# What would be the most efficient way of brute forcing a wifi key [duplicate]

I was wondering how can a brut force of my wifi be prevented so I want to know the best technique that can be used to brute force it first, so protection isn't my question. My question is: What brute forcing techniques (in detail) would be the best (efficient/ fast) to perform a brute force attack on a WPA2 wifi to get the passcode.

• Well I'm only interested in brute force – Vadim Tatarnikov Oct 12 '15 at 13:03
• The linked question address precisely this request: what tools to use (aircrack-ng), how to use them (link to a video), how to speed things up (dictionary, rainbow tables). – WhiteWinterWolf Oct 12 '15 at 13:05
• Yep sry my bad I read the question first not the answer. Thanks will look deeper in to it – Vadim Tatarnikov Oct 12 '15 at 13:09
• Does brute force potentially involve a wrench? – Francisco Presencia Oct 12 '15 at 15:48

## Brute force is brute force

By definition, "brute forcing" a password or key involves trying every single combination of characters until you find the one that works.

There are differences in strategy which might be faster: for example if attacking a specific ISP's router you may know that they always assign 8 character upper-case-and-numeric passwords, which leaves you with a smaller sub-set of possible keys.

But there's no guarantee that the key hasn't been changed to use a different approach - for example I routinely change my WiFi passwords to a longer, more complex password - in which case you won't even know that your strategy is wrong until you've tested every combination in your strategy. At which point you'd then have to revert to a full brute force approach.

Similarly you can attempt to use a dictionary attack, if you expect the key to be a word (or combination of words, or bastardization of words, for example P4\$\$W0rD!), but again there's no guarantee that the password has been changed to use this scheme, and the only way to be sure is to test.

And finally if your basic strategies fail, you're back to trying to crack all the possible combinations... which is a number bigger than I can be bothered trying to remember the word for.

In short

There is no "efficient" way to crack a password - there are a few ways that may be efficient if the password is insufficiently complex to be secure, or follows a simple strategy - but they only work if you (the cracker) pick the correct strategy. If not, you're actually being more inefficient.

• +1 for the implication that ISPs don't necessarily choose good schemes. I've seen too many where the default key is only 8 uppercase letters. And we know how secure that is nowadays. Mind you, the infamous WEP used 8 numbers, which makes me wonder how it was ever approved. – underscore_d Oct 12 '15 at 15:22
• You don't make things less efficient by checking restricted spaces first. Checking all passwords up to and including length N is quicker than checking all passwords of length exactly N + 1. Unless I just massively maths failed there... – OrangeDog Oct 12 '15 at 15:23
• You make things less efficient by checking restricted spaces first unless you then exclude them from the entire space later - in which case you've wasted time configuring the exclusive strategies switching between them.... – Jon Story Oct 12 '15 at 15:25

This can't be answered generally because it relies on the PSK. You can create a strategy for cracking passwords but there is no holy grale that will get you into every network in a few hours. Im using wordlists and mangling. Mangling uses the given words and modifies them using given rules. John The Ripper can do this for example. I'm generating wordlists this way:

• Keyboard combinations
• Commonly used passwords (mangling it)
• Numbers from 0 to 9999999
• Wordlist attack with common words in the local language (~300.000 Words, mangling it)

If this doesn't bring any result Im creating a relativly small wordlist that is tailored to fit the target by harvesting webpage that are in some kind of correlation to the target:

• The targets Website
• Competitors Website
• Professional Branch related Websites
• The Social Network Pages of Employees and all associated links

After creating a wordlist of between 150.000 and 500.000 Words Im trying it again using mangling.

Technically I would suggest you always to use Graphic Cards instead of CPU power. CUDA Cards arent that expensive anymore.

• How do you brute force though, what programming language do you use/ software, what algorithm idea/ technique? – Vadim Tatarnikov Oct 12 '15 at 13:07
• With CPU: `aircrack-ng` with GPU: `ocalhashcat`or `pyrit` – davidb Oct 12 '15 at 13:09
• And is it possible on any operating system or only Linux? – Vadim Tatarnikov Oct 12 '15 at 13:10
• I suggest you to use Kali Linux because there all three applications are available as packets so you dont need to compile them. – davidb Oct 12 '15 at 13:11
• For reasons of performance I suggest you to install it directly. Also if your seariously interested in security: Get along with Linux! – davidb Oct 12 '15 at 13:13