2

So I'm trying to hack my own WiFi using aircrack or reaver but have had no success with either. With aircrack I cannot achieve a successful handshake as the deauth doesn't seem to have any effect on my targeted devices. This is what it outputs:

root@kali:~# aireplay-ng -0 0 -a C0:05:C2:3B:8E:42 -c 98:9E:63:A1:E7:03 wlan0mon

20:21:49  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 8| 1 ACKs]

20:21:59  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [34| 0 ACKs]

20:21:59  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 3| 2 ACKs]

20:22:00  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [21| 5 ACKs]

20:22:10  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 9| 2 ACKs]

20:22:10  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

20:22:11  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [12| 0 ACKs]

20:22:20  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [11| 0 ACKs]

20:22:21  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

20:22:21  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

In addition, with aircrack, sometimes when i try to use the deauth command it says:

20:24:09  Waiting for beacon frame (BSSID: C0:05:C2:3B:8E:42) on channel 6

20:24:09  wlan0mon is on channel 6, but the AP uses channel 1

However, normally I can just keep trying and the two channels will sync up. I don't know if this has any impact but on my airodump terminal, the first line of the table keeps changing the 'fixed channel' number. (The 9 keeps changing):

CH  1 ][ Elapsed: 7 mins ][ 2018-01-06 20:23 ][ fixed channel wlan0mon: 9 

With Reaver, the command is executed and goes to check the first pin but it gets stuck and repeats this over and over again:

[+] Waiting for beacon from C0:05:C2:4B:7D:48

[+] Switching wlan0mon to channel 1

[+] Received beacon from C0:05:C2:4B:7D:48

[+] Vendor: AtherosC

[+] Trying pin "12345670"

[+] Associated with C0:05:C2:3B:8D:41 (ESSID: VM7781911)

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

Anyone know where I've gone wrong or how to fix these problems?

EDIT: When I enter my card into monitoring mode it outputs this:

PHY      Interface      Driver      Chipset

phy0     wlan0          iwlwifi     Intel corporation wireless 3165 (rev 79) 

                    (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0wlan0mon])
                    (mac80211 monitor mode vif disabled for [phy0]wlan0)

Is this okay?

  • Are you running airodump with the -c channel flag? If not, you should be. Otherwise, it will constantly hop channels, which is not what you want. – multithr3at3d Jan 7 '18 at 15:39
  • No, I’m not usually. Thanks for letting me know. Know anything about my other problems, though? – Non0 Jan 7 '18 at 22:17
  • See if that helps any of those issues – multithr3at3d Jan 7 '18 at 23:14
  • No chance, had no effect. Thanks for your help though – Non0 Jan 8 '18 at 17:04
  • When i enter my card into monitoring mode it outputs this: PHY Interface Driver Chipset phy0 wlan0 iwlwifi Intel corporation wireless 3165 (rev 79) (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0wlan0mon]) (mac80211 monitor mode vif disabled for [phy0]wlan0) Is this okay? – Non0 Jan 8 '18 at 17:20
1

You need to set an amount of packets to send, 0 is 0, send nothing, put more than 0 :D (deauth)

-0 22

root@kali:~# aireplay-ng -0 22 -a C0:05:C2:3B:8E:42 -c 98:9E:63:A1:E7:03 wlan0mon

[EDIT]

Also, run airmon-ng check kill before you start as said by G. T

  • Isn’t 0 just infinite? I’ve tried using other amounts too but that didn’t help either... – Non0 Jan 9 '18 at 7:12
  • Could it be that my WiFi adapter doesn’t support this kind of stuff? – Non0 Jan 9 '18 at 7:13
  • Do you have errors ? – Pixar Filmz Jan 13 '18 at 0:36
0

I had somewhat the same problem. I could deauth clients, but never got the handshake.

Before starting the first airodump-ng Run this command: airmon-ng check kill

This did the trick for me. Some processes were standing in the way for the handshake to be caught correctly.

Also, when you have done the first airodump-ng to find the Mac address. Stop that dump from running. Start a new one, one only the channel you need.

  • So I tried using deauthenticating clients from another laptop and it worked so I think my first laptop’s wireless adapter didn’t support packet injection. In addition neither laptop worked with Reaver so I guess my router is protected against it? – Non0 Jan 21 '18 at 12:07
  • Is there anything I can if my wireless adapter doesn’t support packet injection? I tested like suggested above and no, it does not support packet injection. – Non0 Jan 21 '18 at 14:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.