Instructor: Now that we have associated
with our target network,
we can start communicating with it, and it won't ignore us.
So now we can go and start injecting packets
into the traffic to force the access point
to generate new packets with new IVs.
This will increase the number of data
really, really quickly, allowing us
to crack WEP networks in minutes,
even if the network was not busy,
like the one that we are targeting right now.
Now, there are a number of ways to do this,
but in this course, I'm going to explain
the most reliable method
which is using an ARP request replay attack.
I actually explain other methods
in my network hacking course,
but they are a little bit more complex
and have less success rate.
So this is the most reliable method
and it should work against most networks
if you have a good signal and a good wireless adapter.
So the idea behind this method is
to wait for an ARP packet,
and I'll talk about ARP in more details later on.
So for now, just think of it as a special type of a packet
that we're gonna be waiting on.
Once this packet is sent in the network,
we're going to capture it and retransmit it.
Once we do this, the router is forced
to generate a new packet with a new IV.
So by repeating this process, we will be forcing the router
to continuously generate new packets with new IVs.
Then once we have enough data, once we have enough IVs,
we can run aircrack-ng,
exactly as we seen before and crack the key.
So let me show you how to do this in practice.
Now, as you can see,
I'm already running airodump-ng against my target network.
And I have already associated with it
as shown in the previous lecture.
So the only thing that's left right now
is to run the ARP replay attack
in order to inject packets into the traffic,
and force the router to generate new packets
and increase the number of data.
To do that, we're gonna use aireplay-ng again.
And the command is actually gonna be very similar
to this command right here.
So I'm actually gonna copy all of this because I'm lazy,
and I'm gonna clear this, and paste the command here.
Now, there are only a few things that I need to modify.
First of all, I don't want to run
a fake authentication attack,
so I'm gonna remove all of this,
and I want to run an ARP replay attack.
Also, this attack does not take a number,
so I'm gonna remove this number.
And I'm also gonna replace the a with b, and we're done.
So if you look at it, you'll see it's actually very similar
to this command right here.
We're using aireplay-ng,
but instead of doing a fake authentication attack,
we're doing an ARP replay attack,
we're giving it the MAC address of my target network
after the b instead of the a.
Then we're giving it the MAC address
of my wireless adapter after the h,
which is identical to this.
And then we're giving it
my wireless adapter in monitor mode.
Now, I'm actually gonna associate again, before I do that,
and then I'm gonna hit Enter here.
And what's happening right now is
my wireless adapter is waiting for an ARP packet,
once there is an ARP packet transmitted in this network,
it's gonna capture it, and it's going to retransmit it.
Once it does that, the access point will be forced
to generate a new packet with a new IV,
and we'll keep doing this, forcing the access point
to continually generate new packets with new IVs.
So you should just wait for it right now,
we're literally just waiting for an ARP packets
to be sent in the air.
And as you can see, the number of data
is increasing now very, very quickly, which means
that we actually managed to capture an ARP packet.
This ARP packet got retransmitted, forced the router
to generate a new packet with a new IV,
and we are continually doing this process,
forcing the router to generate new packets with new IVs.
So right now we can go ahead and run aircrack-ng,
to crack this network, and before I do that,
I'll actually just associate one more time.
And then I'm gonna do aircrack-ng,
and give it the name of the file
which we're storing the data in,
which is called arpreplay-01.cap.
So I'm gonna hit Enter,
and you'll notice the cracking process right now
will actually require more data packets.
The reason for this is,
I've actually modified the settings of this network,
so that it uses 128 bit key,
because in WEP, you can either use a 64 bit or 128 bit key,
and obviously, the 128 key is longer.
Therefore, I actually modified the key length
for this lecture to make sure it's the longest key possible.
And as you can see, we still managed to get it
within about 47,000 packets.
We have the key right here in ASCII,
and we have the key in here in hex,
where we can use after we remove the colons.
So perfect, now we managed to crack the target network,
it was idle as you could see,
the was no data being sent, and we managed to do this
by forcing the target access point
to generate new packets with new IVs.