Instructor: In the previous lectures,
we seen how to crack the WEP encryption in minutes
even if the target network is not busy.
Now, in the next lectures,
we will talk about cracking WPA and WPA2.
First of all,
before we start talking about
how to crack these encryptions,
it is very important to understand
that both of them are very, very similar.
The only difference between them is the encryption used
to ensure message integrity.
WPA uses TKIP,
and WPA2 uses an encryption called CCMP.
In any case,
this does not affect the methods that we're gonna use
to crack WPA and WPA2.
Therefore, all of the methods
that I'm gonna show you from now on will work
on both WPA and WPA2.
Now, both of these encryptions came after WEP
and they were designed to address the weaknesses in it.
Therefore, both of them are much more secure
and cracking them is more challenging.
So before we start talking about how to crack them,
I want to cover a feature that if enabled and misconfigured,
can be exploited to recover the key
without having to crack the actual encryption.
The feature is called WPS.
It allows devices to connect to the network easily
without having to enter the key for the network.
So it was designed to simplify the process
of connecting printers and such devices.
You can actually see a WPS button
on most wireless enabled printers.
If this button is pressed
and then you press the WPS button on the router,
you'll notice that the printer will connect to the router
without you having to enter the key.
This way,
the authentication is done using an eight digit pin.
So you can think of this
as a password made up of only numbers
and the length of this password is only eight.
So this actually gives us a relatively small list
of possible passwords
and we can try all of these possible passwords
within a relatively short time.
Once we get this pin,
it can be used to recover the actual WPA
or WPA2 key.
So as you can see with this method,
we are not exploiting WPA or WPA2.
We are actually exploiting a feature
that can be enabled on these encryptions.
So for this to work,
first of all,
we need WPS to be enabled on the network
because it can't be disabled.
Also, it needs to be misconfigured.
So it needs to be configured
to use a normal pin authentication
and not a push button authentication.
If push button authentication is used,
then the router will refuse any pins that we try
unless the WPS button is pressed on the router.
Therefore, the method will not work
if push button or PBC is enabled.
So in most modern routers,
PBC comes enabled by default
or WPS will be disabled by default
so this method might not work.
But because WPA and WPA2 are so secure and so challenging,
it is always a good idea to check if WPS is enabled
and try the method that I'm gonna show you
to crack the network.
If it fails,
then you can try the other methods that I'm gonna show you
after the next lecture.