I'm preparing for Offensive Security's OSWP course. I came across several topics I need clarification on, some of them might be related to my lab that probably works in a slightly different way compared to OffSec's lab.
Purpose of fake authentication The course tells us the steps needed to crack a WEP are this (I know there are many different methods but let's focus on this one for the moment): a. I start airodump-ng and filter on my target AP and channel b. I run a fake authentication (with or without psk doesn't matter much to the point of my question) c. I listen for ARP packet. d. Once I receive a suitable ARP packet I replay it until aircrack-ng has enough IVs to crack the key e. I can speed up the ARP packet creation through deauthenticating one of the clients. When it reconnects it will send an ARP packet Here comes the question: In my lab, there is a test client connected to the network DOING NOTHING. In a real world scenario, wouldn't there be a lot of traffic because people are surfing, accessing file shares, whatever? Would I ever need to deauthenticate someone to receive an ARP packet? I'm asking because of the problems in question 2 and 3 (see below).
In my lab, deauthenticating my client doesn't work well. Or, more precisely, deauthenticating works great, only the client doesn't automatically send an ARP packat after that. I have seen several times where the PWR count in airodump-ng's output went to 0 for a very short moment, followed my a normal value (-27, -30, sth like that), so the client reconnected, but no ARP packet was picked up by aireplay-ng's ARP replay attack. The only thing that helped was to switch off/on the wifi adapter on the client. Then, an ARP packet was sent immediately and the key was cracked within seconds. As the course material suggests, I could also force the ARP packet creation by doing a ping from the client. Am I doing sth wrong or is the problem that my lab devices are just working differently than other devices?
This is kind of a similar question to #2. When attacking WEP with PSK, I capture the XOR keystream file I need for fake authentication. My problem is that this works only ONCE. After that, the authentication doesn't go beyond step 1. I have captured the traffic with wireshark and see below the error message. I found out I can fix this by: a) switching off/on the wifi adapter on the client, and starting a new capture with airodump-ng (and then, having a new XOR keystream file) or b) restarting the wifi router. Just to be clear, the second time also doesn't work if I deauthenticate the client and run a new airodump-ng capture in order to create a new XOR keystream file, after restarting the client wifi device it only works one single time no matter what I do. I am pretty confused.
So maybe you see now why I'm asking question 1. The fake authentication makes a lot of problems but most of the attacks would work if I could just replay an ARP packet. I was thinking that the fact I don't get any is due to the lab setup (only one client connected, noone really using that network) and if that wasn't a problem I wouldn't need any fake authentication...
Discaimer: I have checked my card can do packet injection, all devices are running 802.11bgn, etc. etc.