-: Now from the previous lectures, we learned
in order to crack WPA
or WPA2
we need to first capture the handshake.
And second, have a word list
which contains a number of passwords
that we're going to try.
And hopefully one of them will be the password
for the target network.
So right now I have both of these components
and we are ready to go and crack the password.
To do this Aircrack-ng is going to unpack the handshake
and extract the useful information.
The MIC right here, or the message integrity code,
is what's used by the access point
to verify whether a password is correct or not.
So, it's going to separate this and put it to the side.
And then it's going to use all
of the other information right here,
combined with the first password from the word list
to generate an MIC, another message integrity code.
And then, it's going to compare this MIC to the one
that's already in the handshake.
If the MIC generated using this information
plus the first password is the same,
then the password used to generate this MIC
is the password for the network.
Otherwise this password is wrong
and it will move to the next password.
Again, it'll do the same
until they use all of this information
combined with this password,
generate a new MIC, compare this new MIC
to the one that's already in the handshake.
If it's correct, then this is the password.
If it's not, then it's going to move on
to the next password.
And it'll keep doing this through all of the passwords
in my word list.
If any of them generate the right MIC,
then this is the password for the network.
Otherwise we want to be able to get the password.
That's why the success of this attack really depends
on your word list.
So let's see how to do this in practice.
Right now I have my word list right here.
It's called test.txt, and I've actually manually
added my password to the end of the list right here.
Just so that when I run the word list against the handshake,
I will actually find the password
because the word list did not contain my password
by default.
I also have the handshake file right here, as you can see.
And all of this is in my home directory,
which is my root directory.
So if I do LS in here, you'll see,
I have the word list and the handshake file.
So we're ready to run Aircrack-ng.
So we're going to type the name of the program as usual,
followed by the name of my capture file,
which is WPA handshake zero one dot cap.
So, so far it's identical to the way
that we used to use it with WEP.
The only difference right now,
because this is a WPA2 network,
We have to specify a word list with the dash w option.
And the name of my word list is test.txt.
So very, very simple "aircrack" is the name of my program.
WPA handshake zero one dot cap is the name of the file
that contain my handshake.
And I'm using dash w to specify my word list file.
I'm going to hit enter.
And as you can see now, Aircrack-ng is running
through the world list,
testing each word in the word list one by one,
as shown in this diagram,
calculating an MIC based on this information
on the word list,
and then if the MIC is correct,
it's going to tell me that this is the password.
Now the speed of this depends on your processor
and the size of your word list file.
So if you have a huge file,
obviously it'll take you longer time.
There are also online services that you can try
where you upload the handshake
and they have huge word lists
and they have super computers
to run through these word lists and try
to give you the password.
Unfortunately, I can't share their links with you,
but you can easily find them on Google,
if you search for them.
And perfect!
As you can see,
we managed to find the key.
it's telling us the key is found,
and this is the key to the network.
And this is the correct key because as you know,
this is the same key that we got
when we exploited the WPS feature.
So now we can go ahead and connect to the network
and we'll be able to run all of the cool stuff
that I'm going to teach you
in the post connection attack section.
Now, this is the only practical way known so far
to crack WPA and WPA2 keys.
There are methods to speed up this process.
So you can use the GPU for cracking
because it's much faster than the CPU.
That's if you have a GPU.
You can also use rainbow tables.
You can also pipe the word list
as it's being created in Crunch to Aircrack-ng.
This way you can create bigger word lists
without using any storage on your computer.
There are also methods
so that you can pause your cracking process
and then come back after a while
without losing your progress.
But the main idea is the same.
The only way right now to crack WPA and WPA2
is through a word list attack.
You can use social engineering, however,
to get the password using an evil twin attack
where you trick one of the users to give you the password.
This is actually all covered
in my advanced network hacking course:
the cracking using the GPU, pipe in Crunch to Aircrack-ng,
getting the password using an evil twin attack,
and much more advanced network hacking techniques.
If you're interested in that,
then I highly recommend you have a look
on my Advanced Network Hacking course.
Check out the bonus lecture of this course,
the last lecture of this course.
It contains links to all of my other courses
and the comparison between them.