# Understanding AirCrack output in Backtrack 5

First let me clarify that I was trying to crack WPA2 in my home for educational purposes. I followed some tutorials and the message I received was:

key found! [ilovegod]

I know that this is not my WiFi password. Below that I can see the `Master key` and `transient key` and `EAPOL HMAC` but I don't know how to translate them.

Is there any way to crack WPA2 using Backtrack 5 or some other way?

-

## migrated from unix.stackexchange.comMay 11 '12 at 13:36

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems.

Are your neighbors religious? Maybe you accidentally did their AP instead. – Scott Chamberlain May 11 '12 at 14:48
@scottchamberlain sorry, what is AP? – Sb Sangpi May 14 '12 at 12:39
AP = Access Point, I was saying "Maybe you accidentally connected to your neighbor's wireless router instead of yours" – Scott Chamberlain May 14 '12 at 17:27

As @Awhitehatter said, brute force is the only way to crack WPA2. It is based on the initial handshake and after that the key can be computed offline. The time necessary to crack WPA2 depends on the complexity of the key and your computational power. There are tools which can help you in cracking a relative weak key (common word(s)) by using so called dictionary lists. If not, you can use John The Ripper to compute all the key combinations.

Just to have an idea about the time it takes to crack a normal WPA2 key (actually a password) using brute force (computing all the combinations), let's pick a decent password containing 8 characters, lower and upper case and digits, with a speed of 600 keys/second on a Quad core, we will crack it in... 36 months! Take into consideration that this is the worse case scenario (100% chances of success). You can calculate other timings based on other given password details using the Password Calculator.

Also to answer your question, a step by step tutorial on explaining how you can crack WPA2 using Backtrack is available here and not only...

-

WPA2 requires a minimum of 8 characters for it's CCMP cipher, which is similar to Rijndael. The only way to get WPA2 passwords is a brute force attack. The attack time will depend of various factors: Your computational power (clock speed, amount of cores) Your wordlist length (Usually ranging from Megabytes to Gigabytes) Your password length (If you are cracking a foreign AP, you should not know this length.) Common words in password.

-

To the best of my knowledge, it's fairly difficult to break WPA2. They best you can do is brute force it by renegotiation of the hand shake.

-

You clearly got the `WEP` or `WPA` password of one of your neighbor wireless network (as guessed Scott).

Since this is illegal, and may compromise you, you should locate this neighbor (this is another interesting security topic per se), and inform him.

You will have to inform your neighbour that you accidentaly got his network password, that the technic he is using to secure his network is false security (as usefull as an empty extinguisher). That his technic `WEP` or `WPA` is easily broken by any neighbor within seconds. Then his computer and his network traffic are completely stripped bare.

To stay accidentaly the owner of your neighbor wireless password may compromise you in the same way than keeping the keys of his appartment may compromise you. Let's imagine for a while that this neighbor is a criminal torturing children in his appartement and broadcasting snuff movies on the Internet. To exhibit that you have an access to the network of this neighbor may let him defend on the ground that his network was hacked:

"See, this is not coming from me. My network is hacked and used by this neighbor. All his traffic is coming from my IP address. He did it to hide behind my network access. This is clearly your guy."

The only real security on wireless networks has a completely different kind of name. It's `802.11i`. All the other commercial names starting with `Wi-Fi` are just empty extinguishers.

-