fragmentation
Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
fragmentation [2007/01/26 23:46] – PRAGA -> PRGA mister_x | fragmentation [2009/09/05 23:32] (current) – wiki-files.aircrack-ng.org become download.aircrack-ng.org/wiki-files mister_x | ||
---|---|---|---|
Line 1: | Line 1: | ||
====== Fragmentation Attack ====== | ====== Fragmentation Attack ====== | ||
- | |||
- | |||
===== Description ===== | ===== Description ===== | ||
- | This attack, when successful, can obtain 1500 bits of PRGA (pseudo random | + | This attack, when successful, can obtain 1500 bytes of PRGA (pseudo random |
- | Basically, the program | + | Basically, the program |
- | The original paper by Andrea Bittau at http://www.toorcon.org/2005/ | + | The original paper, [[http://darkircop.org/bittau-wep.pdf|The Fragmentation Attack in Practice]], by Andrea Bittau |
===== Usage ===== | ===== Usage ===== | ||
Line 33: | Line 31: | ||
*-k IP : set destination IP in fragments - defaults to 255.255.255.255 | *-k IP : set destination IP in fragments - defaults to 255.255.255.255 | ||
*-l IP : set source IP in fragments - defaults to 255.255.255.255 | *-l IP : set source IP in fragments - defaults to 255.255.255.255 | ||
+ | |||
===== Usage Example ===== | ===== Usage Example ===== | ||
- | Notes: | ||
- | *The source MAC address used in the attack must be associated with the access point. | ||
- | *For madwifi-ng drivers (Atheros chipset), you must change MAC address of your card to the MAC address you will injecting with otherwise the attack will not work. | ||
Essentially you start the attack with the following command then select the packet you want to try:\\ | Essentially you start the attack with the following command then select the packet you want to try:\\ | ||
- | aireplay-ng -5 -b 00: | + | |
+ | |||
Waiting for a data packet... | Waiting for a data packet... | ||
Read 96 packets... | Read 96 packets... | ||
+ | | ||
Size: 120, FromDS: 1, ToDS: 0 (WEP) | Size: 120, FromDS: 1, ToDS: 0 (WEP) | ||
+ | | ||
| | ||
Dest. MAC = 00: | Dest. MAC = 00: | ||
Source MAC = 00: | Source MAC = 00: | ||
+ | | ||
0x0000: | 0x0000: | ||
0x0010: | 0x0010: | ||
Line 61: | Line 57: | ||
0x0060: | 0x0060: | ||
0x0070: | 0x0070: | ||
+ | | ||
Use this packet ? y | Use this packet ? y | ||
Line 80: | Line 76: | ||
Now you can build a packet with packetforge-ng out of that 1500 bytes keystream | Now you can build a packet with packetforge-ng out of that 1500 bytes keystream | ||
- | You have successfully obtained the PRAGA which is stored in the file named by the program. | + | You have successfully obtained the PRGA which is stored in the file named by the program. |
+ | |||
+ | ===== Usage Tips ===== | ||
+ | |||
+ | *The source MAC address used in the attack must be associated with the access point. | ||
+ | |||
+ | *For madwifi-ng drivers (Atheros chipset), you must change MAC address of your card to the MAC address you will injecting with otherwise the attack will not work. See this [[faq# | ||
+ | |||
+ | * The fragmentation attack sends out a large number of packets that must all be received by the AP for the attack to be successful. | ||
+ | |||
+ | * The [[tutorial|tutorials page]] have a number of tutorials which utilize the fragmentation attack. | ||
+ | |||
+ | * When to say no to a packet? | ||
+ | |||
+ | |||
+ | |||
+ | ===== Usage Troubleshooting ===== | ||
+ | |||
+ | ==== General ===== | ||
+ | |||
+ | * Make sure your card can successfully inject. | ||
+ | * Make sure the MAC you are using for injection is associated with the AP. | ||
+ | * Make sure you are on the same channel as the AP. | ||
+ | * Also see the general aireplay-ng troubleshooting ideas: [[aireplay-ng# | ||
+ | |||
+ | Although not a direct troubleshooting tip for the fragmentation attack, if you are unable to get the attack to work, there are some alternate attacks you should consider: | ||
+ | |||
+ | * [[korek_chopchop|Korek chopchop Attack]]: This is an alternate technique to obtain PRGA for building packets for subsequent injection. | ||
+ | * [[interactive_packet_replay# | ||
+ | |||
+ | |||
+ | ==== "Not enough acks, repeating" | ||
+ | |||
+ | If you receive a message similar to: | ||
+ | |||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | | ||
+ | |||
+ | Possible reasons are: | ||
+ | |||
+ | * Too close or too far from the Access Point | ||
+ | * The driver is problematic. | ||
fragmentation.1169851589.txt.gz · Last modified: 2007/01/26 23:46 (external edit)