Penetration Testing mailing list archives
Re: Cracking WEP and WPA keys
From: Cedric Blancher <blancher () cartel-securite fr>
Date: Fri, 16 Dec 2005 22:12:32 +0100
Le vendredi 16 décembre 2005 à 09:50 -0200, Demetrio Carrión a écrit :
1. The AP sends a 128bit number (challenge) 2. The client/user encrypts the challenge with the WEP key (Challenge XOR Key)
No, it's not Challenge XOR Key, it's: Challenge XOR RC4(IV,Key) It would be too simple if it was : Response = Challenge XOR Key <=> Key = Response XOR Challenge But anyway, you still have: RC4(IV,Key) = Response XOR Challenge And you both know Response and Challenge. So you can guess 144 bytes of RC4(IV,Key), which allows you yoo: 1. Authenticate yourself by crafting any challenge response using this RC4(IV,Key) 2. Inject any frame you want using this RC4(IV,Key) providing payload does not exceed 132 bytes You can't guess the key, however, you get sufficient knowledge to be able to inject traffic, and then perform chopchop or aireplay attacks. -- http://sid.rstack.org/ PGP KeyID: 157E98EE FingerPrint: FA62226DA9E72FA8AECAA240008B480E157E98EE
Hi! I'm your friendly neighbourhood signature virus. Copy me to your signature file and help me spread!
------------------------------------------------------------------------------ Audit your website security with Acunetix Web Vulnerability Scanner: Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do! Download Trial at: http://www.securityfocus.com/sponsor/pen-test_050831 -------------------------------------------------------------------------------
Current thread:
- Re: Cracking WEP and WPA keys, (continued)
- Re: Cracking WEP and WPA keys Seth Fogie (Dec 13)
- RE: Cracking WEP and WPA keys cerealkilla (Dec 15)
- RE: Cracking WEP and WPA keys Sahir Hidayatullah (Dec 16)
- Re: Cracking WEP and WPA keys Seth Fogie (Dec 13)
- RE: Cracking WEP and WPA keys Josh Perrymon (Dec 13)
- Re: Cracking WEP and WPA keys pagvac (Dec 14)
- Radio Signal Pent test (RFID) Louie (Dec 14)
- Re: Radio Signal Pent test (RFID) Toufeeq Hussain (Dec 27)
- Re: Cracking WEP and WPA keys David M. Zendzian (Dec 14)
- Re: Cracking WEP and WPA keys Demetrio Carrión (Dec 16)
- RE: Cracking WEP and WPA keys Rui Pereira (WCG) (Dec 16)
- Re: Cracking WEP and WPA keys Cedric Blancher (Dec 16)
- Re: Cracking WEP and WPA keys Matthias.Vallentin (Dec 16)
- Radio Signal Pent test (RFID) Louie (Dec 14)
- Re: Cracking WEP and WPA keys Robert Baldi (Dec 14)
- Cracking WEP and WPA keys Eduardo Espina (Dec 14)
- Re: Cracking WEP and WPA keys Fabien Degouet (Dec 14)
- Re: Cracking WEP and WPA keys Robin Wood (Dec 15)
- Re: Cracking WEP and WPA keys Fabien Degouet (Dec 17)
- Re: Cracking WEP and WPA keys Fabien Degouet (Dec 14)
- RE: Cracking WEP and WPA keys Hamlesh Motah (Dec 14)
- RE: Cracking WEP and WPA keys Rapaille Maxime (Dec 17)