[Autogenerated] in the previous module we looked at
bypassing authentication by finding hidden S.
S.
I.
D.
S beating Mac filters and bypassing shared key authentication.
So in this module will turn to cracking encryption keys to gain
access to networks and steal sensitive information.
Before we launch into the demo.
Let's take a deeper look at the wet protocol to understand
its weaknesses and how we can exploit them.
Standard 64-bit WEP uses a 40 bit key which is added to a 24 bit
initialization vector to form an RC four stream cipher key.
The key stream is an ex sword with a plane tax data stream which
includes a CRC 32 checksum to ensure data integrity.
The encrypted data then gets bundled with the 802.11 header
which contains the initialization vector.
Now the fundamental weakness in web is its use of our C.
Four and a short initialization vector that's recycled every 224 frames.
While this may appear to be a large number,
there's a 50% chance of four initialization vector
reuses every 5000 packets to use this.
To our advantage,
we can either wait patiently for sufficient traffic to traverse the
network or we need to generate a large amount of traffic so that we can
more quickly capture reused initialization vectors.
We can then compare to cipher streams encrypted with the same initialization
vector to begin to decrypt the key let's begin by configuring the access point
to use WEP encryption by navigating to wireless.
And then wireless security.
Check the web radio button and change the authentication.
Type two shared key.
This access point except 64 or 128 bit WEP keys which can be
entered either as a ski characters or in hexadecimal to capture
all the traffic that will be generated.
Let's start a road um specifying the access points,
MAC address to focus only on the wireless lab network and the
channel on which the access point is broadcasting will again use
the right option to specify the prefix for the file name that
will contain the captured data.
After completing the command by specifying the monitoring interface,
we can see confirmation that a capture file called web
dash 01 dot cap has been created.
We then wait for a client to connect before moving to the next
stage of the attack in a busy environment.
This should happen quite quickly but in some cases you
may just need to be patient here.
We can see that a client is connected to the wireless lab
network but not much data is being generated.
So it will take a long time to capture enough data to crack the WEP key.
Let's try to speed things up to do this will capture our packets
on the wireless network using air replay and inject them back into
the network to simulate ARP replies,
replaying these packets a few 1000 times will generate a lot of traffic
on the network now despite not knowing the WEP key.
Every play is able to identify our traffic.
This is because art is a fixed head of protocol.
So the size of the art packets can be easily determined and used
to identify them even in encrypted traffic.
Let's run air replay with option three to specify an ARP replay,
attack and dash B to specify the bss I.
D.
We then use dash H to specify the client MAC address that we want
to spoof followed by the monitoring interface.
W land zero mon we have to spoof the client MAC address as every play
only works with authenticated and associated client mac addresses but of
course error replay complains to us that the host MAC address doesn't
match that of the wireless adapter.
Which of course is intentional.
It also reminds us to run aero dump,
which we've already done and after a short amount of time we capture some art
requests and start to inject them back into the network,
switching back to a road.
Um briefly we notice that we now have a large number of wireless
frames associated with the client and a rapidly increasing number of
data packets associated with the access point.
Let's now open a new tab and start cracking,
we can start aircraft at any time and it will start attempting to crack
the weP key with the data that we've captured so far.
If it fails at that point it waits until the next multiple of 5000
new initialization vectors and has another go this continues every
5000 new initialization vectors until the web key is cracked
depending on the cracking machine,
the key will typically be cracked in less than five minutes.
In this test it took about 1.5 minutes skipping to the
last few initialization vectors.
We see that after capturing about 15,000 unique initialization vectors,
aircraft has successfully cracked the WEP key.
Before we move on,
let's take a quick look at one more tool for cracking wireless keys.
Wi-Fi It uses a number of different tools and utilities including the
aircraft sweet to automate much of the key cracking process.
We launch we fight by entering its name at the command line.
It then looks for a wireless interface that's in monitor mode.
If it doesn't find one,
it will look for a managed interface and use Airman
to change it to monitor mode.
It then automatically starts scanning for wireless access
points and obtaining information about them.
As soon as we see an access point that we want to target.
We use control C to stop the scan and enter the number of the access point here.
At number two we have our wireless lab network which uses WEP
encryption and authentication and a second access point that
supports WP a personal encryption,
selecting two for our Wi-Fi lab Wi-Fi it immediately and automatically
launches an ARP replay attack and starts capturing packets.
After 10,000 initialization vectors have been captured.
Wi-Fi starts to attempt to crack the WEP key.
And after a little over 12,000 unique initialization vectors have been captured.
Wi-Fi successfully cracks the key.