Loki How to crack the password hash OSPF?

Question

I have created for myself a lab of routers in GNS3 . Routing protocol between routers is OSPF.

Now,by Loki penetration testing, I found that routers are the feature authentication. Using wireshark, I do sniff network traffic. I see only Hello Packet in attacker's system.That is very normal.

Within this package do not see any hash password (MD5) that it would crack, Using crack sites online.

My question is how Loki crack passwords by the list of words?

Loki has access to the password hash value? Where in the packet is the hash value?

Answer 1

Hash authentication of protocol packets is not on by default in OSPF, you'll only see hash digests if digest authentication is on with a pre-shared key configured. If you're looking for the encrypted digest packets you'll find the information you're looking for in RFC 2328 section D.3

'Using this authentication type, a shared secret key is configured in all routers attached to a common network/subnet. For each OSPF protocol packet, the key is used to generate/verify a "message digest" that is appended to the end of the OSPF packet. The message digest is a one-way function of the OSPF protocol packet and the secret key. Since the secret key is never sent over the network in the clear, protection is provided against passive attacks. `

Looking forward in section D.3 it looks like the way forward is to look for the key ID, then pull the length of the digest from the auth len section. Then all you have to do is read that length from the back of the packet, minus any footer, and you have the digest. See D.4 as to how it is generated.