WPA/WPA2 networks cracks methods

Question

There are some software that states that can crack WPA networks, however that is not an easy task as the initialization code for WPA2 uses a four-way handshake to properly initialize all of the vectors that are used in the actual encrypting. So in order to properly break it you need to sniff the traffic that gets sent back and forth during a session initialization. However, because this is a WiFi it's not uncommon for packets to not be sniffed properly. So you should be aware that you may have to initialize the connection more than one time. Again, see the link I posted.

As for not knowing the carrier frequency there are a few ways to approach the issue. As the link pointed out they suggest getting an antenna. This is the best option when you're doing anything with WiFi. However, if you have reason to believe the access point is on a standard frequency discovering it could be as simple as an App on a smartphone to search for networks. But if you're doing this with any kind of frequency you should get an antenna and look for some guides on how to interact with it; they're all over the place.

Another approach would be to look at the client. Since you asked this question on an RE forum I'm assuming you have access to at least one of the access points so you can attack it from that angle and try to trace what happens when the connection is initiated.

Now If I try to protect my network, bacause neighbours didnt want to make a deal to get one internet account, and also I could not get a key easily, but have to wait like 6 hours.

What software or method have you used that acctually works?

Answer 1

First i would like to suggest that it seems like you forgot to post the link you were talking about, or i just missed it. Apart from that one basic approach, which definitely will work, assumed that you checked the requirements well, would base on exploiting the WPS (Wifi Protected Setup). To give you a short impression of how it works, you have to imagine that WPS offers a way to establish a connection by for example entering the WPS Pin (Aside this there are a bunch of other WPS Methods, like the WPS PBC [Push Button Configuration], WPS UFD [USB Flash Drive] and WPS NFC [Near Field Communication]). For educational purpose it suffices if we take a look at the WPS Pin-Method, take a look here for a documentation on how to connect to a router with WPS.

Wash

Wash is a utility that identifys WPS enabled Access-Points. It can survey from a live interface and will only show access points that support WPS. So as you can see a great tool for this purpose and some kind of derivate of airodump. For the official Wash-Documentation, take a look here.

Reaver

After you checked if the AP provides WPS based connectivity, you could exploit it using it using the Reaver tool, which all in all realizes a Brute-Force-Attack to crack the Pin and as the Pin in most cases does is not longer than about 4 Digits, there are only 10^4 = 10.000 different possibilities to try. Brute-Forcing this should take a couple hours, worst case. For the official Reaver-Documentation,take a look here.

So summarizing what we discussed till here:

1. Check if WPS is enabled for the target, using Wash-Tool.
2. Crack the WPS-Pin and use it to connect, because if you got the Pin, even the longest and most complicated WPA/WPA2 password is useless.

Answer 2

if WPS is disabled, you can use a different method to get WPA/WPA2 password in a few seconds by using Linset in kali linux How it works: Scan the networks. Select network. Capture handshake (can be used without handshake) We choose one of several web interfaces tailored for me (thanks to the collaboration of the users) Mounts one FakeAP imitating the original A DHCP server is created on FakeAP It creates a DNS server to redirect all requests to the Host The web server with the selected interface is launched The mechanism is launched to check the validity of the passwords that will be introduced It deauthentificate all users of the network, hoping to connect to FakeAP and enter the password. The attack will stop after the correct password checking Are necessary tengais installed dependencies, which Linset check and indicate whether they are installed or not.

It is also preferable that you still keep the patch for the negative channel, because if not, you will have complications relizar to attack correctly.