Now the attacks that we've seen in the previous video worked perfectly because the pin was really simple
it was set to 1 2 3 4 5 6 7 0 and it actually came from the factory like this.
So most people will not be modify that.
And if your target is using the same router that I got from my internet provider then you'll be able
to crack their password very very easily.
Right now I just want to show you an example I actually modified the router settings and I set the pin
to be something more random again.
It still has to be eight digits and still has to be made out of digits on the.
So you'll still be able to cover all possibilities and crack it.
And I just want to show you that this still works.
If the pin was more complicated than just one two three four five six seven.
So I'm just going to run Washington
and we can see that I have my target here the taste a.p and I'm just going to run a river against it
exactly like I did in the previous lecture.
Get with the SS ID on the channel and my wireless interface.
I'm going to hit enter and river actually supports pause and resume.
So if you were a crack in a network and you reached 50 percent for example and then you wanted to stop
that attack for some reason you can just press control-C at the same time go do whatever you want it
to do and come back even weeks after and just launch Schriever again against that network and river
will know where it stopped and it'll start from 50 percent so it's not going to start from scratch.
So with this I'm going to tell it.
Yes please.
Reassume and it's going to start with me so you can see that so far I tried 25 and it's just going
to keep going and it's going to try to brute force all possibilities.
And if we look at the start you'll remember that it said there is eleven thousand possibilities so it
can actually cover all these possibilities it's not a huge number.
And then when it covers all of them it will definitely be able to get the pin and then calculate the
key from the pin.
Now I'm going to Control-C out of this because this is actually working properly and I just wanted I
just want to show you what it would look like while it's working.
If the pin was a bit more complicated so you can see right here it is zero point 37 percent and it's
saying that the estimated maximum time is 6 hours five minutes to cover all possibilities.
So you might actually be able to get the to guess the pain before that time and get the key.
But the maximum time that you're going to have to wait is six hours five minutes and 18 seconds.
Now if I go up now notice that it 0.37 percent if I go up you'll see that I was at zero point three
three percent.
So it's actually work in it's stride and the pins it's going through the pins and trying them one by
one individually so everything is working.
All I have to do in this case is just wait for it to get the pin and then give me the key.
Now this router is configured in a way that it's going to accept failed attempts and it will never lock.
So when we run wash I'm just going to go and run wash again like I did
you'll see the WPX locked here.
And for my test AP It's still sad to know what this basically means is some routers lock after a number
of failed attempts.
So when you try to authenticate with them use an Iraq pin after four or five six.
However the router is configured they will lock and they'll stop accepting any requests.
Even if we try the right pin.
So rather than trying against right now the test AP never locks.
Even if I try a thousand wrong pins it'll never lock.
So that's really handy.
And that's why it's very easy to crack.
While you were testing you might face some routers that are configured to lock after a number of failed
attempts.
And once the router locks basically you won't be able to do anything and you'll have to wait for it
until it unlocks some routers unlock.
After a minute some writers lock after five minutes and some routers take days to unlock.
So it's not really a good idea to just sit down and wait for the router to unlock.
Now my other router the updated one that's sent from the company actually does lock after failed attempts
and I'm going to show you now I'm just going to run Rivara against it and I'm going to show you how
the router looks like if it's locked.
So my other router is actually the one that I'm using currently.
So it's still named the default name and it's this one.
So I'm going around revolt against it again using the same command that we did in the previous lecture.
I'm not going to do anything fancy So it's just going to be I'm going to clear this first and then I'm
going to do Reverchon minus B and thrown in on channel 6 and then I'm going to give him my wireless
card and monitor mode hit enter.
Sorry I had to give it after mine.
I
and again is asking me if I wanted to continue from the last time I'm going to say no to start from
scratch.
And I can see that it works for a bit and then it just completely locks.
It doesn't really do anything it just sits down there.
Now if I press control-C and greenwash again
you'll see that the writer got locked right here and it won't accept anymore requests right now so we
can't really do anything at the moment because WPX is locked.
Now the simplest way to get the router to unlock is to just the authenticate all the connected computers
and keep doing that for a long period of time until the user one of the users will just think that there
is something happening in the network and just goes in and turn off the router and turn it back on when
they do that the router will get unlocked and then you'll be able to run revert again.
So to do that all you have to do is the authentication attacked like we did before.
So we're going to do airplane Engy the Auth. if we're going to give it the access point
and you're not going to specify a client because you wanted to connect all the clients and then you're
going to give it the card in monitor mode which is zero.
And don't forget to specify a really large number after the deal with no we spoke about this before
and I'm not going to run this attack right now because it actually requires physical interaction of
the user to go and restart the router.
So again it's not the best way but it is a way to get the router to restart.
There is better methods to do that.
We're going to do them using a tool called MBK 3 and we'll talk about them in the next lecture.