Questions tagged [aircrack-ng]

An 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured.

Filter by
Sorted by
Tagged with
1
vote
0answers
138 views

Is the keystream recovered by tkiptun-ng the same key used to encrypt all data frames between the client and the AP?

Looking at the manual for tkiptun-ng,(http://www.aircrack-ng.org/doku.php?id=tkiptun-ng) The output saves the keystream in the example near the end of the program. Is this the same keystream used to ...
1
vote
3answers
753 views

Handshake not recording

I am trying to crack wireless WEP password of my wireless AP. When I enable monitor mode and issue this command: root#airodump-ng -w TESTFILE1 -c 1 --bssid 68:72:51:58:A3:14 wlan0mon No handshake ...
1
vote
1answer
692 views

How to get attacker mac address aireplay-ng

I'm currently working on a WIPS and I would like to know how to obtain the attacking MAC address when he launches a aireplay-ng deauth attack. On wireshark, if the attacker broadcast the deauth ...
5
votes
2answers
300 views

Aircrack-ng does not have cuda implementation. Are there alternatives?

I need a program to crack .cap files , and would like to use my cuda devices. I know there is pyrit, but I have very severe driver issues on Linux with it and it does not exist for windows, and ...
4
votes
2answers
1k views

How deauth attack works in mkd3

I watched a video on YouTube about it, and the guy did not explain well how mdk3 and its deauth attack works. Can someone please explain me this? P.s: the guy used the tool aircrack-ng; This tool is ...
1
vote
2answers
2k views

Stations not deauthenticating when using Aircrack-ng

I am attempting to conduct a deauthentication attack on a stand alone AP using Aircrack-ng. Im using an ASUS 802.11ac router and using aireplay-ng to send the deauthentication packets. But when ...
4
votes
1answer
345 views

Cant access most websites using a fake AP created by aircrack-ng suite

The question , Setting up a fake AP - problem with iptables and DNS server , I posted before was answered and fixed, to not confuse people looking for the same problem in the future I wanted to post a ...
3
votes
1answer
2k views

Setting up a fake AP - problem with iptables and DNS server

Im trying to set up a fake AP using aircrack-ng suite, DHCP server & iptables. After creating the fake AP: airmon-ng start wlan1 airbase-ng -c 11 -e "freewifi" wlan1mon running iptables ...
-1
votes
1answer
2k views

Aircrack-ng Windows 10 with USB WiFi in Promiscuous mode

I have seen many tutorials and lessons about how to use aircrack-ng suite in Linux. Can I use this suite in Windows 10? If so, from where can I download binaries safely? (if you google, there are ...
0
votes
1answer
756 views

How to connect to AP when attacker is deauth'ing my device?

Scenario is: attacker is disconnecting devices using aireplay --deauth command on AP so none of my devices are connecting to AP. Then what do I do now when none of my device is connected to AP?
0
votes
2answers
808 views

RaspberryPi3 wont show fake AP created by Airbase-ng

Im using Aircrack-ng suite to apply an evil-twin attack with my RaspberryPi3 operated by Kali-linux on another RspberryPi3 with Raspbian Jessie. The steps are as followed: 1.configuring the apache2 ...
6
votes
3answers
9k views

Why use a USB WiFi adapter with Aircrack-ng?

What are the limitations we have when we are performing aircrack-ng pen testing using laptop's built-in WiFi adapter? Many pen testers are using USB WiFi dongles for this purpose and I wonder why. ...
2
votes
1answer
3k views

Airodump on wireless interface error [closed]

I'm unable to airodump on my wlo1 interface. To set things up, first I set wlo1 to monitoring mode: sudo ifconfig wlo1 down sudo iwconfig wlo1 mode monitor sudo ifconfig wlo1 up After running ...
1
vote
1answer
1k views

Broadcast deauth requests are not working

While using aireplay-ng broadcast deauth requests are not working but if i use deauth for specific user it's working fine. But the problem is i don't know how to get the Mac address of specific user. ...
3
votes
2answers
19k views

How to get clients mac address for aireplay-ng [closed]

While I was reading the docs on deauth for aireplay, I found that the parameter -c 'mac addr' is used for deauth of a specific client if I am not wrong. But what I don't know is how to find the MAC ...
4
votes
2answers
1k views

How Aircrack reliable is for decrypting password? other alternative?

I'm testing over a Handshake captured file I have (handshake.cap) launching aircrack attacks against it with a lot of dictionaries and bruteforce to decrypt its password, but I don't have a strong ...
0
votes
1answer
2k views

Finding password length using Airmon-ng and Crunch on Kali Linux [WPA/WPA2]

I want to find the length of a password on my wireless network. How can I monitor/track the behavior of the WiFi reaction to entering the current password? Once I find the exact length of the ...
1
vote
1answer
258 views

Prevention against De-Auth Attack for Handshake Capturing [duplicate]

As far as I know about De-authentication attack, the attacker sends de-auth packets to both router and the victim asking the victim to disconnect and reconnect. But I wonder what would happen if I ...
1
vote
0answers
893 views

Getting “No Answer” When I Test If The Chipset Is Injectable Or Not?

When I tried this command aireplay-ng --test wlan0 I got This : 01:10:49 Trying broadcast probe requests... 01:10:51 No Answer... 01:10:51 Found 2 APs 01:10:51 Trying directed probe ...
5
votes
2answers
959 views

Scan for Vulnerabilities Without Network Connection

I have been search on the internet for some time but can't really find an answer to my question; Is it possible (common) to scan or hack a network device (such as a router or computer) without being ...
3
votes
1answer
4k views

Enterprise Wireless 5Ghz deauth

I am running blackbox pentests on an enterprise wireless setup. My area of attack consists of multiple APs that have a 2.4 GHz interface and also a 5GHz one. I have successfully deauthenticated users ...
3
votes
1answer
732 views

Aircrack-ng: Why deauth works

When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that ...
1
vote
0answers
94 views

How many packets required to deauth WPA? [duplicate]

When using aircrak-ng to attack WPA; Why do I need to send many de-authenticate packets to force the host to deauthenticate? Why is one packet not enough to cause deauthentication?
1
vote
1answer
454 views

Various questions about cracking WEP with aircrack-ng

I'm preparing for Offensive Security's OSWP course. I came across several topics I need clarification on, some of them might be related to my lab that probably works in a slightly different way ...
0
votes
2answers
435 views

why does aircrack-ng need AP name when wordlist read from stdin?

I'm learning wireless. The following command works great: aircrack-ng -w mywordlist <capture file> If I generate the wordlist on the fly by JTR, for instance, then I need to provide -e : root@...
-1
votes
2answers
3k views

How do I brute-force a WPA-2 wifi with Aircrack-ng in Kali Linux?

What I basically want to do is, perform a test on my Wi-Fi and brute force it instead of a dictionary attack. I googled, and all of them showed me examples of dictionary attack and no bruteforcing. ...
0
votes
1answer
469 views

How do I tell my wifi device to stick to a channel

I'm doing the usual exercises with airodump-ng, aireplay-ng etc. When I try to perform a fake authentication to a WEP protected wifi network I get the message quite frequently that I'm sending on ...
7
votes
1answer
2k views

List wireless stations around me

I'm looking to find a specific wireless user around me, I have his MAC address, I even have the channel he is on. I've tried iwlist peers, to no avail, as well as airodump. I have seen his mac pop up ...
2
votes
1answer
629 views

Cracking N Digit Unknown Password

Hi I'm quite new to Aircrack-ng and I just have a quick question. Is there a possible way to determine the amount of digits a wifi password has? In the example below the amount of digits is already ...
3
votes
1answer
678 views

Arp replay for cracking WEP key IN Aircrack-ng

I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
2
votes
1answer
581 views

Strange behavior when injection wifi packets with aireplay-ng [closed]

When I'm testing packet injection with aireplay-ng I can witness a strange behaviour on my Lenovo T510i. Several blogs report my wireless device to be capable of packet injection. But then look at ...
2
votes
1answer
2k views

Evil AP with known WPA2 password

So I have been playing around with the aircrack-ng suite and beef a mitmf. Until now I have been able to host an Evil Twin with DHCP server and providing internet access to connected clients while ...
2
votes
1answer
916 views

Packet Injection during attacks on WPA/WPA2/WEP — How it works

Most Wi-Fi attacks rely on some kind of packet injection. This could be in the form of injecting deauth packets, arp packets, etc. I have a question about these fake packets -- Are they constructed ...
1
vote
1answer
3k views

WPA/WPA2 Handshake — A question on the computation of the MIC

During the WPA/WPA2 4-way handshake, the first two steps are as follows. (1) The AP sends an ANonce to the client, (2) The client computes its own Nonce (SNonce), computes the Preshared Transient Key (...
1
vote
2answers
1k views

Regarding number of packets needed to crack WEP

One of the major weaknesses of WEP is a short 24-bit IV, which means that only 224 packets are needed to exhaust all IVs. 224 translates to about 16.5 million IVs (or packets for that matter). ...
0
votes
1answer
408 views

Attacking WEP — Question on Packet Injection

When attacking WEP, one must use a wireless card which supports packet injection. I have two questions about this. (1) As long as we have a busy network, why would we need packet injection? I thought ...
3
votes
2answers
394 views

Attacking WEP/WPA/WPA2

When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
0
votes
3answers
418 views

Weird problem on airbase-ng

The situation is pretty simple, I'm trying to create a rogue AP, am I missing something? No matter what I do I get the same error message: I tried using different bssid and essid's with the ...
0
votes
2answers
425 views

Does wireless card need to be on same channel as AP to sniff beacon frames?

OBJECTIVE Essentially, my goal is to emulate something like airodump-ng wlan0 Here is a link just in case ... airodump-ng Collects raw 802.11 frames Displays nearby access points and data GAMEPLAN ...
2
votes
2answers
1k views

Ethical Hacking: Cracking my personal wireless network

I am teaching myself ethical hacking. Now, I am attempting to crack the password of my Verizon FIOS Router at home. Using Kali Linux 2 based on this website. Steps So Far On Kali Linux typed airmon-...
1
vote
3answers
503 views

Few questions about aircrack-ng

Hello I recently started playing with aircrack-ng and I have few questions. When I'm starting with the whole process insted of turning on the monitor mode I do the opposite airmon-ng stop wlan0 and ...
-1
votes
1answer
393 views

Deauthenticate ALL wlan networks/clients in range [closed]

I need to deauthenticate all clients in all networks within the range of my wlan-adapter. Aireplay-ng allows only to focus a single network. Are there any programs or scripts i can use for this ...
3
votes
1answer
408 views

missing ESSID from aircrack-ng

I'm using Mac OS X and I was able to sniff packet from my homeNetwork (in order to learn more about how things goes on). I'm sending a deauth command to all my devices to disconnect them and then ...
9
votes
3answers
42k views

Turn RPi3 Wi-Fi adapter into monitor mode using airmon-ng

For some reason, I can't turn the built-in Wi-Fi adapter on the new Raspberry Pi 3 into monitor mode like I used to do on other platforms. First I kill the processes that interfere with sudo airmon-...
1
vote
3answers
2k views

aircrack-ng fed with crunch taking ages

I'm trying aircrack-ng attack like below: crunch 1 2 -f /usr/local/Cellar/crunch/3.6/share/charset.lst mixalpha-numeric|aircrack-ng -b 90:F6:52:80:B9:E2 -w - ~/DumpLog* ⋮ Crunch will now generate the ...
1
vote
1answer
4k views

How to enable WiFi while using two wireless cards one in monitor mode and other in managed mode?

I have two wireless adapters, one is internal PCI wireless adapter (wlan0) while other is USB wireless adapter (wlan1). I put wlan0 in monitor mode and wlan1 is in managed mode. But, after running ...
3
votes
2answers
1k views

Aireplay-ng doesn't work properly on Ubuntu

I want to do De-auth attack on Ubuntu 14.04 using Aireplay-ng. I am using alfaawus036h, so when I tried it on Kali or Backtrack, after plug in, it worked fine and there was no problem. but when I ...
3
votes
1answer
2k views

PMK/s and Keys/s: Which is faster?

I'm struck with the fact that almost all tutorials on the internet specified speed of aircrack-ng in Keys per second and the speed of pyrit as PMKs per second. So, leaving the fact that it runs on ...
0
votes
1answer
3k views

Android devices are unable to connect to Rogue Acces point created using Airbase-ng

I have created a rogue access point using airbase-ng, but I can't connect to it using my android phones (note II, S4), when I tap on the access point all I get is: Obtaining IP address...', than ...
2
votes
4answers
7k views

How long til a 4-way handshake is captured with Aireplay-ng

I've got a TP-Link TL-WN722N wifi adapter which I believe allows monitoring/injection to a network (was reassured by the comments of other users). When I follow a guide by Vulnerableuser I can get to ...