Instructor: Welcome back.
So, we have cracked the password with our aircrack tool.
We noticed that the speed was around
three to four hundred keys, or passwords per second.
We saw that it works once we added
the correct password to our file,
and we also saw some of the other options,
such as time left, the percentage,
and the amount of passwords that have been tested.
But, right now let's see how we can crack the password
even faster using the hashcat tool.
So, let me clear the screen from the previous video.
And, what I got on my desktop right now is
I got the rockyou dot txt password list,
and I got the rockyou dot txt with our correct password.
Now, these are the two exact same lists
from the previous video,
Just this one contains the correct password
for our wireless access point.
We're going to run the first one first just to
see the speed that we get and
whether it is any faster than with our aircrack tool.
And then, just to prove that it works,
we're going to run this list the next.
So let's get straight into it,
to run the hashcat help menu, you can simply type hashcat,
and to get even more options on to how you can use hashcat,
you can type hashcat and then dash dash help.
And, here is the help menu.
Down here we got some basic examples
of how we can use hashcat,
and if I scroll a little bit up here
we can see all of our available options.
And, you might be asking what was the thing that I
was scrolling through so much?
Well, these are just different types
of password hashes that you can crack.
You have SHA one SHA two SHA 512, you got Keccak
you got sip hash, you got MD five,
different types of MD five hashes with salt without salt.
That goes for SHA one as well,
and for any other password list that we can find.
Now, you might be wondering, well
which one are we going to use?
In our case, we want to find the WPA password hash,
and it'll be under these network protocols.
And, if I go right here, here it is.
We want to use the WPA EAPOL P B KDF two,
and this has a code of two 500.
Remember that, because that is the number
that we are going to specify in our command.
And, up here we got something under the dash a option,
which is called the attack mode,
and you simply just specify dash A
and then different attack mode.
Down here at the lower part of the help menu
we get which attack modes we have.
Let me just find where it is.
I believe it's somewhere around here.
And, here it is.
I believe these are the attack modes.
So we got the low, which is specified With zero,
even though it says one right here,
the low attack mode is specified
with zero, and the four which is nightmare
is specified with dash A three.
Now, we are going to be running the lowest attack mode
just so we can see how the tool works.
So, the first thing that we must do
is we must type hashcat dash a and then the attack mode.
We are going to use the lowest one,
which is zero, and then dash M for the password hash.
Remember the code for the WPA password hash
is going to be two five oh oh.
After that comes our cap file,
but if you were to try to run this program
with our dot cap file, it would not work.
hashcat works with different cap files.
We must convert this cap file to hc cap X.
How can we do that?
Well, we don't have any tool that we can use
in our Cal Linux, so we must go and do that online.
What I'm going to do is I'm going to open up my Firefox,
and I'm just going to search for cap to hc cap X converter.
Let's wait for this to open.
Open a new tab and type cap
to hc cap and then X.
press enter.
The proxies are refusing connections.
This could be due to our burp suite being the proxy,
so we're just going to remove it real quick,
instead of actually opening it,
I'm just going to go to network settings,
and click right here,
No proxy.
Great. Now I will refresh this page
and I'm going to go to this first link right here,
which is pcap and cap file converter to hc cap x.
Let's click on that.
Let's select our file.
I will click on browse,
and I will find my dot cap file.
Here it is.
So, I will select that one and I will click on upload.
This will upload the file for me,
and as soon as it finishes
I should be able to download the hc cap x file
that we can use with our hashcat tool.
So, let's wait for this to finish.
And, here it is.
I can click down here, download my file,
and I want to save my file.
It will be under here in the download section,
as we can see, it has some weird name.
Nonetheless, let's copy it to our desktop.
For that I'm going to open another terminal,
navigate to downloads,
and I'm going to copy
our hc cap X file
to home Mr. Hacker and then desktop.
(keys typing)
Then, I can exit this out.
And, the next thing that we specify right here is that file.
So, I believe it is called like this.
You can rename it if you want to.
I'm just going to leave it with this long name,
And the last parameter to this function
is going to be the word list that we're going to use.
In our case, this is going to be rockyou dot txt.
First, this is the list without our password.
So, let's go through the options once again,
the attack mode is going to be the lowest.
The dash M option specifies: which password are we cracking?
We're cracking WPA password, so we specify two five oh oh.
Then we specified our cap file
that is converted for hashcat.
And, the last thing we specify is the password list.
So I'm going to run this.
(key clack)
It will tell me that this has been started.
It will initialize this backend run time for our device one,
and it'll probably start brute forcing with my CPU.
And the reason it does that,
is probably because we are running this
over virtual machines,
so it can only detect the CPU.
However, even with CPU cracking, we should still
get faster cracking time than with aircrack.
All we need to do is we need to wait
for this to finish, and as soon as that's done
we should start cracking the password.
And here it is, it started cracking the password.
It will not write anything right here.
However, if we type S for status,
we can check out what progress it currently has.
So we can see some information right here.
And, anytime you press S, you will see the current progress
of this cracking of the password.
It will tell us which file are we using to crack,
which hash name are we using,
the progress and the speed is down here.
It says 600 hashes per second,
and this is equal to 600 passwords per second.
So, we can see it is almost double the amount
that we had with aircrack.
Down here We can see the progress
as to what amount of passwords have
we covered from 14 million passwords
that we have inside of our program.
And, we can see we already passed
a hundred thousand passwords.
In the candidates,
it tells you between which passwords it is currently at.
Now you can wait for this to finish.
However, even though it is currently at 1%,
we're not going to be waiting for all of this to finish.
It will take hours.
We're just going to quit this with Q command,
and then we're going to run the same command
just with our correct file.
(keys typing)
So, I'm going to use rock you with password txt,
and I'm going to run this once again,
just make sure that you added the correct
password to the password list,
and let's see whether it will manage to find it.
And, keep in mind that
if you didn't run this on a virtual machine
and you actually used the GPU to brute force the password,
you could have up to tens of thousands of passwords
per second, and the faster the better.
However, even with this small speed
we managed to find the password while I was talking.
So, we can see it printed it out right here.
Here is the hash, here is the name
of the actual wireless access point,
and here is the password that it managed to find.
So we can see it also did this in less than one second.
While I talked, we got all of these results output,
and this is a second option
as to how you can crack
the password of wireless access points.
Now you can use the hashcat to crack some other
passwords as well.
We saw that there are a bunch of different hash values
that you can use.
However, we learned hashcat
through wireless password cracking.
Great, and that will be about it for wireless cracking.
So, thank you for watching this video,
and this section, and I will see you in the next lecture.