Aircrack-ng

User Tools

Site Tools

Trace:
airdecloak-ng

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
airdecloak-ng [2008/12/26 18:40] – Doestoying the managed interface is only needed for madwifi-ng - stop people from killing their wlan0 interfaces on mac80211 drivers. netrolller3dairdecloak-ng [2023/01/15 11:37] – fix typos and indentation in usage info (PR #2371) gemesa
Line 13: Line 13:
 ===== Usage ===== ===== Usage =====
  
-  Airdecloak-ng 1.0 rc1 r1193 - (C) 2008 Thomas d'Otreppe +  Airdecloak-ng 1.4 - (C) 2008-2018 Thomas d'Otreppe 
-  http://www.aircrack-ng.org+  https://aircrack-ng.org
      
   usage: airdecloak-ng [options]   usage: airdecloak-ng [options]
Line 40: Line 40:
            signal_dup_consec_sn: Use signal (if available), duplicate and            signal_dup_consec_sn: Use signal (if available), duplicate and
                                  consecutive sequence number (filtering is                                  consecutive sequence number (filtering is
-                                  much more precise than using all these +                                 much more precise than using all these 
-                                  filters one by one).+                                 filters one by one).
      --null-packets        : Assume that null packets can be cloaked.      --null-packets        : Assume that null packets can be cloaked.
-     --disable-base_filter : Do not apply base filter. +     --disable-base-filter : Do not apply base filter. 
-     --drop-frag           : Drop fragmented packets+     --drop-frag           : Drop fragmented packets.
      
-     --help                : Displays this usage screen+     --help                : Displays this usage screen.
  
 ==== Options ==== ==== Options ====
Line 56: Line 56:
 |--filters <filters>|Apply theses filters in this specific order. They have to be separated by a ','. \\ **Example**: --filters signal,consecutive_sn| |--filters <filters>|Apply theses filters in this specific order. They have to be separated by a ','. \\ **Example**: --filters signal,consecutive_sn|
 |--null-packets|Assume that null packets can be cloaked (not yet implemented).| |--null-packets|Assume that null packets can be cloaked (not yet implemented).|
-|--disable-base_filter|Disable the base filter.|+|--disable-base-filter|Disable the base filter.|
 |--drop-frag|Drop all fragmented packets. In most networks, fragmentation is not needed.| |--drop-frag|Drop all fragmented packets. In most networks, fragmentation is not needed.|
  
Line 82: Line 82:
  
 === Trying to crack the WEP key === === Trying to crack the WEP key ===
-  aircrack-ng.exe wep_cloaking_full_speed_dl.pcap -b 00:12:BF:12:32:29 -K -n 64 -d 1F:1F:1F+  aircrack-ng wep_cloaking_full_speed_dl.pcap -b 00:12:BF:12:32:29 -K -n 64 -d 1F:1F:1F
      
 {{http://www.aircrack-ng.org/wep_cloaking/crack_without_filter.jpg}} {{http://www.aircrack-ng.org/wep_cloaking/crack_without_filter.jpg}}
Line 197: Line 197:
 === Timing === === Timing ===
  
-The time needed to receive a cloaked frame could be analysed; compared to its uncloaked equivalent since the sensor receive the real frame then forge a wep cloaked frame with the informations of the real one.+The time needed to receive a cloaked frame could be analyzed; compared to its uncloaked equivalent since the sensor receives the real frame then forge a wep cloaked frame with the informations of the real one.
  
 For this, 2 packets are needed (one real and one cloaked) and we have to make sure the "cloaking" status of both packets is accurate (and that the cloaked packet is forged against the real one we have). For this, 2 packets are needed (one real and one cloaked) and we have to make sure the "cloaking" status of both packets is accurate (and that the cloaked packet is forged against the real one we have).
Line 227: Line 227:
 {{http://www.aircrack-ng.org/wep_cloaking/low_traffic.jpg}} {{http://www.aircrack-ng.org/wep_cloaking/low_traffic.jpg}}
  
-There's a few possibilites to filter out the cloaked packet for 7509/7510:+There are a few possibilities to filter out the cloaked packet for 7509/7510:
 - both packets can be discarded since they have the same sequence number. - both packets can be discarded since they have the same sequence number.
 - use signal/timing to find the cloaked packet. - use signal/timing to find the cloaked packet.
  
  
-For packet 7538/7539, it will be easier, it's easy to find out which one is cloaked, a beacon has the same sequence number as packet 7539; 7539 is cloaked:+For packet 7538/7539, it will be easier, it's easy to find out which one is cloaked, a beacon has the same sequence numbers as packet 7539; 7539 is cloaked:
  
  
Line 247: Line 247:
  
 ... so other ways have to be used. Beacon will still be used but in another way: since 1319 is a valid sequence number, the previous (1318) and the next (1320) sequence numbers of valid packets are known. It's getting more complicated, these sequence number are both used more than once ;) \\ ... so other ways have to be used. Beacon will still be used but in another way: since 1319 is a valid sequence number, the previous (1318) and the next (1320) sequence numbers of valid packets are known. It's getting more complicated, these sequence number are both used more than once ;) \\
-Since it is known that wep cloaking copy the attributes (including frame size) of its equivalent real frame, wep cloaked packets can be easily found:+Since it is known that wep cloaking copies the attributes (including frame size) of its equivalent real frame, wep cloaked packets can be easily found:
  
 ^Position^Uncloaked^Cloaked^Frame size^Reason| ^Position^Uncloaked^Cloaked^Frame size^Reason|
Line 317: Line 317:
 Remove all duplicate sequence numbers for both the AP and the client (that are close to each other). Remove all duplicate sequence numbers for both the AP and the client (that are close to each other).
  
-Basically it apply ''duplicate_sn_ap'' and ''duplicate_sn_client'' filters+Basically it applies ''duplicate_sn_ap'' and ''duplicate_sn_client'' filters
  
 == consecutive_sn == == consecutive_sn ==
Line 363: Line 363:
 ===== Thanks ===== ===== Thanks =====
  
-Thanks to Alex Hernandez aka alt3kx from [[http://sybsecurity.com|sybsecurity.com]] for the hardware+Thanks to Alex Hernandez aka alt3kx from [[http://sybsecurity.com|sybsecurity.com]] for the hardware.
airdecloak-ng.txt · Last modified: 2023/01/17 09:58 by gemesa