RE: Cracking WEP and WPA keys

["Rapaille Maxime" <Max.Rapaille () nbb be>]

Hi,

I have made this kind of demo for a lot of Wireless hacking demo and training.
As stated in the readme file of Aircrack, Wep Cracking is not rocket science.
And, to be honest, I have not had luck each time.  But could always crack it eventually.
After lot of test (in pentest and in demo) I found that, even with the same key, the same AP and the same PCMCIA card, 
downloading the same big sized file, you get different results.
But, a good trick that seems to work, I mean that add a lot of chance to crack WEP quickly (in a few second mostly) is 
to have a lot of Auth and Deauth packet in the capture (+ associate request..)
I do it in pentest using Void11, to deauth and/or deassociate the client(s) during the capture.
With that, i get more than 90% succes, in less than 10 minute cracking with aircrack, Fudge Factor 2 to 8.
I use a Proxim Atheros based a/b/g card and the Auditor CD collection. (Great tool !)
If I can't crack the WEP in 10 minutes, I consider it as lost, and redo the capture.

Last point : I usually capture until I have collected minimum 800.000 IV. (Weak IV aren't so common in new 
implementation, and not neede for the new attack.) but have had results with only 200.000...
This is valid for 64 and 128 bit keys, in the field.

Just my 0.02€...Hoping to help.

Max 

-----Original Message-----
From: Robin Wood [mailto:dninja () gmail com] 
Sent: jeudi 15 décembre 2005 14:37
To: Fabien Degouet
Cc: pen-test () securityfocus com
Subject: Re: Cracking WEP and WPA keys

I'll take this one to the wireless list once I've subscribed but just to let people know that I tried again to crack my 
key and failed. I collected 1million IVs with a mix of aireplay and copying large files between devices. Even with that 
I still hadn't cracked it after 521 minutes so I gave up.

I'm going to have a read of all the articles that people sent me and if I have any more prolems I'll put them on the 
wireless list.

Thanks All

Robin

PS the machine doing the cracking is a Sempron 3000+ with a gig of ram in case anyone was going to suggest the machine 
may not be up to it!

On 12/15/05, Fabien Degouet <fdegouet () conthackto com mx> wrote:
> In fact, as it is a statiscical attack, it does not depend on the "weaks IV"
> but on the quantity.
> It's like the more unique IVs, the higher the probability to find the 
> wep key quicker. Anyway, it's probability, even a 99% probability does 
> not ensure you'll win!!
> In practice I used to crack 104 bit wep keys with around 500 000 
> packets. If you're not lucky you will need more, till a million packets.
>
> While collecting packets you can run aircrack. For example you have 
> collected 500 k packets, you can run aircrack on the capture file as 
> it still grows (capturing with airodump), it is even faster. That's 
> what I usually do.
>
>
> Fabien Degouet
>
>
> ----- Original Message -----
> From: "Eduardo Espina" <eduardomx () gmail com>
> To: <pen-test () securityfocus com>
> Sent: Tuesday, December 13, 2005 9:55 AM
> Subject: Cracking WEP and WPA keys
>
>
> > I cracked my own WEP a few months ago, I just needed to collect 
> > about
> 800,000
> > IVs with airodump, then ran aircrack and I got the key in less than 
> > one
> second.
> > (104 bit WEP) By the way, i collected the whole traffic in 2 hours.
> >
> > It doesn't just depend on the number of collected IVs, but the weak 
> > IVs
> and your
> > hardware. My frist try was using a 3Com Card, but I wasn't 
> > collecting
> enough
> > IVs, then I tried with a Prism2 Intersil card and it was done.
> >
> > You should give it more time to the airodump stage than to the 
> > aircrack
> one.
> > Greetings,
> > Eduardo.
> >
> > --
> > Eduardo Espina Garcia <eespina () seguridad unam mx> Departamento de 
> > Seguridad en Computo - UNAM-CERT DGSCA, UNAM 
> > http://www.seguridad.unam.mx  Tel.: 5622-8169  Fax: 5622-8043 GPG 
> > Key Fingerprint: "8E86 932F C364 03BE 39B8  3F9D D27E 438A 3C6A 750F"
> > "No matter how hard you try to keep your secret, it's a universal 
> > law that sooner or later it will be discovered."
> >
> > --------------------------------------------------------------------
> > ------
> ----
> > Audit your website security with Acunetix Web Vulnerability Scanner:
> >
> > Hackers are concentrating their efforts on attacking applications on 
> > your website. Up to 75% of cyber attacks are launched on shopping 
> > carts, forms, login pages, dynamic content etc. Firewalls, SSL and 
> > locked-down servers
> are
> > futile against web application hacking. Check your website for
> vulnerabilities
> > to SQL injection, Cross site scripting and other web attacks before
> hackers do!
> > Download Trial at:
> >
> > http://www.securityfocus.com/sponsor/pen-test_050831
> > --------------------------------------------------------------------
> > ------
> -----
> >
>
>
> ----------------------------------------------------------------------
> -------- Audit your website security with Acunetix Web Vulnerability 
> Scanner:
>
> Hackers are concentrating their efforts on attacking applications on 
> your website. Up to 75% of cyber attacks are launched on shopping 
> carts, forms, login pages, dynamic content etc. Firewalls, SSL and 
> locked-down servers are futile against web application hacking. Check 
> your website for vulnerabilities to SQL injection, Cross site scripting and other web attacks before hackers do!
> Download Trial at:
>
> http://www.securityfocus.com/sponsor/pen-test_050831
> ----------------------------------------------------------------------
> ---------

------------------------------------------------------------------------------
Audit your website security with Acunetix Web Vulnerability Scanner: 

Hackers are concentrating their efforts on attacking applications on your website. Up to 75% of cyber attacks are 
launched on shopping carts, forms, login pages, dynamic content etc. Firewalls, SSL and locked-down servers are futile 
against web application hacking. Check your website for vulnerabilities to SQL injection, Cross site scripting and 
other web attacks before hackers do! 
Download Trial at:

http://www.securityfocus.com/sponsor/pen-test_050831
-------------------------------------------------------------------------------



-----------------------------------------
Visit our website! http://www.nbb.be

"DISCLAIMER: The content of this e-mail message should not be construed
as binding on the part of the National Bank of Belgium (NBB) unless
otherwise and previously stated. The opinions expressed in this message
are solely those of the author and do not necessarily reflect NBB
viewpoints, particularly when the content of this message, or part
thereof, is private by nature or does not fall within the professional
scope of its author."