Hello everybody and welcome back to the wireless penetration testing session.
Now in the previous videos I showed you how you can brute force the handshake with the catch catch the
catch get tool and with the aircraft tool we both use CPO and GPO in that process and we also saw how
we can create some of our own world lists in over to the make our attack more possible to work.
Now the next thing that I want to show you is also very important thing which is how you can actually
make your process of cracking even more faster than we did before.
Now you remember that we actually had only around 350 passwords per second on our clinic's machine with
our CPO and on my laptop we had of around 4000 passwords per second with the G we DCP.
Now the GPL was around 100 thousand pastors per second.
But we can even make it faster if we wanted to like a lot faster.
So open up your terminal.
I am currently on the clinics but I will switch to my laptop when I need to show you something.
But right now what I want to do is actually find our handshake that we captured it is in the handshake
folder as we can see it is right here.
Can 0 wondered cap and we also have a password that the file let me just see which password list is
that it is a password list that we created with the crunch.
OK.
Now what I want to show you is basically how you can make a rainbow table out of your password list.
Now what is a rainbow table or basically rainbow tables are huge sets of pre computed tables filled
with hashed values that are pretty much two possible plaintext passwords.
Now it allows us to crack the passwords even faster.
Basically it allows hackers to reverse the hashing function and to determine what the plaintext password
might be.
So let us let me show you how we can actually create a rainbow table.
It can take some time so I will find it on github.
Our password list that isn't larger than 100000 passwords per second.
So this doesn't take long to create.
Let me just open up my Firefox and I will basically just search and get her password lists and let's
see how many.
And let's see what we can actually find on github.
Maybe we can find a good password list that we can use for this.
You can use any password if you want.
If you want to for example you can use the uh the rock your password list.
Basically it can be any pastoralists want but it depends.
The larger the password the more time it will take to create a rainbow table.
So let me just find right here pass list let's go with the one hundred thousand.
Let's wait for this to open up then we will get clone this site.
It has 100000 passwords.
So let us just clone this copy then go to our terminal in our handshake folder and not type and keep
clone and paste the file.
So now that we are downloading this.
It says fatal repository not found.
Well that's unfortunate but there is another thing that we can do we can go to the raw section right
here and it should load up the page with basically all the passwords and we will just select all of
them just my Firefox is currently a little bit slow.
We could have used a smaller password list if we wanted to.
And basically we will.
If this doesn't want to copy itself but there really isn't no point in making a rainbow table out of
a password list that isn't at least 1 million passwords large.
Now I am using one hundred thousand passwords so this doesn't take too long to make me see what is happening
with this at the moment.
It is holding something.
Not really sure what is it holding.
You know what.
It basically.
Oh okay.
Finished.
So let us copy all of the passwords right here.
And let me nano parceled out to 60 and I will basically paste all the passwords that I just copied.
Now since this is a virtual machine this will probably lag out a little bit but as soon as it finishes
we will be able to continue working with it.
Well never mind that Id like out.
I will just use a password list that they already have right here.
So let me just create a new one with crunch that has eight
characters at least and that's pasted into the file not the sixty four for example.
Now since this is one terabyte large I will not really uh paste the entire password list.
I will basically control C soon enough.
So let me just control C right now and basically in the file not the 60 we should have some passwords
at least.
I believe there is around million passwords right here.
Which is more than enough.
I will show you how you can create the rainbow table now with that password.
So let me just delete the ones we do need so pass that the 60 to save.
And we do need passwords not to exceed and let us actually rename the file that extends into passwords
at the extremes so you don't actually get confused right here.
So these are the only two things we need a password list and the DOT kept file that we call the handshake
with.
So the two that we will use is called Arrow lib.
Let's just type error early minus minus help in order to see our available options.
Now as we can see right here there are a few options.
No.
One is the ask you out of the clean the badge verifies that we will use most of them.
So since we need to import the password list and we also need to import the e ss I.D. which is just
the name of our access point.
Now in order to import the e ss I.D. you basic need to create a simple text file so you just name it.
Nano e as this I.D. dot the extreme and what you need to do right now is basically just search your
violence access point and see what the name of it is for my SO for my access point.
It is basically this one.
So I'll just paste the name of my wireless access point in this file now I control o enter and then
control C or pandemic control X to exit and you can see that in this folder in this file I only have
the name of my wireless access point.
Now that you made this we can start using the arrow leave the minus n G2 so first thing we need to do
right here is basically uh create the rainbow table itself and import the E SSD in it.
Now how we do that we do that with air lib minus N G.
Now after that you specify the name of your rainbow table you can emit anything you want.
I will just name it rainbow table or let's just do all small letters and then you want to minus minus
import and then import as I.D. and the basically after this you need to specify the name of our files
which is only the e ss I.D. So just type your import dsa d and then the name of the file which is e
as decided on the.
Now once you do that you can click your enter and you can see it will finish relatively fast since we
only imported one word.
The next thing that you want to do is import the password list.
Now we import the password list with these similar comments or type your l m minus N G and then you
specify the name of your rainbow table or whatever you name it then you specify minus minus or tell
Dash import pass W D and after the pass WD You need to specify the password list that you are using
in my case that is the past not the extreme so once you do that just click here enter and it will read
all of the passwords from the file and it will import them into different pool table.
Now we can see right here how many passwords are there in my file.
So over a million already.
Hopefully it will stop soon.
They should have control.
See it a little bit earlier.
So we do not have this much passwords but it doesn't matter.
This shouldn't take too long to load.
The process that will take too long if you use a huge password list will be the next command which will
be minus minus or dash dash batch since it will import.
And it will hash all of the private share keys or all of the passwords from plaintext to hashed versions
so it can compare them faster once you run the attack.
Now here we can see that we are running over five that we are reading over five million passwords but
those are just passwords in plain text and that it will compute those passwords into hashed version
of those passwords so let's see how long this will take.
This is already over 7 million soon now.
It will also go onto the entire process of this will also go a lot faster if you have a stronger virtual
machine or basically if you are running this on your main P.C. now I remember on my laptop I did the
same thing a few minutes ago with the rainbow and with the rocket at 60 pass for this which is around
14 million.
And this process right here of importing the password list took a lot took a lot shorter time to process
these lines that it reads than these 10 million passwords right here but I will just wait for this to
finish and I will get back to you as soon as it does.
Well this took a lot longer.
I basically control see this since it went over 20 million passwords.
There is no need to wait for that and you can see right now if you're importing your password list is
finished that you will have a file called rainbow table if you name it like that.
Now what you can do with is basically you can check out the stat which is the option in error lib.
So just type here.
Rainbow table minus minus stat
and here we can see there are 1 and after it finishes here we can see that there is one SS I.D. which
we specified with this command right here once we reported the name of our wireless access point and
there are also 20 million passwords in the database now zero out of 20 million possible combinations
have been computed.
So what we want to do right now is Randy command cold.
Minus minus batch.
Now that command will compute these passwords and there will no longer be zero out of 20 million possible
combinations computed.
So how do we do that.
Well we run the airplane minus energy so and then minus minus latch.
So once you do that basically let me just add the name of the rainbow table on or it won't work.
So name your rainbow table then minus minus batch and when you will at this front this process will
take the longest out of all of the previous processes since it basically has to compute all the passwords
in this rainbow table.
Now I will not wait for it to compute the 20 million passwords since that will take around a week time.
How.
Basically let compute a few passwords or basically first ten or twenty thousand or something like that.
And then after that I will control C this program and we will run the attack with our error crack program
if you use the SMART password list you can wait for it to finish computing it.
Uh basically the fact the process of computing is dependent on your basically hardware so as you can
see right here it computes around 10000 passwords in 45 seconds while as on my laptop it computes around
I believe a hundred thousand passwords in 45 seconds.
So but once again this is our virtual machine so that is why it is so slow.
If you use a smaller password list it shouldn't take that much to finish but after this once it computes
computes around 20000 passwords you will see how much faster the aircraft program will run compared
to the previous attack that we did where it only were able to guess around 350 keys per second while
as right now I believe that number will grow over two or three thousand.
Now we will see.
Let me just.
It might even be larger than that.
So let's just control.
See this program once it hits 25000.
So controls here right now.
That is just not really sure why I'm not able to control see this.
OK.
Here it is.
We closed it and now if we run the stats right here it will say that 25000 out of 20 million possible
combinations have been computed which is around zero point point twelve percent so let us just let me
just show you that you can also watch or watch you can also do with this tool which is eerily minus
energy.
You can basically make arrow live.
You can basically make the SVR queries to the database or to your rainbow table with the minus minus
you all and then you specify the Eskil query you want to use.
Now we cover ask you basics so you should know what for example this means.
So select start from key as this idea.
Basically it will select the ESD that we important in to our rainbow table.
You can also select all from passwords but I believe that this will take a lot longer since there are
a lot of passwords in our password list.
Now I will control see if it good.
OK.
There it is.
You can also select all private shared keys.
All right.
Or basically your encrypted versions of the password with this comment.
So right now you can see that there are a bunch of random characters being printed out right here.
Uh those are basically your pre computed the passwords that it hashed in the process where we run minus
minus batch now after we do that.
We only want to run one more comment before we start the attack which is error lib minus and G then
the name of our rainbow table and then minus minus clean all.
Now this will clean all of the unnecessary things in our rainbow table and possibly make it work even
faster.
So I'm not really sure how long this could take.
Shouldn't take too long but we will see.