Various questions about cracking WEP with aircrack-ng

Question

I'm preparing for Offensive Security's OSWP course. I came across several topics I need clarification on, some of them might be related to my lab that probably works in a slightly different way compared to OffSec's lab.

1. Purpose of fake authentication The course tells us the steps needed to crack a WEP are this (I know there are many different methods but let's focus on this one for the moment): a. I start airodump-ng and filter on my target AP and channel b. I run a fake authentication (with or without psk doesn't matter much to the point of my question) c. I listen for ARP packet. d. Once I receive a suitable ARP packet I replay it until aircrack-ng has enough IVs to crack the key e. I can speed up the ARP packet creation through deauthenticating one of the clients. When it reconnects it will send an ARP packet Here comes the question: In my lab, there is a test client connected to the network DOING NOTHING. In a real world scenario, wouldn't there be a lot of traffic because people are surfing, accessing file shares, whatever? Would I ever need to deauthenticate someone to receive an ARP packet? I'm asking because of the problems in question 2 and 3 (see below).

2. In my lab, deauthenticating my client doesn't work well. Or, more precisely, deauthenticating works great, only the client doesn't automatically send an ARP packat after that. I have seen several times where the PWR count in airodump-ng's output went to 0 for a very short moment, followed my a normal value (-27, -30, sth like that), so the client reconnected, but no ARP packet was picked up by aireplay-ng's ARP replay attack. The only thing that helped was to switch off/on the wifi adapter on the client. Then, an ARP packet was sent immediately and the key was cracked within seconds. As the course material suggests, I could also force the ARP packet creation by doing a ping from the client. Am I doing sth wrong or is the problem that my lab devices are just working differently than other devices?

3. This is kind of a similar question to #2. When attacking WEP with PSK, I capture the XOR keystream file I need for fake authentication. My problem is that this works only ONCE. After that, the authentication doesn't go beyond step 1. I have captured the traffic with wireshark and see below the error message. I found out I can fix this by: a) switching off/on the wifi adapter on the client, and starting a new capture with airodump-ng (and then, having a new XOR keystream file) or b) restarting the wifi router. Just to be clear, the second time also doesn't work if I deauthenticate the client and run a new airodump-ng capture in order to create a new XOR keystream file, after restarting the client wifi device it only works one single time no matter what I do. I am pretty confused.

So maybe you see now why I'm asking question 1. The fake authentication makes a lot of problems but most of the attacks would work if I could just replay an ARP packet. I was thinking that the fact I don't get any is due to the lab setup (only one client connected, noone really using that network) and if that wasn't a problem I wouldn't need any fake authentication...

Discaimer: I have checked my card can do packet injection, all devices are running 802.11bgn, etc. etc.

Answer 1

First of all, I strongly suggest you narrow down your questions, I'm prety sure people haven't answered because it's really hard to read and there are many questions. Try making a conclusion question o highlight the details, this stack exchange has rich text editors. Try reading this.

Still, I'll try my best to answer everything.

1. You should start by reading the manual

It should be noted that the fake authentication attack does NOT generate any ARP packets

The purpose of fake auth is to add (associate) your mac to the AP, so he thinks you are OK (When you do a ARP replay attack you can spoof the MAC from an already auth client, but let's follow your case)

a) I start airodump-ng and filter on my target AP and channel: This is done to create a capture file, a dump of the captured packets, the filters are made to drop any noise or broadcasts not needed in the process to crack WEP (quick tip, you can add --ivs to filter ONLY the ivs which is the only thing you need to crack the WEP key)

b) I run a fake authentication (with or without psk doesn't matter much to the point of my question): Ok, I already answered the purposed of this

c) I listen for ARP packet.: This is needed to replay it to the AP so it generates more IVs, it's called ARP request replay attack

d) Once I receive a suitable ARP packet I replay it until aircrack-ng has enough IVs to crack the key: Ok, we are doing just fine.

e) e. I can speed up the ARP packet creation through deauthenticating one of the clients. When it reconnects it will send an ARP packet: No, there's no need to de-authenticate, you already said you got a suitable ARP which you will replay, why do you want to disconnect the client? This would be only in the case you still DO NOT HAVE A SINGLE ARP request.

And now to the question of subsection 1) You are right, generaly right after the initial conversation (probe request/response, auth reqest/response asociation request/response) there will be some ARP.

2. No idea why is this happening, but PWR has nothing to do with the attack, the control frame used in deauth-attack is only to disassociate the station with the AP, it's not meant to hinder the signal of the antenna.
3. I'm not sure why do you want to catch the keystream, or how you intend to do it, but the weakness of WEP lies in the IVs, there are some weak IVs that can be used to crack the key. They keystream is generated by the RC4 with PRNG, and to seed the RC4 you need the IV + the WEP key, so if you are actually sniffing, you can only get the Ciphertext which has already been xored by the IV + keystream and the data + checksum.