Questions tagged [wep]
Wired Equivalent Privacy (WEP) is a security protocol for 802.11-based wireless networks.
81 questions
2
votes
1
answer
391
views
RC4 decryption with WEP
I just want to make sure what I know is correct about why WEP isnt secure.
When a client wants to send data to AP using WEP, the WEP key (which is the password the user uses to connect to wifi – so ...
- 23
0
votes
1
answer
135
views
Can I make a WEP wifi and crack it using two virtual machines?
I am using VirtualBox, Kali linux as the attacker vm and xubuntu as the supposed AP. However, I only have my wireless pcie card on my actual pc and it seems that making a virtual interface card doesn'...
- 11
1
vote
0
answers
183
views
WEP .pcap example, need help finding one [closed]
I first wanted to simulate a WEP wi-fi network using virtual machines and then intercept data/crack it but it seems that I need actual wireless interfaces which I do not have and using my own in my ...
- 11
0
votes
1
answer
157
views
WEP keystream extraction
After having captured multiple packets with repeated IVs you can perform cipher1 XOR cipher2 which is the same as having cleartext1 XOR cleartext2, and performing cipher1 XOR cleartext1 gives you the ...
1
vote
0
answers
274
views
WEP fake authentication purpose
I am studying WEP protocol and more specifically fake authentication attack. Man page says
This is only useful when you need an associated MAC address in various aireplay-ng
attacks and there is ...
- 213
0
votes
1
answer
162
views
Catch enough IV to be in the FMS attack
I am doing WEP attack test using FMS method (Fluhrer, Mantin and Shamir), but not capturing enough 4,000,000 to 6,000,000 IV.
Please show me how to catch enough IV.
1
vote
3
answers
533
views
How can wireless password cracking be detected?
Our team was hired for a red team engagement for a client. A part of the engagement is attempting to crack the WiFi passwords of their office APs. However, we obviously want to stay undetected. What ...
- 885
2
votes
1
answer
197
views
WEP QOS_DATA vs DATA decryption - difference?
I recently played a bit with my hardware pocket size IV WEP sniffer.
It's a 5v tool that i use in my lab when bored:
https://www.youtube.com/watch?v=jJyRaWrnbJg
In my tests i figured out one of my ...
- 225
1
vote
1
answer
2k
views
WEP cracking - Why does many IVs allow to actually get the cipher key [duplicate]
I've been reading a lot about WEP cracking on online resources very recently, however there is one question that no website gives answer to I believe.
I would like to first understand the theory very ...
- 433
1
vote
1
answer
273
views
Set up a WEP network as safely as possible [duplicate]
WEP is dead and no one should use it... but I have a couple of devices that I would like to use (mainly an original DS that does not support any of the newer standards)
Is it possible to set up a ...
1
vote
1
answer
4k
views
How to speed up brute forcing of finding a WEP key from a captured file?
I have been working on decrypting a WEP .cap file using crunch. It has 1268 IVs. I am wondering:
Can I get a clue from the captured file to speed the process of brute-forcing?
If not, what other ways ...
- 45
-5
votes
1
answer
3k
views
Has Wi-Fi hacking gotten almost impossible?
I have read about Wi-Fi password cracking for a while and used different tools my self, such as:
Airodump for monitoring
Aicrack for getting key from cap files for WEP/WPA/WPA2
Reaver for WPS
Bully ...
- 1
0
votes
1
answer
663
views
is it possible to create a WEP wifi that accepts any password?
the same as evil twin fluxion but without captive portal so the victim connects to our fake Wep Wifi that accepts any password after getting disconnected from his Wpa 2 Wifi so we sniff data from the ...
- 117
2
votes
1
answer
2k
views
ARP request replay attack - why do APs work the way they do?
ARP request replay attacks are based on the practice that wireless access points repeat ARP packets injected into the network, and since these ARP packets are encrypted, they also carry the IV with it....
- 123
1
vote
3
answers
372
views
Does use of WEP only open the network to attacks in proximity of the router?
I'm learning about security, and discovered my family's router was set to use WEP, with WPS enabled. I've fixed that, but I couldn't give a great answer for why it was necessary, given that we live in ...
- 113
20
votes
3
answers
11k
views
Is WEP still a thing?
I was studying the Wi-Fi security section for a pentesting certification the other day and there is an extensive part about cracking WEP. Is going in-depth on WEP cracking worth it anymore?
According ...
- 329
0
votes
0
answers
28
views
Where is exposed WEP key in auth mecanism? [duplicate]
I know that WEP cipher is unsecure and offers no protection. It is said that in this authentication process, the WEP key is exposed,but, where, in what frame, is the key exposed? I know how the ...
- 523
2
votes
2
answers
1k
views
How bad is WEP security presently?
I just discovered that a wireless network that I frequently connect to still uses WEP security. How bad is this for me, the end user of the network? What steps should I take to secure my devices, ...
- 121
2
votes
1
answer
13k
views
How to find a wep key inside a pcap file with only 2 IV?
I have a pcap file that contains 3 packets. I need to find a WEP key inside these packets. These packets contains only two IV. It's not a live attack so I can't try brute force.
user163054
2
votes
2
answers
2k
views
Data sniffing on a WEP 128-bit encryption
I am relatively new to cybersecurity and hacking and I aim to learn ethical hacking as a passion alongside my mainstream education(Electrical Engineering).
My setup: I have set up my very own WEP ...
- 121
1
vote
0
answers
2k
views
Different CRC32 implementations? different results?
So recently I managed to implement the Caffe-Latte attack in python. I got stuck for two weeks because the final ICV wouldn't match.
After some digging around I found that airbase-ng (which already ...
- 143
0
votes
1
answer
504
views
Caffe-Latte attack in Python
I have a github project called 'Evil-Twin Framework' which basically is a very extensible Wi-Fi pentesting framework. I'm not going to delve into the details but basically one can code any type of Wi-...
- 143
-1
votes
2
answers
390
views
How to train and practice Wifi attack?
I've just got a quick question about how to train Wifi attacks (WEP,WPA,etc...), I can't really do this on my own Wifi, it would be terrible if someone broke into it for example, so do you guys know a ...
- 144
3
votes
2
answers
3k
views
Is the Karma attack still relevant today?
I tried replicating the Karma attack and it does not work on my iphone5s and galaxy s6. Even when the phones send out directed probe requests and the Rouge AP responds with the appropriate probe ...
- 439
9
votes
2
answers
977
views
wireless security - Authentication and Association
I am trying to learn wireless security a bit more technically but resources out there on the net are so confusing. Here is my understanding.
There are two types of Authentication:
1) Open System ...
- 213
2
votes
3
answers
1k
views
Handshake not recording
I am trying to crack wireless WEP password of my wireless AP.
When I enable monitor mode and issue this command:
root#airodump-ng -w TESTFILE1 -c 1 --bssid 68:72:51:58:A3:14 wlan0mon
No handshake ...
- 21
0
votes
1
answer
1k
views
Wireless - why can't i view ARP broadcasts in monitor mode on encrypted networks?
I'm running a packet capture on my test client (running in managed mode) and also on my attacking machine (running in monitor mode).
It is my understanding that 802.11 networks using WEP encryption ...
- 3
1
vote
1
answer
358
views
Encryption and Decryption in WEP protocol [duplicate]
What is the role of Integrity Check Value in Wireless Equivalent Privacy?
Why initialization Vector is sent as a clear message where as Integrity Check Value is sent as a cipher message?
- 11
6
votes
1
answer
3k
views
What is the most used WiFi encryption? [WEP/WPA/WPA2] [closed]
I am doing some research on WiFi for my school and one question I want to answer is what encryption is the most used. One day it was of course WEP and now it is WPA2 I assume, but it would be great if ...
- 63
1
vote
3
answers
294
views
Why is it called WEP? [closed]
The WEP standard is called "wired equivalent privacy"?
Why does it include "wired"? Does have it have to do with ethernet codes or something else?
user110708
1
vote
0
answers
162
views
What will happen if WEP reuses a challenge?
What will happen if a WEP authentication challenge string is reused? If the access point ran out of unique random numbers and reused one then what would happen? I'd think that if challenges were ...
- 171
6
votes
2
answers
2k
views
What are weak IVs? Can we somehow stop or slow down WEP cracking by avoiding usage of them?
Most of us dealing with wireless security must have cracked a WEP key, and while doing that must have come across texts like this:
weak IVs, reveal more information about the secret part of the WEP ...
- 680
2
votes
1
answer
380
views
When running a WEP fragmentation attack on an AP with no clients, how are the first few bytes of keystream obtained?
As I've understood Andrea Bittau's fragmentation attack, an attacker can obtain a keystream of arbitrary length if he can first obtain a very small keystream of about 8 bytes. I understand that this ...
- 377
3
votes
1
answer
1k
views
Aircrack-ng: Why deauth works
When using aircrack to attack WPA, deauth packets are used to force a host to deauthenticate. But the machine sending these deauth packets is not even connected to the network. How possible is it that ...
- 1,576
1
vote
0
answers
181
views
How many packets required to deauth WPA? [duplicate]
When using aircrak-ng to attack WPA; Why do I need to send many de-authenticate packets to force the host to deauthenticate? Why is one packet not enough to cause deauthentication?
- 1,576
0
votes
1
answer
844
views
Attacking WPA/WPA2 ; Clarification on deauthentication packets
In the attack on WPA/WPA2, one way to force a handshake is by sending deauth packets to force the client to deauntheticate. During reauthentication attempts, the handshake can the be captured. Here is ...
- 1,576
4
votes
1
answer
1k
views
Arp replay for cracking WEP key IN Aircrack-ng
I'm pretty new to all of this so it might be a little stupid question... but why do we need to wait to capture an arp packet from a client to the AP? Can't we just send a 'fake' arp request to the AP ...
- 43
2
votes
1
answer
2k
views
Packet Injection during attacks on WPA/WPA2/WEP -- How it works
Most Wi-Fi attacks rely on some kind of packet injection. This could be in the form of injecting deauth packets, arp packets, etc.
I have a question about these fake packets -- Are they constructed ...
- 1,576
1
vote
2
answers
3k
views
Regarding number of packets needed to crack WEP
One of the major weaknesses of WEP is a short 24-bit IV, which means that only 224 packets are needed to exhaust all IVs. 224 translates to about 16.5 million IVs (or packets for that matter).
...
- 1,576
0
votes
1
answer
1k
views
Attacking WEP -- Question on Packet Injection
When attacking WEP, one must use a wireless card which supports packet injection. I have two questions about this.
(1) As long as we have a busy network, why would we need packet injection? I thought ...
- 1,576
3
votes
2
answers
570
views
Attacking WEP/WPA/WPA2
When attacking WEP/WPA/WPA2, I see people buy a wireless network adapter (e.g. Alfa). Why can't an inbuilt adapter in a laptop work? Or in other words, is there a quick way for me to check if the ...
- 1,576
0
votes
1
answer
402
views
Can a third party passively read transmissions if WEP / WPA / WPA2 key is known?
If I connect to a WiFi network sporting either WEP, WPA or WPA2 encryption, can someone other decipher my communication he passively received if he knows the network's passphrase?
- 141
3
votes
3
answers
2k
views
Authentication in WPA from a user's perspective
I have read several articles that discuss the differences between WEP and WPA but I haven't seen an answer to my question, which is :
How is the authentication used in WPA different from that used ...
- 131
0
votes
2
answers
171
views
How secure is LAN wireless 802.11 if password is used with access point?
I've read a book on computer networks, and among other subjects the author touched WiFi security. It was said that WiFi has some serious security flaws and that there is even free publicly available ...
- 101
2
votes
2
answers
2k
views
How to determine if a key is a weak key
How to do you decide that a particular key is a weak key? In the case of WEP, the weak keys seem to be those whose initialization vectors are in the form of (B + 3,255,x).
Does the condition for weak ...
- 41
3
votes
1
answer
1k
views
Sniff wireless (Wi-Fi) trafic with Wireshark
I have a wireless card (AWUS036H) in monitor mode (with airmon-ng start wlan0) on my Debian machine. In Wireshark, in "capture options", all my interfaces are in promiscuous mode.
The test network is ...
- 431
0
votes
1
answer
2k
views
How to speed-up data collecting of WEP AP for aircrack?
I'm using aireplay to collect some data from AP alongside with aircrack.
Unfortunetlly, the proccess seems quite slow to me as I've reached 2000 in more than 20mins so far.
What most affects the speed ...
- 141
3
votes
1
answer
256
views
Standard for Generating Multiple WEP Keys From a Passphrase
I've been reading a lot about WEP recently and why it was bad. To make sure I understand it, I've been writing scripts to show how it works and highlight its vulnerabilities. But I want to have a full ...
- 115
0
votes
1
answer
1k
views
hard time in bug bounty hunting [closed]
I have practiced oswap documentation and their vulnerability lab. I also read some books like the web app penetration hackers handbook. But I have no success in bug bounty hunting.
I have read an ...
- 21
2
votes
0
answers
135
views
Determining time it would take to exhaust IVs on 802.11b/g/n
I'm trying to learn about WEP attacks at the moment. I know that attacks against WEP require collisions of the initialization vectors. Is there a way to determine how long it would take for the ...
- 121