Instructor: So from the previous lecture,
we know, in order to crack WEP,
we need to first capture a large number of packets,
this means that we'll capture a large number of IVs,
the IVs, because they are short,
they will be repeated,
therefore we'll be able to use a tool called aircrack-ng
to run statistical attacks
and crack the WEP key.
So, we're using airodump-ng to capture the data
and we've seen how to do this before,
then we're using aircrack-ng
to analyze this data and break the key.
Let's see how to do this in practice.
So I already have my wireless adapter in monitor mode.
And it's called mon0.
I've also already run airodump-ng
to list all the networks around me
and as you can see, I have only one network using WEP.
This is called Test AP3
and this is my actual network
that I use every day.
I've just configured it to use WEP
to make this lecture.
The main reason why I'm targeting the network
that I use daily
because like I said, for this to work,
we need to capture a large number of packets
and therefore we need a busy network,
a network that gets used constantly
to capture a large number of packets.
If the network is idle,
then the process is a little bit complex
and I will cover that in the next lecture.
So for now, let's focus on the simplest form
which is how to break into a busy network.
So I'm gonna copy the BSSID of this network.
And I'm gonna run airodump-ng against this network only.
So I showed you how to do this before.
I'm gonna do airodump.ng.
I'm gonna do --bssid to specify the BSSID of the network.
Then I'm gonna do --channel
to specify the channel of the network
and we can see it's running on number one.
And I'm gonna do --write
to store everything that we capture into a file
and let's call this file basic_wep.
And then I'm gonna specify my wireless adapter
in monitor mode which is mon0.
So we ran this command before
in the targeted sniffing lecture.
All we're doing is we're running airodump.ng
against a specific network with this MAC address,
with this channel and we're storing everything in a file
called basic_wep.
I'm gonna hit Enter
and as you can see, airodump.ng is working
against my target network
and if you notice,
you'll see the data in here
is increasing really, really fast.
So this is something that I told you,
I'll talk about it later
when we were talking airodump.ng
because I didn't want to talk about IVs
at that early stage.
So basically what you see under the Data column
is the number of useful packets
that contain a different IV
that we can use in order to crack the key.
So the higher this number is,
the more likely we will be able
to crack the key.
As you can see, this number is increasing very fast
because like I said, this is a busy network
that is being used at the moment
by my own computers and my own devices.
If yours isn't increasing fast,
then don't worry, we will tackle this problem
in the next lectures.
So for now, we're capturing a lot of data
and this should actually be enough
to crack the key.
So what I'm gonna do,
I'm gonna go down to my other terminal in here
and if we actually list the files,
you'll see that we have the capture file
that we specified in the write argument
and like I said, we're always interested in the .cap file.
So all we have to do right now
is do step two in here.
Run aircrack-ng against the file
that we captured in order to crack the key.
So I'm gonna do aircrack.ng
followed by the file name
which is basic_wep-01.cap.
I'm gonna hit Enter.
And as you can see,
it's telling us that the key is found.
So let me cancel this here
and right now, we can connect
to the target network which is called Test_AP3
using this ASCII password,
so you can literally just copy this and paste it
or you can connect using this key.
Now, in some cases,
you will not see this ASCII password.
That's why I'm gonna show you how to connect
using this key right here
because you'll always get this.
So I'm gonna copy this.
And I'm just gonna paste it here.
You can paste it anywhere in a normal text editor
or anywhere you want.
And all you have to do
is remove the colons
that we see in here between the numbers.
So I'm gonna remove this one,
I'm gonna remove this one,
this one and this.
And now, we can just copy this.
And just to show you,
I'm actually gonna connect from my host machine.
You can connect from Kali
but when we enabled monitor mode,
we killed a lot of processes
and sometimes even after you restart these processes,
getting connecting to your target
will be a little bit buggy
so it's best to literally just restart Kali
and connect again.
So just to save all of this time,
I'm going to connect from here.
I'm just gonna click here,
I'm gonna connect to Test AP3.
And I'm going to paste the password.
So I'm just gonna click on Show the Password
to show it to you.
Again, the same password,
we just remove the colons.
I'm gonna click on Join.
And as you can see, we managed to connect
and we can test this connection
by going to Google and perfect.
As you can see, it's working
and we managed to break the WEP encryption.