Here I will be sharing How to HACK and How to be SAFE from getting hacked.
Do share your Hacking tricks too ... ;)
The Tutorials And Softwares I am uploading Is Strictly for Educational Purpose only .. Nothing Is Impossible .
Hello guys, I'm not going to discuss handshakes since I guess you all are familiar with airmon, airodump and aireplay and now how to get them. that's about the first step in cracking WPA and the easy job. The hard job is to actually crack the WPA key from the capfile. I was looking for a method that is full proof without actually storing a huge wordlist on your desktop (talking about lots of lots of terrabites) so i came up with the following:
(notice there is a space in the command that shouldnt be there, i guess the forum can't handle 62characters word)
meaning that crunch is making a list with minimum 0 and maximum 25 characters with alfanumeric small and cap characters that are not stored in a wordlistfile. The "|" ends the crunch command and then we go to the aircrack command: With the bssid of the "victim" (notice you have to be authorised by the victim to do the test) and -w- wich specifies the handshake.cap file.
It took me about 30 minutes to crack the following WPA password: hickmin123 (wich is an easy password because there are no caps in the password) However I believe its almost a fullproof method and with lots of time you are able to crack long passwords. Now the real question... Crunch with Pyrit together : crunch 0 25 abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWX YZ0123456789 | pyrit -r xxx.cap -b xx:xx:xx:xx:xx:xx -i - attack_passthrough
Many times in penetration testing engagements you will discover authentication forms that you will need to bypass in order to gain access to an application or to a remote system.Having a big and a good wordlists always help but as a penetration tester you must be able to create your own custom wordlists depending on thesituation.There are a variety of tools that can assist you on this but here we will focus on Crunch.
Create a Sample Wordlist
The first thing that you need to do is to open terminal and write cd /pentest/passwords/crunch
Next we execute the following command
./crunch 5 5 admin -o pentestlab.txt
Create a sample wordlist
This will instruct crunch to create a wordlist that will have minimum length of characters 5,maximum length of characters 5 with the characters of admin and it will save it on a .txt file called pentestlab as you can see it and in the image below.
Output of a sample wordlist
Of course instead of just letters we can create a wordlist that will include only numbers with the command:
./crunch 5 5 12345 -o numbers.txt
The same method applies and if we want to create a wordlist mixed with letters and numbers.
./crunch 5 5 pentestlab123 -o numbersletters.txt
Special Characters
For special characters like !$% you will need to execute something like the following:
./crunch 5 5 pentestlab\%\@\!
This is because some special characters need escaping and the \ is used before the character.
Special Characters
String Permutations
Here there are two options.First options is when we will want to generate something based on the characters of a word.For example ./crunch 1 1 -p abc will produce the following list:
String Permutation – Characters
The second option is when we will want to create a list based on different words.For example the words blue and red can be bluered or redblue.We can achieve this with the command ./crunch 1 1 -p pen test lab
String Permutation – Words
Splitting Wordlists
If we use the -b option we will instruct crunch to create a wordlist which will be divided into multiple files.Another option that we can combine with that command is to choose the size of our wordlist.For example:
./crunch 6 6 0123456789 -b 1mb -o START
This will generate wordlists which will be 1Mb each and with 6 characters size and it will include the characters 0123456789.
Splitting Wordlists
Specify the number of words
Crunch allows us to specify the number of words in each wordlist.This will create a wordlists that it will contain 20 words maximum by taken a specific charset of lalpha which is [abcdefghijklmnopqrstuvwxyz].
./crunch 3 3 -f charset.lst lalpha -o START -c 20
Alternatively you can use any other charset from the list that comes with crunch if you don’t want to use a custom charset.
Number of words
Prefix Wordlists
Now lets say that we want to create a wordlist that will contains the word pentestlab followed by 3 randomcharacters.The command for that will be:
Creating wordlists can facilitate your needs when performing a penetration test.Crunch of course offers a variety of options and combinations that a user can play with.Trying to brute force of course an application or a system with a wordlist can of course lock you out depending on the account lockout policy but it always helps if you can have your own custom wordlists that may be help you to obtain access. VIDEO TUTORIAL :
Remember this is a professional wireless auditing tool and you should only use it on your clients or personal networks to test for security. Do not hack networks that you do not own or affiliated with.
Ok so many people want to know how to hack WPA / WPA2 with a dictionary wordlist. It is an extremely easy to do but as there are so many combinations of passwords you need to be strategic in creating your own wordlist based on research of the potential format of default passwords the ISP or AP manufacturer may have put in place.
Also when someone changes that password typically they choose a very simple password like xiaopan1234. For that I suggest you use crunch.
Now, before you start this tutorial you should have Xiaopan 0.4.5, a compatible device and it should be installed in virtualisation or as a Live USB or CD (USB is recommended).
I Used Xiaopan 0.4.5 Installed it using LiLi USB Creator ALFA AWUS036H
It took me about 3 minutes to hack but I was using my own router so I embedded the password in the wordlist I created. Longest part was capturing the handshake which took about 1 minute.
Step 1
Open Minidwep (4th icon from the right and click OK to the disclaimer)
Step 2
Click Scan and make sure WPA/WPA2 is selected in the Encryption drop down box
Step 3
Now select the network you want to hack
Step 4
Now you want to select Launch, this will try to capture the handshake, it can take awhile
Step 5
After you have captured the handshake this box will come up, navigate to the wordlist you created
Step 6
When you found it click OK
Step 7
Now when it finds the password this box will show up
Step 8
Now we can save the handshake, the Key will be saved in the tmp folder
Step 9
Now you can save it your computer. I suggest you mount another USB using the mount tool (8th icon on right) and navigate to your mnt/device
Step 10
Select the file you want to copy.
This was a quick tutorial but plan to add more later. If you have any questions please feel free to ask.
3. [Optional] Use Aireplay-ng to Deauthenticate the Wireless Client
This step is optional. If you can't wait till airodump-ng captures a handshake, you can send a message to the wireless client saying that it is no longer associated with the AP. The wireless client will then hopefully reauthenticate with the AP and we'll capture the authentication handshake.
Send DeAuth to broadcast : $ sudo aireplay-ng --deauth 100 -a 00:11:22:33:44:55 mon0 --ignore-negative-one
Send directed DeAuth (attack is more effective when it is targeted) : $ sudo aireplay-ng --deauth 100 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF mon0 --ignore-negative-one
Option
Description
--deauth 100
The number of de-authenticate frames you want to send (0 for unlimited)
-a
The MAC address of the access point
-c
The MAC address of the client
mon0
The wireless interface
--ignore-negative-one
Removes 'fixed channel : -1' message
4. Run Aircrack-ng to Crack WPA/WPA2-PSK
To crack WPA/WPA2-PSK, you need a password dictionary as input. You can download some dictionaries from here.
Crack the WPA/WPA2-PSK with the following command :
