User Tools

Site Tools


newbie_guide

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision
Previous revision
newbie_guide [2007/06/25 23:10]
mister_x Aircrack-ng 0.9.1 is released
newbie_guide [2018/11/21 23:31] (current)
mister_x [Further tools and information] updated
Line 2: Line 2:
 Idea and initial work: ASPj\\ Idea and initial work: ASPj\\
 Additions by: a number of good souls\\ Additions by: a number of good souls\\
-Last updated: ​May 142007\\+Last updated: ​Nov 212018\\
 \\ \\
-This tutorial will give you the basics to get started using the aircrack-ng suite. ​ It is impossible to provide every piece of information you need and cover every scenario. ​ So be prepared to do some homework and research on your own.  The [[http://forum.tinyshell.be/|Forum]] and the [[http://​aircrack-ng.org/​doku.php|Wiki]] have lots of supplementary tutorials and information.+This tutorial will give you the basics to get started using the aircrack-ng suite. ​ It is impossible to provide every piece of information you need and cover every scenario. ​ So be prepared to do some homework and research on your own.  The [[https://forum.aircrack-ng.org/|Forum]] and the [[main|Wiki]] have lots of supplementary tutorials and information.
  
 Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail. Although it does not cover all the steps from start to finish like this tutorial, the [[simple_wep_crack|Simple WEP Crack]] tutorial covers the actual aircrack-ng steps in much more detail.
  
-In the examples, the option "​double dash bssid" is shown as "- -bssid"​. ​ Remember to remove the space between the two dashes when using it in real life.  This also applies to  "- -ivs", "- -arpreplay",​ "- -deauth"​ and "- -fakeauth"​. 
  
 ====== Setting up Hardware, Installing Aircrack-ng ====== ====== Setting up Hardware, Installing Aircrack-ng ======
Line 16: Line 15:
 Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. ​ This is hardware which is fully compatible and can inject packets. ​ A compatible wireless card can be used to crack a wireless access point in under an hour. Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. ​ This is hardware which is fully compatible and can inject packets. ​ A compatible wireless card can be used to crack a wireless access point in under an hour.
  
-To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[http://​aircrack-ng.org/​doku.php?​id=compatible_cards|Tutorial:​ Is My Wireless Card Compatible?​]] if you don't know where to look in this table. ​ It still does not hurt to read this tutorial to build your knowledge and confirm your card attibutes.+To determine to which category your card belongs to, see [[compatibility_drivers|hardware compatibility page]]. Read [[compatible_cards|Tutorial:​ Is My Wireless Card Compatible?​]] if you don't know where to look in this table. ​ It still does not hurt to read this tutorial to build your knowledge and confirm your card attributes.
  
-First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. ​ The [[compatibility_drivers#​drivers|drivers section]] will tell you which drivers you need for your specific chipset. ​ Download them and then get the corresponding patch from http://​patches.aircrack-ng.org. (These patches enables the support for injection.)+First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. ​ The [[install_drivers|drivers section]] will tell you which drivers you need.
  
-As I own a Ralink USB device, I am providing the steps to get it working with Aircrack-ng. ​ Before you are able to compile and install drivers, you need the kernel-sources for your distribution installed. ​ 
- 
-If you own another type of card, check the [[install_drivers|installing drivers page]] for instructions about other drivers. ​ As well, do a search in the net if you're unsure how to install them. 
- 
- 
-===== RaLink USB rt2570 Setup guide ===== 
- 
-If you own a rt2570 USB device (like D-Link DWL-G122 rev. B1 or Linksys WUSB54G v4) you should use the drivers from http://​homepages.tu-darmstadt.de/​~p_larbig/​wlan/​ These are special modified drivers, which support injection and are reported to work best with Aircrack-ng. They don't need to be patched. Of course these drivers do also work for normal operation. 
- 
-Lets unpack, compile and install the drivers: 
- 
-  tar xfj rt2570-k2wrlz-1.3.0.tar.bz2 
-  cd rt2570-k2wrlz-1.3.0/​Module 
-  make 
-  make install 
- 
-The last step has to be performed as root. Use su to change to root. 
-Now we can load the module into the kernel: 
-  modprobe rt2570 
- 
-Plug in your card, it should be recognized as rausb0 now. Run iwconfig to list your wireless devices and check if everything is working. 
  
 ===== Aircrack-ng installation ===== ===== Aircrack-ng installation =====
  
-==== Source ==== +Get the latest copy of aircrack-ng from the [[main|homepage]], use our packages or use a penetration testing distribution such as Kali Linux or Pentoo where Aircrack-ng is already installed and up to date.
- +
-Get the latest copy of aircrack-ng from the homepage: http://​www.aircrack-ng.org +
-The following commands would have to be changed if you use a newer version of the software. +
- +
-Unpacking, compiling, installing:​ +
- +
-  tar xfz aircrack-ng-0.9.1.tar.gz +
-  cd aircrack-ng-0.9.1 +
-  make +
-  make install +
- +
-As usual, the last step needs to be performed as root, use **su** to login as root (use **sudo make** install for Ubuntu). +
- +
-==== YUM ==== +
- +
-If you are using system like Redhat ​Linux or Fedora Core you can install aircrack-ng with yum. First you have to add the repository of [[http://​dag.wieers.com/​home-made/​apt/​|Dag Wieers]] or [[http://​dries.studentenweb.org/​rpm/​|Dries]]. +
- +
-  su +
-  yum -y install aircrack-ng +
- +
-==== RPM ==== +
- +
-If you are using a system which is rpm-based then you can take the easy way to install aircrack-ng. (Example for Redhat Linux 4) +
- +
-  su +
-  rpm -ihv http://​dag.wieers.com/​rpm/​packages/​aircrack-ng/​aircrack-ng-0.7-1.el4.rf.i386.rpm+
  
-IMPORTANT: Check http://​dag.wieers.com/​rpm/​packages/​aircrack-ng/ for the latest version of the aircrack-ng suite and change the command above to reference ​the latest version.+To install ​aircrack-ng, refer to the documentation on the [[install_aircrack|installation page]].
  
 ====== IEEE 802.11 basics ====== ====== IEEE 802.11 basics ======
Line 106: Line 58:
   * WPA/WPA2 is in use, you need EAPOL authentication. The AP will deny you at step 2.   * WPA/WPA2 is in use, you need EAPOL authentication. The AP will deny you at step 2.
   * Access Point has a list of allowed clients (MAC addresses), and it lets no one else connect. This is called MAC filtering.   * Access Point has a list of allowed clients (MAC addresses), and it lets no one else connect. This is called MAC filtering.
-  * Access Point uses Shared Key Authentication,​ you need to supply the correct WEP key to be able to connect. ​ (See the [[http://​aircrack-ng.org/​doku.php?​id=shared_key|How to do shared key fake authentication?​ tutorial]] for advanced techniques.) ​+  * Access Point uses Shared Key Authentication,​ you need to supply the correct WEP key to be able to connect. ​ (See the [[shared_key|How to do shared key fake authentication?​ tutorial]] for advanced techniques.) ​
  
 ====== Simple sniffing and cracking ====== ====== Simple sniffing and cracking ======
Line 114: Line 66:
 ===== Discovering Networks ===== ===== Discovering Networks =====
  
-The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like +The first thing to do is looking out for a potential target. The aircrack-ng suite contains [[airodump-ng]] for this - but other programs like [[https://​kismetwireless.net/​|Kismet]] can be used too.
-[[http://www.kismetwireless.net/​|Kismet]] can be used too.+
  
-Prior to looking for networks, you must put your wireless card into what is called "​monitor mode"​. ​ Monitor mode is a special mode that allows your PC to listen to every wireless packet. ​ This monitor mode also allows you to optionally inject packets into a network. ​ Injection will be covered later in this tutorial.+Prior to looking for networks, you must put your wireless card into what is called "​monitor mode"​. ​ Monitor mode is a special mode that allows your computer ​to listen to every wireless packet. ​ This monitor mode also allows you to optionally inject packets into a network. ​ Injection will be covered later in this tutorial.
  
-To put your wireless card into monitor mode:+To put your wireless card into monitor mode using [[airmon-ng]]:
  
-[[airmon-ng]] start rausb0+  ​airmon-ng start wlan0
  
-To confirm it is in monitor mode, run "​iwconfig"​ and confirm the mode.  The [[airmon-ng|airmon-ng page]] on the Wiki has generic information and how to start it for other drivers.+It will create create another interface, and append "​mon"​ to it. So, **wlan0** will become **wlan0mon**. ​To confirm it is in monitor mode, run "​iwconfig"​ and confirm the mode.
  
-Then, start airodump-ng to look out for networks:+Then, start [[airodump-ng]] to look out for networks:
  
-  airodump-ng ​rausb0+  airodump-ng ​wlan0mon
  
-"​rausb0"​ is the network interface (nic) name. If you are using a different WLAN device than a rt2570 you'll have to use a different nic name. 
-Take a look in the documentation of the nic driver. 
  
 If airodump-ng could connect to the WLAN device, you'll see a screen like this: If airodump-ng could connect to the WLAN device, you'll see a screen like this:
  
-{{http://​www.aircrack-ng.org/​img/​newbie_airodump.png}}+{{https://​www.aircrack-ng.org/​img/​newbie_airodump.png}}
  
-[[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). ​Channels between 36 and 149 are used for 802.11a. The current channel is shown in the top left corner.+[[airodump-ng]] hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a ​is in the 5GHz and availability in different countries is more fragmented than on 2.4GHz. In general, known channels starts at 36 (32 in some countries) to 64 (68 in some countries) and 96 to 165. Wikipedia has more details on channel availability. The Linux [[https://​wireless.wiki.kernel.org/​en/​developers/​Regulatory/​CRDA|Central Regulatory Domain Agent]] takes care of allowing/​forbidding transmissions on the different channels for your country; however, it needs to be set appropriately 
 + 
 +The current channel is shown in the top left corner.
  
 After a short time some APs and (hopefully) some associated clients will show up. After a short time some APs and (hopefully) some associated clients will show up.
Line 143: Line 94:
  
 ^ BSSID        | The MAC address of the AP  | ^ BSSID        | The MAC address of the AP  |
 +^ RXQ          | Quality of the signal, when locked on a channel |
 ^ PWR          | Signal strength. Some drivers don't report it  | ^ PWR          | Signal strength. Some drivers don't report it  |
 ^ Beacons ​     | Number of beacon frames received. If you don't have a signal strength you can estimate it by the number of beacons: the more beacons, the better the signal quality | ^ Beacons ​     | Number of beacon frames received. If you don't have a signal strength you can estimate it by the number of beacons: the more beacons, the better the signal quality |
-^ Data         | Number of data frames ​recieved ​  |+^ Data         | Number of data frames ​received ​  |
 ^ CH           | Channel the AP is operating on   | ^ CH           | Channel the AP is operating on   |
 ^ MB           | Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture ​ | ^ MB           | Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture ​ |
Line 156: Line 108:
 ^ STATION ​     | The MAC of the client itself ​ | ^ STATION ​     | The MAC of the client itself ​ |
 ^ PWR          | Signal strength. Some drivers don't report it  | ^ PWR          | Signal strength. Some drivers don't report it  |
-^ Packets ​     | Number of data frames ​recieved ​  |+^ Packets ​     | Number of data frames ​received ​  |
 ^ Probes ​      | Network names (ESSIDs) this client has probed ​ | ^ Probes ​      | Network names (ESSIDs) this client has probed ​ |
  
-Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[http://​aircrack-ng.org/​doku.php?​id=how_to_crack_wep_with_no_clients|How to crack wep with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.+Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See [[how_to_crack_wep_with_no_clients|How to crack WEP with no clients]]). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.
  
 In the example above the net 00:​01:​02:​03:​04:​05 would be the only possible target because it's the only one with an associated client. But it also has a high signal strength so it's really a good target to practice. In the example above the net 00:​01:​02:​03:​04:​05 would be the only possible target because it's the only one with an associated client. But it also has a high signal strength so it's really a good target to practice.
Line 167: Line 119:
 Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking: Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:
  
-  airodump-ng -c 11 - -bssid 00:​01:​02:​03:​04:​05 -w dump rausb0+  airodump-ng -c 11 --bssid 00:​01:​02:​03:​04:​05 -w dump wlan0mon
  
-With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk.  The "- -bssid"​ combined with the AP MAC address limits the capture to the one AP.  The "- -bssid"​ option is only available on new versions of irodump-ng.+With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk.  The "-''''​-bssid"​ combined with the AP MAC address limits the capture to the one AP.  The "-''''​-bssid"​ option is only available on new versions of airodump-ng.
  
-You can also add the -ivs parameter. This tells [[airodump-ng]] to only capture ​the IVs to save space.+Before being able to crack WEP you'll usually need between 40 000 and 85 000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different ​IVs is usually a bit lower than the number of data packets captured.
  
-Before being able to crack WEP you'll usually need between 250.000 and 500.000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different IVs is usually a bit lower than the number of data packets captured. +So you'll have to wait and capture ​40K to 85K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.
- +
-So you'll have to wait and capture ​250K to 500K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.+
  
 ===== Cracking ===== ===== Cracking =====
Line 187: Line 137:
 For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]]. For more information about [[aircrack-ng]] parameters, description of the output and usage see the [[aircrack-ng|manual]].
  
-The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stonger ​ones. So if you are lucky, you can crack a key with only 100.000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes. Experience shows that 250.000 to 500.000 IVs is usually enough for cracking.+The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ​ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.
  
-There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than "​n"​ different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the [[http://forum.tinyshell.be/|Forum]], there are some threads about cases like this and what to do.+There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than "​n"​ different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the [[https://forum.aircrack-ng.org/|Forum]], there are some threads about cases like this and what to do.
  
 ====== Active attacks ====== ====== Active attacks ======
- 
 ===== Injection support ===== ===== Injection support =====
-Most devices don't support injection - at least not without patched drivers. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay. ​ Sometimes this table is not up-to-date, so if you see a "​NO"​ for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our [[http://forum.tinyshell.be/|Forum]]. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the [[compatibility_drivers|compatibility page]] table and add a link to a short howto.+Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the [[compatibility_drivers|compatibility page]], column aireplay. ​ Sometimes this table is not up-to-date, so if you see a "​NO"​ for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our [[https://forum.aircrack-ng.org/|Forum]]. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the [[compatibility_drivers|compatibility page]] table and add a link to a short howto. ​(To do this, request a wiki account on IRC.)
  
 The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack. ​ Make sure to perform this test prior to proceeding. ​ Your card must be able to successfully inject in order to perform the following steps. The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the [[injection_test|injection test]] attack. ​ Make sure to perform this test prior to proceeding. ​ Your card must be able to successfully inject in order to perform the following steps.
Line 200: Line 149:
 You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP. You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP.
  
-The first thing to do is find out the MAC of your own WLAN device. Sometimes there is a label with the MAC on the device. But you can always find +Try to connect ​to your AP using [[aireplay-ng]]:
-it out using the ifconfig command (the 6 Hex bytes after "​HWaddr",​ usually divided by ":"​ or "-").+
  
-Then you can try to connect to your AP using [[aireplay-ng]]:+  ​aireplay-ng ​--fakeauth 0 -e "your network ESSID" -a 00:​01:​02:​03:​04:05 wlan0mon
  
-  aireplay-ng - -fakeauth 0 -e "your network ESSID" -a 00:​01:​02:​03:​04:​05 -h 00:​11:​22:​33:​44:​55 rausb0 +The value after -a is the BSSID of your AP.
- +
-The value after -a is the BSSID of your AP, the value after -h is the MAC of your own WLAN device.+
  
 If injection works you should see something like this: If injection works you should see something like this:
Line 217: Line 163:
  
 If not If not
-  - double-check ESSID, BSSID and your own MAC+  - double-check ESSID and BSSID
   - make sure your AP has MAC filtering disabled   - make sure your AP has MAC filtering disabled
   - test it against another AP   - test it against another AP
Line 229: Line 175:
 ==== The idea ==== ==== The idea ====
  
-[[http://​en.wikipedia.org/​wiki/​Address_Resolution_Protocol|ARP]] works (simplified) by broadcasting a query for an IP and the device that has this IP+[[https://​en.wikipedia.org/​wiki/​Address_Resolution_Protocol|ARP]] works (simplified) by broadcasting a query for an IP and the device that has this IP
 sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid. sends back an answer. Because WEP does not protect against replay, you can sniff a packet, send it out again and again and it is still valid.
 So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs). So you just have to capture and replay an ARP-request targeted at the AP to create lots of traffic (and sniff IVs).
Line 239: Line 185:
 Wait for a client to show up on the target network. Then start the attack: Wait for a client to show up on the target network. Then start the attack:
  
-  aireplay-ng - -arpreplay -b 00:​01:​02:​03:​04:​05 -h 00:​04:​05:​06:​07:​08 ​rausb0+  aireplay-ng --arpreplay -b 00:​01:​02:​03:​04:​05 -h 00:​04:​05:​06:​07:​08 ​wlan0mon
  
 -b specifies the target BSSID, -h the MAC of the connected client. -b specifies the target BSSID, -h the MAC of the connected client.
Line 245: Line 191:
 Now you have to wait for an ARP packet to arrive. Usually you'll have to wait for a few minutes (or look at the next chapter). Now you have to wait for an ARP packet to arrive. Usually you'll have to wait for a few minutes (or look at the next chapter).
  
-If you were successfull, you'll see something like this:+If you were successful, you'll see something like this:
  
   Saving ARP requests in replay_arp-0627-121526.cap   Saving ARP requests in replay_arp-0627-121526.cap
Line 254: Line 200:
 the -r <​filename>​ option. the -r <​filename>​ option.
  
-When using the arp injection technique, you can use the PTW method to crack the WEP key.  This dramatically reduces the number of data packets you need and also the time needed. ​ You must capture the full packet in airodump-ng,​ meaning do not use the "- - ivs" option when starting it.  For [[aircrack-ng]],​ use "​aircrack -z <file name>"​.+When using the ARP injection technique, you can use the PTW method to crack the WEP key.  This dramatically reduces the number of data packets you need and also the time needed. ​ You must capture the full packet in airodump-ng,​ meaning do not use the "-''''​-ivs" option when starting it.  For [[aircrack-ng]],​ use "​aircrack -z <file name>"​. ​(PTW is the default attack)
  
-If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x <packets per second> option. I usually start out with 50 and reduce until packets are received ​contiously ​again. Better positioning of your antenna usually also helps.+If the number of data packets received by airodump-ng sometimes stops increasing you maybe have to reduce the replay-rate. You do this with the -x <packets per second> option. I usually start out with 50 and reduce until packets are received ​continuously ​again. Better positioning of your antenna usually also helps.
  
 ==== The aggressive way ==== ==== The aggressive way ====
  
-Most operating ​sytems ​clear the ARP cache on disconnection. If they want to send the next packet after reconnection (or just use DHCP), they have to send out ARP requests. So the idea is to disconnect a client and force it to reconnect to capture an ARP-request. A side-effect is that you can sniff the ESSID during reconnection too. This comes in handy if the ESSID of your target is hidden.+Most operating ​systems ​clear the ARP cache on disconnection. If they want to send the next packet after reconnection (or just use DHCP), they have to send out ARP requests. So the idea is to disconnect a client and force it to reconnect to capture an ARP-request. A side-effect is that you can sniff the ESSID and possibly a keystream ​during reconnection too. This comes in handy if the ESSID of your target is hidden, or if it uses shared-key authentication.
  
 Keep your airodump-ng and aireplay-ng running. Open another window and run a [[deauthentication]] attack: Keep your airodump-ng and aireplay-ng running. Open another window and run a [[deauthentication]] attack:
  
-  aireplay-ng - -deauth 5 -a 00:​01:​02:​03:​04:​05 -c 00:​04:​05:​06:​07:​08 ​rausb0+  aireplay-ng --deauth 5 -a 00:​01:​02:​03:​04:​05 -c 00:​04:​05:​06:​07:​08 ​wlan0mon
  
 -a is the BSSID of the AP, -c the MAC of the targeted client. -a is the BSSID of the AP, -c the MAC of the targeted client.
  
-Wait a few seconds and your arp replay should start running.+Wait a few seconds and your ARP replay should start running.
  
-Most clients try to reconnect automatically. But the risk that someone recognizes this attack or at least attention is drawn to the stuff happening on the WLAN is higher +Most clients try to reconnect automatically. But the risk that someone recognizes this attack or at least attention is drawn to the stuff happening on the WLAN is higher than with other attacks.
-than with other attacks.+
  
  
  
 ====== Further tools and information ====== ====== Further tools and information ======
-[[http://​www.tuto-fr.com/​tutoriaux/​crack-wep/​aircrack-ng.php|Tutorial in french for aircrack-ng]] [[http://​www.tuto-fr.com/​tutoriaux/​tutorial-crack-wep-aircrack.php|or in english]]+ 
 +More tutorials can be found on [[tutorial|this page]].
newbie_guide.1182805836.txt.gz · Last modified: 2007/06/25 23:10 by mister_x