly in Westhues’ palm, then disappears.

The guy can clone the signal, then reverse it and play it back to the card reader in your office, bingo, he just broke in without raising any alarms.

Van Bokkelen enters the building, and Westhues returns to me. “Let’s see if I’ve got his keys,” he says, meaning the signal from Van Bokkelen’s smartcard badge. The card contains an RFID sensor chip, which emits a short burst of radio waves when activated by the reader next to Sandstorm’s door. If the signal translates into an authorized ID number, the door unlocks.

The coil in Westhues’ hand is the antenna for the wallet-sized device he calls a cloner, which is currently shoved up his sleeve. The cloner can elicit, record, and mimic signals from smartcard RFID chips. Westhues takes out the device and, using a USB cable, connects it to his laptop and downloads the data from Van Bokkelen’s card for processing. Then, satisfied that he has retrieved the code, Westhues switches the cloner from Record mode to Emit. We head to the locked door.

Read More

Jacking Wifi

The Ethics Expert also points out that if you find an open connection, you should try to figure out who owns it to let them know it’s open — in case they want to cut it off. Of course, he leaves out the strongest argument for why there’s nothing wrong with using free WiFi, assuming you’re either on public property or your own property: those radio waves are no longer under the control of the access point owner once they drift off of his or her property

While I suppose that an argument could be made that you should never use what you donâ’t pay for, I don’t think this would apply here and I’m not even sure that I agree with the broad sentiment. Unless it is made clear to users tapping into wireless connections that they must agree to certain conditions before proceeding, they have not breached any ethical mandate by logging on in any way that they legally can.

The right thing would be for those who set up wireless connections and want to keep them private to take the time to do so. If you’re a piggybacking user and can identify the individual to whom the connection belongs, it would be courteous but not essential to let that person know that you and presumably others are able to enjoy their wireless largesse.

Read More