3

I have some specific problem. Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

I need it for my bachelor thesis, where I am using android app WIBR+ which simply tests all words from my own dictionary one by one, but if it finds the password, it should also connect to the Wi-Fi.

The problem is, that I am testing the security of WI-Fi networks which are not mine and even if I had an agreement from the owner of the Wi-Fi every time, it is necessary not to join to the Wi-Fi due to law but to just find out what the password is.

So my question is if there is any program (utility) which I can run on Android and which prevents from connection to Wi-Fi. My supervisor of the bachelor thesis also told me that it may be possible with some FW rule, but i am not really sure how to deal with it.

EDIT: I am testing vulnerability of some specific internet provider in my city. In fact it's all about finding default password of the Wi-Fi with dictionary. I actually have to walk around the city and search as much as possible Wi-Fi networks which fall within this provider and can have these vulnerability. Then it is necessary find out who is the owner of the Wi-Fi by the signal strength and ask him if i can check his Wi-Fi for this vulnerability. So using WIBR is probably the only one app on android which can I use, because it simply test words from my own dictionaries and that's exactly what I need. (I also have to use for every Wi-Fi network specific dictionary - not still the same) I didn’t find another app for android which does what I need and using laptop would be really impractical. Creating my own Wi-Fi doesn't help me too and I can't also afford do any de-authentication attack and kick legitimate users in my case.

  • I have not got a definitive answer for you but look into this aircrack-ng.org/doku.php?id=cracking_wpa .. it might be for linux but it could give you some ideas. do you have to use WIBR? – TheHidden Mar 22 '18 at 9:03
  • 1
    Does these laws specifically forbid successful connections to the mentioned WiFi networks? Usually, these kinds of laws forbid unauthorized interactions. Were this true, this would also forbid you to use any cracking utility. I would advise you to set up your own WiFi network. This way you would 1) not have to worry about breaking any law, and 2) have a total control on the tested environment, which for a thesis sounds better. Otherwise, and as pointed by TheHidden, WiFi attacks use off-line cracking after retrieving the necessary data. – Yuriko Mar 22 '18 at 9:07
  • 6
    The top commenter has it - you will have to have some interaction with the AP in order to get the password, but what the above suite does is kick legitimate users off the wifi (your contact with the AP, by using a deauthentication attack) and then forcing clients to connect to you. Each time that happens, you get a little piece of the handshake puzzle, eventually having all of it, which you can then use to crack offline. – Ian Mar 22 '18 at 9:08
  • @Ian yup! exactly what I was going for, thank you for doing the words. lol – TheHidden Mar 22 '18 at 9:25
  • Thanks for your answers, I edited the post based on your recommendations. I couldn't add the text here because it was too long. – AizyB Mar 22 '18 at 10:28
2

I am testing the security of WI-Fi networks which are not mine

I will assume you are acting in good faith and that this was passed by some ethical committee at your university. If not, I urge you to cease doing this and wipe any cracked passwords immediately, until you have such consent.

Is there any possibility how to find out Wi-Fi password with dictionary attack without connecting to the Wi-Fi?

Sure. You're doing a bachelor's thesis in IT I assume? In that case, I'd say you should know this... but anyway, to answer the question, WPA2 does a handshake. If you capture the handshake, you can use it to brute force the password offline. This is also much faster than the online attack you are doing. The only requirement, since you need that handshake, is that you capture someone connecting to the WiFi network.

If I remember correctly, you need someone who successfully connects, but I might be wrong (i.e. you might be able to try to connect yourself with a password that you are sure will not work, and then use that handshake to brute force).

For the sake of completeness, in order to obtain such handshakes, you could do a deauthentication attack. Clients will automatically reconnect and you will get a positive handshake. I would however recommend that you do not do this, because it disturbs legitimate users (ethically wrong) and it's also illegal in any jurisdiction I know of (it's not jamming a signal exactly, but I'm reasonably sure I read about a conviction because it's close enough to be considered jamming).

I am using android app WIBR+ which simply tests all words from my own dictionary one by one, but if it finds the password, it should also connect to the Wi-Fi.

Which is illegal, by the way. The Dutch law states one may not break into an automated system in such a way (it's even a felony if I remember correctly, not a misdemeanor or infraction), and I'm sure your country has similar laws.

Cracking the password is one thing; then using it to break into an automated system... that's where it becomes 100% sure to be illegal. But you seek to prevent doing that, which is good.

If the tool is open source, you could modify it to not include the connection part. And if it's not, you could patch the bytecode if you have the skills.

But since online attacks are slow, I don't see why you want to do this sort of attack anyway. It'd give much better (more reliable) results if you can do the cracking offline, and by doing it offline, you don't risk connecting to the network either.

Tools to do this are available in Aircrack-ng. Please use them responsibly; I believe I've given ample warning about the legality of your actions by now.


Edit: I missed this part:

find out who is the owner of the Wi-Fi by the signal strength and ask him if i can check his Wi-Fi for this vulnerability

Ah, so you ask the owner for permission. That's good! Now I understand what you are doing a lot better. In that case, I'd not be afraid of joining the network: you have permission and you will disconnect immediately anyway, so what does it matter that it connects?

  • If he's in the USA he's pretty likely to violate the CFAA doing this. It's a ridiculously overly broad law, but he can get convicted of violating it all the same. en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act – Adonalsium Mar 22 '18 at 12:52
  • Thanks for your reply. I of course agree with you that using WIBR+ is illegal if you are trying break into stranger's Wi-Fi without their agreement. But I don't understand why it should be illegal, if I will find the owner of the Wi-Fi and will try it in his presence and with his agreement. One part of my thesis in a simplified way is prove that some networks of this internet provider have still vulnerable default passwords even if they announced that they will fix it. – AizyB Mar 22 '18 at 13:30
  • So I need just search Wi-Fi networks which are connected with this problem, explain the situation to the owner and with his agreement test some pregenerated passwords to see if the problem still persist. In view of the fact that these Wi-Fi networks should be still vulnerable, I will show to the owner that it is possible find out password of his Wi-Fi and therefore basically everybody can connect to his network so he should change it.(If he is still using default password) – AizyB Mar 22 '18 at 13:31
  • 1
    @AizyB The firewall option is also a way to do it. If you block DHCP traffic, you will not get an IP address configured and won't be able to communicate over the network. You can also create your own app, or indeed look for another one. – Luc Mar 22 '18 at 15:48
  • 1
    @AizyB Rooting just means you become the real owner (administrator) of your own device, so I'd always recommend that. But aside from that, yes, I think it's necessary to have root for the firewall option. If you don't want to root your own device, perhaps you can lend someone else's? Your university probably has some, perhaps pre-rooted, for research purposes. – Luc Mar 23 '18 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.