newbie_guide
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revisionNext revisionBoth sides next revision | ||
newbie_guide [2007/02/16 22:32] – darkaudax | newbie_guide [2018/11/21 23:29] – [The lazy way] Update interface name + small updates mister_x | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Aircrack-ng Newbie Guide for Linux ====== | ====== Aircrack-ng Newbie Guide for Linux ====== | ||
- | This tutorial will give you the basics to get started using the aircrack-ng suite. | + | Idea and initial work: ASPj\\ |
+ | Additions by: a number of good souls\\ | ||
+ | Last updated: Nov 21, 2018\\ | ||
+ | \\ | ||
+ | This tutorial will give you the basics to get started using the aircrack-ng suite. | ||
+ | |||
+ | Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail. | ||
Line 6: | Line 12: | ||
The first step in getting aircrack-ng working properly on your Linux system is patching and installing the proper driver for your wireless card. Many cards work with multiple drivers, some of which provide the necessary features for using aircrack-ng, | The first step in getting aircrack-ng working properly on your Linux system is patching and installing the proper driver for your wireless card. Many cards work with multiple drivers, some of which provide the necessary features for using aircrack-ng, | ||
- | |||
Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. | Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. | ||
- | To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[http:// | + | To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial: |
- | First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. | + | First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. |
- | As I own a Ralink USB device, I am providing the steps to get it working with Aircrack-ng. | ||
- | |||
- | If you own another type of card, check the [[install_drivers|installing drivers page]] for instructions about other drivers. | ||
- | |||
- | |||
- | ===== RaLink USB rt2570 Setup guide ===== | ||
- | |||
- | If you own a rt2570 USB device (like D-Link DWL-G122 rev. B1 or Linksys WUSB54G v4) you should use the drivers from http:// | ||
- | |||
- | Lets unpack, compile and install the drivers: | ||
- | |||
- | tar xfj rt2570-k2wrlz-1.3.0.tar.bz2 | ||
- | cd rt2570-k2wrlz-1.3.0/ | ||
- | make | ||
- | make install | ||
- | |||
- | The last step has to be performed as root. Use su to change to root. | ||
- | Now we can load the module into the kernel: | ||
- | modprobe rt2570 | ||
- | |||
- | Plug in your card, it should be recognized as rausb0 now. Run iwconfig to list your wireless devices and check if everything is working. | ||
===== Aircrack-ng installation ===== | ===== Aircrack-ng installation ===== | ||
- | ==== Source ==== | + | Get the latest |
- | + | ||
- | Get your copy of aircrack-ng from the homepage: http:// | + | |
- | + | ||
- | Unpacking, compiling, installing: | + | |
- | + | ||
- | tar xfz aircrack-ng-0.5.tar.gz | + | |
- | cd aircrack-ng-0.5 | + | |
- | make | + | |
- | make install | + | |
- | + | ||
- | As usual, the last step needs to be performed as root, use **su** to login as root (use **sudo make** install for Ubuntu). | + | |
- | + | ||
- | ==== YUM ==== | + | |
- | + | ||
- | If you are using a system like Redhat | + | |
- | + | ||
- | su | + | |
- | yum -y install aircrack-ng | + | |
- | + | ||
- | ==== RPM ==== | + | |
- | + | ||
- | If you are using a system which is rpm-based then you can take the easy way to install aircrack-ng. (Example for Redhat Linux 4) | + | |
- | + | ||
- | su | + | |
- | rpm -ihv http:// | + | |
+ | To install aircrack-ng, | ||
====== IEEE 802.11 basics ====== | ====== IEEE 802.11 basics ====== | ||
- | Ok, now everything is ready, time to make a stop before the action finally starts and learn something about how this works exactly. | + | Ok, now everything is ready, time to make a pit stop before the action finally starts and learn something about how wireless networks work. |
- | Following | + | The following |
===== How a wireless network is found ===== | ===== How a wireless network is found ===== | ||
- | This is a short introduction into managed networks, these ones working with AccessPoints. | + | This is a short introduction into managed networks, these ones working with Access Points (AP). Every AP sends out about 10 so called beacon frames a second. These packets contain |
- | Every AP sends out about 10 so called beacon frames a second. These packets contain following information: | + | |
* Name of the network (ESSID) | * Name of the network (ESSID) | ||
- | * If encryption is used (and what encryption is used; pay attention, that may not be always true because | + | * If encryption is used (and what encryption is used; pay attention, that may not be always true just because the AP advertises it) |
- | * What MBit rates are supported | + | * What MBit data rates are supported |
* Which channel the network is on | * Which channel the network is on | ||
+ | |||
This information is then shown in your tool that connects to this network. It is shown when you let your card scan for networks with **iwlist < | This information is then shown in your tool that connects to this network. It is shown when you let your card scan for networks with **iwlist < | ||
- | Every AP has a unique MAC address (48 bit, 6 pair of hexadecimal numbers). It looks like 00: | + | Every AP has a unique MAC address (48 bit, 6 pair of hexadecimal numbers). It looks like 00: |
===== Connecting with a network ===== | ===== Connecting with a network ===== | ||
- | If you want to connect to a wireless network, there are some possibilities. In most cases, Open System Authentication is used. | + | If you want to connect to a wireless network, there are some possibilities. In most cases, Open System Authentication is used. |
Open System Authentication: | Open System Authentication: | ||
Line 95: | Line 56: | ||
\\ | \\ | ||
This is the simplest case, BUT there could be some problems if you are not legitimate to connect: | This is the simplest case, BUT there could be some problems if you are not legitimate to connect: | ||
- | * WPA is in use, you need EAPOL authentication. The AP will deny you at step 2. | + | * WPA/WPA2 is in use, you need EAPOL authentication. The AP will deny you at step 2. |
- | * AccessPoint | + | * Access Point has a list of allowed clients |
- | * AccessPoint | + | * Access Point uses Shared Key Authentication, |
====== Simple sniffing and cracking ====== | ====== Simple sniffing and cracking ====== | ||
+ | |||
+ | |||
===== Discovering Networks ===== | ===== Discovering Networks ===== | ||
- | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like | + | The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like [[https:// |
- | [[http://www.kismetwireless.net/ | + | |
- | Start airodump-ng | + | Prior to looking |
- | | + | To put your wireless card into monitor mode using [[airmon-ng]]: |
+ | |||
+ | airmon-ng start wlan0 | ||
+ | |||
+ | It will create create another interface, and append " | ||
+ | |||
+ | Then, start [[airodump-ng]] to look out for networks: | ||
+ | |||
+ | | ||
- | " | ||
- | Take a look in the documentation of the nic driver. | ||
If airodump-ng could connect to the WLAN device, you'll see a screen like this: | If airodump-ng could connect to the WLAN device, you'll see a screen like this: | ||
- | {{http:// | + | {{https:// |
+ | |||
+ | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a is in the 5GHz and availability in different countries is more fragmented than on 2.4GHz. In general, known channels starts at 36 (32 in some countries) to 64 (68 in some countries) and 96 to 165. Wikipedia has more details on channel availability. The Linux [[https:// | ||
- | [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. | + | The current channel is shown in the top left corner. |
After a short time some APs and (hopefully) some associated clients will show up. | After a short time some APs and (hopefully) some associated clients will show up. | ||
Line 123: | Line 93: | ||
The upper data block shows the access points found: | The upper data block shows the access points found: | ||
- | ^ BSSID | The MAC of the AP | | + | ^ BSSID | The MAC address |
+ | ^ RXQ | Quality of the signal, when locked on a channel | ||
^ PWR | Signal strength. Some drivers don't report it | | ^ PWR | Signal strength. Some drivers don't report it | | ||
- | ^ Beacons | + | ^ Beacons |
- | ^ Data | Number of data frames | + | ^ Data | Number of data frames |
^ CH | Channel the AP is operating on | | ^ CH | Channel the AP is operating on | | ||
^ MB | Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture | ^ MB | Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture | ||
Line 137: | Line 108: | ||
^ STATION | ^ STATION | ||
^ PWR | Signal strength. Some drivers don't report it | | ^ PWR | Signal strength. Some drivers don't report it | | ||
- | ^ Packets | + | ^ Packets |
^ Probes | ^ Probes | ||
- | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an | + | Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack WEP with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength. |
- | advanced topic. It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better | + | |
- | signal. Often a few centimeters make a big difference in signal strength. | + | |
- | In the example above the net 00: | + | In the example above the net 00: |
- | has a high signal strength so it's really a good target to practice. | + | |
===== Sniffing IVs ===== | ===== Sniffing IVs ===== | ||
- | Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and | + | Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: |
- | additionally write all data to disk to be able to use it for cracking: | + | |
- | airodump-ng -c 11 -w dump rausb0 | + | airodump-ng -c 11 --bssid 00: |
- | With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. | + | With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The " |
- | You can also add the --ivs parameter. This tells [[airodump-ng]] to only capture | + | Before being able to crack WEP you'll usually need between 40 000 and 85 000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different |
- | Before being able to crack WEP you'll usually need between 250.000 and 500.000 different Initialization Vectors (IVs). Every data | + | So you'll have to wait and capture |
- | packet contains an IV. IVs can be re-used, so the number of different IVs is usually a bit lower than the number of data packets | + | |
- | captured. | + | |
- | + | ||
- | So you'll have to wait and capture | + | |
- | it up a lot by using an active attack (=packet replay). See the next chapter. | + | |
===== Cracking ===== | ===== Cracking ===== | ||
Line 171: | Line 133: | ||
aircrack-ng -b 00: | aircrack-ng -b 00: | ||
- | The MAC after the -b option is the BSSID of the target and dump-01.cap the file containing the captured packets. You can use multiple files, just add all their names. | + | The MAC after the -b option is the BSSID of the target and dump-01.cap the file containing the captured packets. You can use multiple files, just add all their names or you can use a wildcard such as dump*.cap. |
- | For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]] | + | For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]]. |
- | The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. | + | The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger |
- | Usually these weak IVs are randomly mixed in between the stonger | + | |
- | There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than n different IVs from the AP or that you'll need millions (like 5 to 7 Mio) to crack the key. Search in the forum, there are some threads about cases like this and what to do. | + | There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than "n" |
====== Active attacks ====== | ====== Active attacks ====== | ||
- | |||
===== Injection support ===== | ===== Injection support ===== | ||
- | Most devices don't support injection - at least not without patched drivers. Take a look at [[compatibility]], | + | Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility |
- | Sometimes this table is not up-to-date, so if you see a " | + | |
- | or our forum. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the [[compatibility]] table and | + | |
- | add a link to a short howto. | + | |
- | The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[fake authentication]] attack. | + | The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack. Make sure to perform this test prior to proceeding. |
You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP. | You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP. | ||
- | The first thing to do is find out the MAC of your own WLAN device. Sometimes there is a label with the MAC on the device. But you can always find | + | Try to connect |
- | it out using the ifconfig command (the 6 Hex bytes after " | + | |
- | Then you can try to connect to your AP using [[aireplay-ng]]: | + | |
- | aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00: | + | The value after -a is the BSSID of your AP. |
- | + | ||
- | The value after -a is the BSSID of your AP, the value after -h is the MAC of your own WLAN device. | + | |
If injection works you should see something like this: | If injection works you should see something like this: | ||
Line 209: | Line 163: | ||
If not | If not | ||
- | - double-check ESSID, BSSID and your own MAC | + | - double-check ESSID and BSSID |
- make sure your AP has MAC filtering disabled | - make sure your AP has MAC filtering disabled | ||
- test it against another AP | - test it against another AP | ||
- make sure your driver is properly patched and supported | - make sure your driver is properly patched and supported | ||
+ | - Instead of " | ||
===== ARP replay ===== | ===== ARP replay ===== | ||
Line 220: | Line 175: | ||
==== The idea ==== | ==== The idea ==== | ||
- | [[http:// | + | [[https:// |
sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. | sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. | ||
So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). | So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). | ||
+ | |||
==== The lazy way ==== | ==== The lazy way ==== | ||
Line 229: | Line 185: | ||
Wait for a client to show up on the target network. Then start the attack: | Wait for a client to show up on the target network. Then start the attack: | ||
- | aireplay-ng --arpreplay -b 00: | + | aireplay-ng --arpreplay -b 00: |
-b specifies the target BSSID, -h the MAC of the connected client. | -b specifies the target BSSID, -h the MAC of the connected client. | ||
Line 235: | Line 191: | ||
Now you have to wait for an ARP packet to arrive. Usually you'll have to wait for a few minutes (or look at the next chapter). | Now you have to wait for an ARP packet to arrive. Usually you'll have to wait for a few minutes (or look at the next chapter). | ||
- | If you were successfull, you'll see something like this: | + | If you were successful, you'll see something like this: |
Saving ARP requests in replay_arp-0627-121526.cap | Saving ARP requests in replay_arp-0627-121526.cap | ||
Line 241: | Line 197: | ||
Read 2493 packets (got 1 ARP requests), sent 1305 packets... | Read 2493 packets (got 1 ARP requests), sent 1305 packets... | ||
- | If you have to break replaying, you don't have to wait for the next ARP packet to show up, but you can re-use the previously captured packet(s) with | + | If you have to stop replaying, you don't have to wait for the next ARP packet to show up, but you can re-use the previously captured packet(s) with |
the -r < | the -r < | ||
- | If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with | + | When using the ARP injection technique, you can use the PTW method to crack the WEP key. This dramatically reduces the number of data packets you need and also the time needed. |
- | the -x <packets per second> option. I usually start out with 50 and reduce until packets are received | + | |
- | your antenna usually also helps. | + | If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x <packets per second> option. I usually start out with 50 and reduce until packets are received |
==== The aggressive way ==== | ==== The aggressive way ==== | ||
- | Most operating | + | Most operating |
- | have to send out ARP requests. So the idea is to disconnect a client and force it to reconnect to capture an ARP-request. A side-effect | + | |
- | is that you can sniff the ESSID during reconnection too. This comes in handy if the ESSID of your target is hidden. | + | |
Keep your airodump-ng and aireplay-ng running. Open another window and run a [[deauthentication]] attack: | Keep your airodump-ng and aireplay-ng running. Open another window and run a [[deauthentication]] attack: | ||
Line 264: | Line 218: | ||
Most clients try to reconnect automatically. But the risk that someone recognizes this attack or at least attention is drawn to the stuff happening on the WLAN is higher | Most clients try to reconnect automatically. But the risk that someone recognizes this attack or at least attention is drawn to the stuff happening on the WLAN is higher | ||
than with other attacks. | than with other attacks. | ||
+ | |||
====== Further tools and information ====== | ====== Further tools and information ====== | ||
- | [[http:// | + | [[https:// |
newbie_guide.txt · Last modified: 2018/11/21 23:31 by mister_x