Hello everybody and welcome back to the next lecture in Wi-Fi penetration testing section.
We in the previous video we saw how we can capture our four way handshake and how we can crack it with
the aircraft program using our CPO power now.
Now that we did that what we want to do is basically try to run this process a lot faster or not a lot
faster but basically a few times faster with our GPO.
So how do we do that.
Well basically we will use a program called hash cat as we can see if you type your hash get it is already
installed in the calendar so you won't have to install it again.
All you need to do is run one simple command but you can do that only after you uh basically convert
the DOT cap file we have it to dot H S.C. AP exe file.
Now how we do that.
Well there are some tools on Linux or on the clinics that you can install in order to do that.
But I prefer to use other method which is basically on their website on hash get website.
We want to open new window and we want to go to the website that we will use in order to convert our
file to the DOT HCC AP exe file.
Now to go to that uh Web site you just type your a.
Yes two dots then two slashes hash get dot net slash cap to HCC AP X and then you press enter.
So this is the link right here and it will lead you to a simple Web site which is basically only used
to convert these files between each other so let's let this just load for a second.
Here it is.
And right here you should see the same thing.
You can see that the maximum size of our file is 20 megabytes which can cause sometimes a problem.
Hopefully our file right now isn't larger than 20 megabytes.
If it is I will have to redo basically the attack and capture the former handshake faster uh or basically
you can shoot the file with some of the programs.
But I believe it is not a larger than 20 megabytes right now.
Let's just find our file.
It is on home handshake.
And here it is.
It is only one point six megabytes large.
So if you open it and then click here on cover convert Uh this will take a few seconds and it'll basically
prompt you with a weird name.
Well that is consistent Oh bunch of numbers.
And then with the exception not HCC Apex now it doesn't matter.
They basically just numbered these files with that as we can see right here.
This is the name of our file that we need to download right now.
Uh it converted it to the get to the base PD type of file not really sure what it even is.
It is HCC AP ex and we can just download it right here
as we just opened this
and let's copy it.
Copy and move it to the same file which is the same folder which is the handshake folder so I paste
it right here and now we have the DOT cap and Dot HCC AP exe file which we believe is now in order to
crack it with hash.
Now if we type here Hachette minus minus well you will see it comes a bunch of the options that we will
use some of them not all of them.
The most important one is to specify the type of hash that we are cracking which you can see is uh labeled
with these numbers on the left.
Now as we can see there is the empty five empty foreshore one shot two shot Wall twenty to 256 bit and
they're all labeled with this number right here.
That's how it will specify that.
But we want to find BPA a private room key password and it should be somewhere here.
I believe it is somewhere around here.
Here it is uh BPA.
Uh April.
And this one we will use right here.
So it is under the number of twenty five hundred so let us use that option.
Let me see if there is anything up that we need to use it basically just shows uh the the syntax for
this uh tool.
Uh we will use these two options which is minus M which is hash type and then we will specify twenty
five hundred in order specify that we're cracking BPA password.
And we will use the attack mode which basically minus 3.
I B I believe this is used in order to specify how fast you want this attack to go.
Now they have some examples down here.
Here they are.
And this is for the minus say which is a.
It can go from one to four.
So attack mode can go from low to nightmare which basically I would really recommend using the four
option right here.
Since this process of cracking which are cheap you can actually exhaust your graphics card and it can
also make it crash if it passes the certain temperature.
But I believe that Hachette has been installed in the tool itself to abort the process once the GPO
temperature reaches over a hundred degrees I believe or something like that.
You want to make sure that you check it and you do not let it reach over 85 degrees since 100 is a lot
of the graphics card.
You do not want to wait for 100.
You want to basically aborted at for example 85 degrees.
So you can see right here the device type you can choose if you want to crack you or see you.
Right now we are cracking with you.
So let us run our full command right now.
We have the file right here which is this one.
You can rename it.
So let's just rename it to something that we can use.
So this is for example you you that is EVP X. And now we will just specify these three letters instead
of all of these numbers.
So what we want to do right now is type your hash get minus 8 which stands for the attack mode of all
specify right here too.
Doesn't really matter you can use one two three or even four if you want to then minus 10 which stands
for the hash type.
We saw previously that BPA is two hundred and fifty basically twenty five hundred.
And now what we want to specify is basically the name the name of our file that we are cracking or basically
the name of our file that has the hash password which is not our case.
GP You thought HTC E.P. X and one more thing we want to specify after all of this is the password that
we will use in order to crack that file.
Now right here we will use the.
Let me just find you.
I believe it was user share or it lists right now let us use the rock you dot the extreme password list
invalid.
Attack Mode.
Value specified how is invalid no device's phone left.
Oh yeah I forgot that I am running this on a virtual machine we uh.
Without having the proper drivers installed for my graphics card.
So you would need to uh basically install the graphics the drivers for your graphics card depending
from which graphics card you have in order to perform this attack.
If you are running on clinics or to machine if you're not running if you are running on any other Linux
distribution you should not have this problem and you should be able to run this attack.
Now I will not install it right now since there is no point in showing you that since we all have different
graphics card right.
What I will do is I will switch to my laptop in order to show you how the process of attacking will
work.
So let me just switch to my laptop real quick.
So here I am on my laptop.
And right now we will run the same command that we tried to run before.
I don't really know why I thought that it would work there.
I thought I was on my laptop for a second.
But you want to let me just this.
A little bit.
As we can see I transferred my file.
Here it is cheap you that ATC AP X and what we want to do is basically run the same element so hash
get minus a day in the attack mode for example zero doesn't even matter.
Uh.
Attack Mode zero.
Then we want to use the minus M option I believe two for uh twenty five hundred.
After that the name of the file which is keep you that HCC CCP x.
And after that what we want to do is specify the path to our world list which on my laptop isn't the
same pad.
Now it is desktop or at least and the rock you that the exceed.
Now now that I run this let me just.
It you can see that it started running.
It says temperature about three or said to ninety degrees.
So that is good.
I thought it was 100 degrees.
And you can see that it found the password relatively fast.
Since I have it in my regular to exceed uh the regular text uh file or what is now you can see some
of the options right here hash type which we did specify is VPN we to it cracked it.
You can see it less than a second and it's all the speed right here.
Is this one now as you can see on my laptop.
This is one hundred and one and twelve point one thousand passwords per second.
So this is let's say a hundred thousand passwords per second with cracking with my GP you you can see
how many passwords it finished.
So progress it finish four hundred fifty seven thousand passwords out of 14 million passwords.
Now let me show you the.
Let me just find it.
The
word lists.
No it's not there.
Now this.
Let me just delete.
I have a bunch of these.
Rob you the 60s save passwords
most such file or directory.
What do you mean no such followed directory.
I see it right here.
Oh it is a dot dot too and thought one
Okay doesn't matter now.
But we want to do is turn it or basically comes up it the Iraq you know one I unzip it on my laptop
it won't have.
What do you mean it doesn't want to.
So let me just.
No no never mind.
Let me just let's just use another password based.
Not really sure how many passwords are here but let's see how fast it will finish with this password.
This just comment at the extreme.
But let me just try once again if I can.
Zip
not sure why it won't find.
So let's try comes up once again
Oh it's actually okay.
Maybe it will work like this but let's just run it once again.
So we changed to our directory where we have our hash Cat.
Uh dot A.S.A.P. x file and let us run it once again.
Hash get minus say 0 minus M twenty five hundred and then the name of the file and then the path to
the list all hash is found in Port file.
Okay so it found.
Yeah.
It gives me this because the it already cracked the hash with these past four days.
So let's just use the common dot to see that we have in the same folder or basically you can use any
pastoralists you want.
Uh right now I'm using the ones I have in order to show you uh all hash is found in the portfolio.
Now it won't work because once you crack the password.
The password hash in the dot is ATC AP exe file it wont really allow you to crack it once again since
it it already has it cracked.
Um we saw we directly got to see it ran over one hundred thousand passwords per second and it managed
to crack it in less than a second.
That is how powerful your GP you is in this process of tracking.
Now even though the speed may sound really fast to you.
Uh the one hundred thousand passwords per second may sound really fast to you.
It is still nothing compared to the possible combinations of the password that you might have.
Now I will show you how you can create some of the more precise password lists that you might need.
Which two for which two programs one is crunch and the other one.
I'm not really sure how it's called.
I'll have to check it out and then you might have a slightly bigger chance in cracking the password
for the violence network so that would be about it for this tutorial.
Uh.
And I will show you the passwords.
The list making in the next tutorial and I hope I see you there.
Bye.