1

Why aircrack needs info such as target's BSSID,Channel and more? Also what do those files do? I know one of them is used to save the handshake. But others? Also, how deauth helps in cracking the password when there is a dictionary?

Why ESSID and dictionary file aren't enough?

|improve this question
  • 1
    Those are not files. Those are parameters. BSSID is the MAC Address of Access Point and channel on which your wifi adapter listens. – defalt Oct 29 '17 at 16:41
  • @defalt i know that but why doesn't aircrack just ask for the ESSID and then get the channel and MAC automatically? – Vamputer123 Oct 29 '17 at 16:44
  • Which command of aircrack suite you are pointing to? – defalt Oct 29 '17 at 16:45
  • This one: airodump-ng -c channel --bssid <MAC> -w /root/Desktop/ wlan0mon. Can't i just say airodump -ng --essid <name> <dictionary> and then aircrack finds the channel and BSSID matching to the target. Also how deauth helps with cracking the password? – Vamputer123 Oct 29 '17 at 16:53
  • This command is used for capturing the 4-way handshake. Dictionary file is not used in this. Your wifi adapter listen on a channel -c and search for access point whose --bssid is given. Wifi adapters recognize Access Points with their MAC Address so you can't avoid typing bssid. – defalt Oct 29 '17 at 17:10
3

Tried to pull out a few questions from this:

Why isn't the ESSID enough?

I'd like to point out that in many large, distributed Wi-Fi setups (think corporate or campus networks), there will be several, possibly many access points (APs) broadcasting the same ESSID in a given physical area. Each AP will have its own BSSID, since each piece of network hardware has its own MAC address. Being able to filter by BSSID allows you to focus on a single AP for attacking. Most attacks will typically target a single access point (e.g. using aireplay-ng, you generally must target a specific BSSID).

Why must I specify the channel?

airodump-ng is fairly low-level and barebones, and makes little-to-no assumptions about what you are trying to do with it, so it makes sense that the channel must be specified manually. Note that aireplay-ng is capable of auto-determining the channel given a specific BSSID when launching some attacks, but this tool has a different purpose.

Setting the channel is also useful if you want to capture all of the traffic on a given channel.

Why can't I specify a dictionary file for airodump-ng?

The main job of airodump-ng is to capture Wi-Fi packets. It makes no assumptions about what you want to do with said captures; whether you just want to log them or are going to try and recover a network's pre-shared key (PSK). The functionality for attacking captured WPA handshakes resides in the separate aircrack-ng tool.

How does deauth help with cracking the password?

It doesn't help with cracking the PSK. We use crafted deauthentication frames to kick devices off of the network so that they try to re-associate, thus performing the 4-way WPA handshake again. The 4-way handshake contains the information that we need in order to crack the PSK offline. Crafting deauthentication packets isn't strictly necessary to obtain the 4-way handshake; devices may (re)connect and perform the handshake on their own. In some scenarios, it may not be desirable to send deauthentication frames since it is a noisy operation and can be detected by wireless intrusion detection systems.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.