Aircrack-ng

User Tools

Site Tools

Trace:
newbie_guide

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
newbie_guide [2010/06/17 15:45] – Fixed typo darkaudaxnewbie_guide [2018/11/21 23:14] – Updated information and removed outdated information mister_x
Line 2: Line 2:
 Idea and initial work: ASPj\\ Idea and initial work: ASPj\\
 Additions by: a number of good souls\\ Additions by: a number of good souls\\
-Last updated: May 09, 2008\\+Last updated: Nov 21, 2018\\
 \\ \\
-This tutorial will give you the basics to get started using the aircrack-ng suite.  It is impossible to provide every piece of information you need and cover every scenario.  So be prepared to do some homework and research on your own.  The [[http://forum.aircrack-ng.org/|Forum]] and the [[http://aircrack-ng.org/doku.php|Wiki]] have lots of supplementary tutorials and information.+This tutorial will give you the basics to get started using the aircrack-ng suite.  It is impossible to provide every piece of information you need and cover every scenario.  So be prepared to do some homework and research on your own.  The [[https://forum.aircrack-ng.org/|Forum]] and the [[main|Wiki]] have lots of supplementary tutorials and information.
  
 Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail. Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail.
Line 17: Line 17:
 To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial: Is My Wireless Card Compatible?]] if you don't know where to look in this table.  It still does not hurt to read this tutorial to build your knowledge and confirm your card attributes. To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial: Is My Wireless Card Compatible?]] if you don't know where to look in this table.  It still does not hurt to read this tutorial to build your knowledge and confirm your card attributes.
  
-First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph.  The [[compatibility_drivers#drivers|drivers section]] will tell you which drivers you need for your specific chipset.  Download them and then get the corresponding patch from http://patches.aircrack-ng.org. (These patches enables the support for injection.)+First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph.  The [[install_drivers|drivers section]] will tell you which drivers you need.
  
-As I own a Ralink USB device, I am providing the steps to get it working with Aircrack-ng.  Before you are able to compile and install drivers, you need the kernel-sources for your distribution installed.  
- 
-If you own another type of card, check the [[install_drivers|installing drivers page]] for instructions about other drivers.  As well, do a search in the net if you're unsure how to install them. 
- 
- 
-===== RaLink USB rt2570 Setup guide ===== 
- 
-If you own a rt2570 USB device (like D-Link DWL-G122 rev. B1 or Linksys WUSB54G v4) you should use the drivers from http://homepages.tu-darmstadt.de/~p_larbig/wlan/ These are special modified drivers, which support injection and are reported to work best with Aircrack-ng. They don't need to be patched. Of course these drivers do also work for normal operation. (Starting with kernel 2.6.25 and Aircrack-ng v1.0-rc1, the in-kernel driver, rt2500usb, can also be used.) 
- 
-Lets unpack, compile and install the drivers: 
- 
-  tar xfj rt2570-k2wrlz-1.3.0.tar.bz2 
-  cd rt2570-k2wrlz-1.3.0/Module 
-  make 
-  make install 
- 
-The last step has to be performed as root. Use su to change to root. 
-Now we can load the module into the kernel: 
-  modprobe rt2570 
- 
-Plug in your card, it should be recognized as rausb0 now. Run iwconfig to list your wireless devices and check if everything is working. 
  
 ===== Aircrack-ng installation ===== ===== Aircrack-ng installation =====
  
-==== Source ==== +Get the latest copy of aircrack-ng from the [[main|homepage]], use our packages or use a penetration testing distribution such as Kali Linux or Pentoo where Aircrack-ng is already installed and up to date.
- +
-Get the latest copy of aircrack-ng from the homepage: http://www.aircrack-ng.org +
-The following commands would have to be changed if you use a newer version of the software. +
- +
-Unpacking, compiling, installing: +
- +
-  tar xfz aircrack-ng-1.0-rc1.tar.gz +
-  cd aircrack-ng-1.0-rc1 +
-  make +
-  make install +
- +
-As usual, the last step needs to be performed as root, use **su** or **sudo -s** to login as root (use **sudo make** install for Ubuntu). +
- +
-==== YUM ==== +
- +
-**WARNING!!!** Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead. +
- +
-If you are using a system like Redhat Linux or Fedora Core you can install aircrack-ng with yum. First you have to add the repository of [[http://dag.wieers.com/home-made/apt/|Dag Wieers]] or [[http://dries.studentenweb.org/rpm/|Dries]]. +
- +
-  su +
-  yum -y install aircrack-ng +
- +
-==== RPM ==== +
- +
-**WARNING!!!** Currently, neither of the repositories hosts the latest version of Aircrack-ng. It's recommended that you use the first method instead. +
- +
-If you are using a system which is rpm-based then you can take the easy way to install aircrack-ng. (Example for Redhat Linux 4) +
- +
-  su +
-  rpm -ihv http://dag.wieers.com/rpm/packages/aircrack-ng/aircrack-ng-0.7-1.el4.rf.i386.rpm+
  
-IMPORTANT: Check http://dag.wieers.com/rpm/packages/aircrack-ng/ for the latest version of the aircrack-ng suite and change the command above to reference the latest version.+To install aircrack-ng, refer to the documentation on the [[install_aircrack|installation page]].
  
 ====== IEEE 802.11 basics ====== ====== IEEE 802.11 basics ======
Line 137: Line 86:
 If airodump-ng could connect to the WLAN device, you'll see a screen like this: If airodump-ng could connect to the WLAN device, you'll see a screen like this:
  
-{{http://www.aircrack-ng.org/img/newbie_airodump.png}}+{{https://www.aircrack-ng.org/img/newbie_airodump.png}}
  
 [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. The current channel is shown in the top left corner. [[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). Channels between 36 and 149 are used for 802.11a. The current channel is shown in the top left corner.
Line 159: Line 108:
 ^ STATION      | The MAC of the client itself  | ^ STATION      | The MAC of the client itself  |
 ^ PWR          | Signal strength. Some drivers don't report it  | ^ PWR          | Signal strength. Some drivers don't report it  |
-^ Packets      | Number of data frames recieved   |+^ Packets      | Number of data frames received   |
 ^ Probes       | Network names (ESSIDs) this client has probed  | ^ Probes       | Network names (ESSIDs) this client has probed  |
  
Line 188: Line 137:
 For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]]. For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]].
  
-The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stonger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.+The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.
  
-There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than "n" different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the [[http://forum.aircrack-ng.org/|Forum]], there are some threads about cases like this and what to do.+There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than "n" different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the [[https://forum.aircrack-ng.org/|Forum]], there are some threads about cases like this and what to do.
  
 ====== Active attacks ====== ====== Active attacks ======
 ===== Injection support ===== ===== Injection support =====
-Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay.  Sometimes this table is not up-to-date, so if you see a "NO" for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our [[http://forum.aircrack-ng.org/|Forum]]. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the [[compatibility_drivers|compatibility page]] table and add a link to a short howto. (To do this, request a wiki account on IRC.)+Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay.  Sometimes this table is not up-to-date, so if you see a "NO" for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our [[https://forum.aircrack-ng.org/|Forum]]. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the [[compatibility_drivers|compatibility page]] table and add a link to a short howto. (To do this, request a wiki account on IRC.)
  
 The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack.  Make sure to perform this test prior to proceeding.  Your card must be able to successfully inject in order to perform the following steps. The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack.  Make sure to perform this test prior to proceeding.  Your card must be able to successfully inject in order to perform the following steps.
Line 226: Line 175:
 ==== The idea ==== ==== The idea ====
  
-[[http://en.wikipedia.org/wiki/Address_Resolution_Protocol|ARP]] works (simplified) by broadcasting a query for an IP and the device that has this IP+[[https://en.wikipedia.org/wiki/Address_Resolution_Protocol|ARP]] works (simplified) by broadcasting a query for an IP and the device that has this IP
 sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid.
 So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs).
Line 273: Line 222:
  
 ====== Further tools and information ====== ====== Further tools and information ======
-[[http://www.tuto-fr.com/tutoriaux/crack-wep/aircrack-ng.php|Tutorial in french for aircrack-ng]] [[http://www.tuto-fr.com/en/tutorial/tutorial-crack-wep-aircrack.php|or in english]]+[[https://www.tuto-fr.com/tutoriaux/crack-wep/aircrack-ng.php|Tutorial in french for aircrack-ng]] [[https://www.tuto-fr.com/en/tutorial/tutorial-crack-wep-aircrack.php|or in english]]
newbie_guide.txt · Last modified: 2018/11/21 23:31 by mister_x