Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

https://github.com/brannondorsey/wifi-cracking

by braxxox • 9 years ago

475 132 9 years ago

How long does the cracking process take? I remember WEP only taking 10 minutes using aircrack-ng in BackTrace... I imagine this takes substantially longer.

jaclaz• 9 years ago

Naive-hashcat uses various dictionary, rule, combination, and mask attacks and it can take days or even months to run against strong passwords. The cracked password will be saved to hackme.pot, so check this file periodically.

legojoey17• 9 years ago

So I don't have experience with WPA cracking, but if the access point has WPS (the click to connect button) you can sniff handshakes on the network and crack the WPA password it in relatively no time. In my experience this has usually been under 10 minutes.

ty_a• 9 years ago

On most recent firmware, there is an exponential backoff on WPS connection attempts.

rexicus• 9 years ago

It's not viable for those random 12-ish digit passwords most ISPs will use.

Qub3d• 9 years ago

Yeah, which is why it is sometimes weirdly safer to not change your SSID - a cracker can assume that someone who figured out how to change the broadcast name could've also changed the WiFi password... often to something much less secure.

arprocter• 9 years ago

Time taken to crack WEP depended on if it was a 64 or 128 bit key

I did a study using an Atom netbook - a 64 bit key (10 digits long) took 8 mins to find, 128 (26 digits) took 30 mins

mkagenius• 9 years ago

If it is as slow as SHA512 then it will take 20 days on AWS g2 x8 large for 8 characters (made of alphanumeric or some 10 other symbols).

yedpodtrzitko• 9 years ago

Is there anything novel in there? On a first sight it seems just like a guide done hundred times before...

IncRnd• 9 years ago

Nope. This is an ancient attack.

jagermo3• 9 years ago

Nothing new, but a decent writeup with a nice format.

polpo2• 9 years ago

4,733,979 out of the 14,344,391 passwords (33%) in the rockyou.txt dictionary file used for cracking in this guide are too short to be WPA2 passwords, which have a minimum length of 8 characters. Are aircrack and/or hashcat smart enough to not bother hashing those short passwords?

polpo2• 9 years ago

(looks like the case for aircrack-ng, at least: https://github.com/aircrack-ng/aircrack-ng/blob/master/src/a...)

domenukk2• 9 years ago

5 million hashes only take a few seconds for wpa2 anyway... Less than two for this system: https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27...

stusmall• 9 years ago

They don't touch it in this tutorial but typically you don't check just whats in your dictionary. You also use a set of rules to manipulate your dictionary that massively increases the number of hashes to perform. Those 5 million entries quickly passes tens of billions hashes that need to be run. These initial entries might be too short like OP pointed out, but after the rules are applied it might generate many entries that will be long enough to spend time hashing.

The keyspace for WPA is huge and the hash speed is still relatively slow, even with an extremely high end system like you linked to the quality of the initial dictionary is really important.

weinzierl• 9 years ago

hashcat is smart enough in a subtle way. It will not bother with candidates that are unsuitable for a certain hash type. It checks this after the rules have been applied. (stusmall's comment explains the influence of rules better than I could). Hashcat shows these candidates as "Rejected".

The interesting part is that you can't configure the minimum or maximum length anymore[1], the restrictions are hard coded for every hash type. This is because for fast hashes the branch introduced by the check would be slower than just hashing away[2].

[1] It was possible with the old CPU-based hashcat (--pw-min and --pw-max)

[2] https://hashcat.net/forum/thread-3444.html?highlight=branch

aerovistae2• 9 years ago

I attempted to do this once and it turned out to be monumentally difficult. I got as far as setting up a bootable kali thumb drive before getting stopped in my tracks by hardware incompatibilities and unexpected behaviors and errors. These articles make it sounds a LOT easier than it is. I was very disappointed because I was really excited about it.

The_Sponge• 9 years ago

It's not for the faint of heart or faint of technical skill - different drivers have different behaviors and ways to enter the various capture and raw packet modes needed to do this.

Personally, as long as I stick to supported chipsets, I've almost never had an issue.

wil4213• 9 years ago

Have you found a wifi card that will work on any laptop or desktop?

wil4213• 9 years ago

When I was in school and taking some network security classes I attempted to crack my own wifi. Even after buying a wifi card that could do what I need I faced hardware isssues. It was a major PIA.

It was almost easier to automate a brute force, sit back and wait.

borne0• 9 years ago

And to make matters worse the compatible hardware has been counterfeited a thousand times over and you never know which one you're going to get purchasing online.

rxhernandez• 9 years ago

I beg to differ. I was doing this at 15 or 16 years old in 2006 when it was still called backtrack. So long as you had a mainstream laptop, the most difficult part was buying a compatible wireless card.

To note, the extent of my technical abilities at that time wasn't much beyond being able to install a mainstream linux distribution or write a simple program in C.

maxerickson• 9 years ago

Yeah, I used Backtrack to show my brother that his big complex password didn't mean anything if he was using WEP (this was quite a while ago).

On a pretty standard laptop (intel chipset/CPU/GPU/Wireless) it booted right up with no effort.

aerovistae2• 9 years ago

Regrettably it didn't work out that way for me. I had a brand new macbook air at the time I tried this. When I booted into Kali, I was unable to access the network settings at all[1], period, let alone get any packet sniffing going. I couldn't even connect to the internet.

[1] https://unix.stackexchange.com/questions/273941/missing-netw...

danieka• 9 years ago

Thanks for the nostalgia trip. We must be about the same age and I remember hitting up local corporations that had WEP encrypted networks and offering them my help in improving their security.

Felt like a real security expert then ;) I'm out of that loop now but security sure did seem a lot easier to get a grip on at that time.

throwasehasdwi7• 9 years ago

I'm not sure why this is amazing enough to make the first page but W/E it's HN :). Just so less informed are aware, this has been feasible for maybe 7 years (since GPU calculation became possible).

Just so nobody freaks out, this is cracking weak passwords, not broken WPA.

I have myself cracked countless WiFi passwords when security testing. It's easy if the passwords are bad, which is maybe 90% of the time for home networks and 60% for businesses. The attack is completely passive if you don't want to be noticed, and with a cheap dish you can pickup both ends of the handshakes from up to around a quarter mile away (line of sight).

amluto2• 9 years ago

Just so nobody freaks out, this is cracking weak passwords, not broken WPA.

I beg to differ. The fact that WPA is subject to a passive attack at all is a defect. It should use a PAKE, which would entirely avoid this type of attack.

There are simple balanced PAKE protocols that would do the trick. DH-EKE, SPAKE2, J-PAKE, and even the venerable SRP would all work. I believe that several are old enough that no patents are possible, and, even when WPA was standardized, something should have been available.

throwasehasdwi7• 9 years ago

Yes, this is still a major problem with WPA. Also the fact that certain control packets aren't authenticated is nearly unforgivable. If correctly designed the only reasonable attack on wifi would be channel jamming, sadly after many years this still is not the case.

MadSax2• 9 years ago

For those that don't know, like me, how would PAKE etc protect cracking of weak passwords used during client authentication?

throwaway91111• 9 years ago

Agreed. However, WPA has been obviously broken for years; just use WPA2 instead. It's also way easier to set up on your grandmother's random router.

mdeeks• 9 years ago

Can someone define what is considered a weak vs strong password now for WiFi? The only guides I found online are years old.

Is 10 characters considered weak for mixed case letters, numbers, plus punctuation now?

fhood• 9 years ago

Weak = is in rainbow table that hashcat is using

throwasehasdwi7• 9 years ago

Wifi password cracking is only around 1000X slower than a SHA256 brute-force if I remember right. So your password needs to be secure enough that if a hash of it was leaked it would never be cracked.... So very strong.

WPA enterprise using certificates is usually much harder to crack since you need to interrogate server, you can't just brute force hash. This method only really applies to PSK mode (home networks and small businesses usually)

domenukk2• 9 years ago

If you consider your random keyspace with 26 * 2 chars + 10 numbers + 20ish special chars then to crack 10 letters you'll have to try an average of ((26 * 2 + 10 + 20) ^ 10) / 2 = 6.8724016e+18 keys. If you then assume around 3 million hashes per second it still takes around 72641 days to crack your password.

Edit: As another comment said, just make sure it's not easy to guess based on rainbow tables and whatnot

rocqua• 9 years ago

To do this formally, you need to consider information entropy. This is all about how you generated your password. 10 characters of totally random mixed case, numbers and punctuation gives about 60 bits of entropy which is strong enough.

HOWEVER, that calculation only works if all 10 characters were generated uniformly and randomly. Humans are terrible at this. Now, maybe your trick for turning words into safe passwords is great, but there is no way to be sure. Sadly, remembering 10 random characters is hard.

Luckily, easy to remember and strong passwords are possible. The system I would recommend is diceware: www.diceware.com

Dylan168072• 9 years ago

That should be enough, but keep in mind that you might be entering the password on a lot of non-keyboards. 20 lowercase letters is faster and far more secure. Even 14-15 lowercase letters is soundly better.

slackingoff20174• 9 years ago

I read in many places that the easiest way to generate a really strong password is to memorize a fairly long sentence and use the first letter of each word.

However definitely DONT use a quote or lyrics. Needs to be something unique.

lqdc132• 9 years ago

Nowadays most routers I've seen come with a pre-shared key that's something like 20 chars long.

It's been the case with Comcast + Verizon for a while now. Not sure about AT&T.

Still might work 10% of the time though.

paulgerhardt• 9 years ago

Some regional bias here.

Most of Asia (so most of the world) use digits only for their wifi password.

Lack of fluency with Latin characters was not a big concern in the original implementation. That should be fixed with WPA3

thomastjeffery2• 9 years ago

but W/E it's HN

Would you please simply type "whatever", instead of this "W/E" nonsense? Considering the amount of 8+ character adjectives you used, you clearly aren't trying to be less verbose.

hartator• 9 years ago

I am okay with abbreviations, but I had to think twice for this one.

hyperdunc• 9 years ago

In the same spirit of improving grammar and readability - I think you meant to type 'number' of 8+ character adjectives.

Markoff• 9 years ago

i am not native speaker so didn't even know what does it mean, since it's much less common than Without written this way

melq• 9 years ago

You understood him perfectly well, what exactly is your criticism? If he agrees to comply to your arbitrary standards of style, only to say the exact same thing, will you agree to "please simply" refrain from being obnoxious for no reason?

TheAceOfHearts• 9 years ago

In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer? I'm pretty paranoid, and also think it could be an insightful experience to tinker around with networking tools.

Any advice for what constitutes a strong or weak password in this context?

ComputerGuru• 9 years ago

I wanted to do that in my home, but good luck getting IoT devices to connect which may be a good thing..)

You'd probably have to set up a separate network for those devices (again, technically a good thing) which can be a source of some friction.

It used to be only good routers had a guest network option, but now even $20 TP-Links can use Radius for the main network and WPA2 for the guest network; though I'm not sure you can do something like whitelist by MAC on only the guest network.

pixl97• 9 years ago

In your opinion, is setting up a RADIUS server and using WPA2-Enterprise worth it for a consumer?

It can be a pain in the ass when the consumer device requires a valid SSL certificate. On active directory networks this isn't much of a problem because a CA is pushed out to devices, but automating this at home can be a bigger issue.

cpach• 9 years ago

~15 random characters (printable ASCII of course) should be enough for a WPA2 password.

jagermo3• 9 years ago

If I might ask, how would you compile a password list for a non-english speaking country?

Just look for a wordlist in the respective language or also try to create your own via tools like CeWL?

baalimago• 9 years ago

most people don't change password on their routers anymore

webaholic• 9 years ago

To the script kiddies out there who read this: Do not try this on others wifi. It is a crime in the USA to crack network routers. Although the chance of you getting caught is low, better be safe than sorry.

jaimex2• 9 years ago

whats the punishment in the US?

quacker• 9 years ago

IANAL, but from reading for a little bit, it seems to vary and states have their own laws.

There's some discussion on Wikipedia here[2] of unauthorized piggybacking (which does not even require hacking the network), with a few examples of actual instances.

In St. Petersburg, 2005, Benjamin Smith III was arrested and charged with "unauthorized access to a computer network", a third-degree felony in the state of Florida, after using a resident's wireless network from a car parked outside.

A third-degree felony in Florida seems to be up to 5 years. In some states it is up to 10 years. Another person got "a fine of $250 and one year of court supervision".

If it's unauthorized access to the computer of a government or financial institution (or "which is used in or affecting interstate or foreign commerce or communication", which can be interpreted very broadly), then the Computer Fraud and Abuse Act would apply[2]. From reading about the sections regarding "trespassing", punishment can be a fine and 1-5 years imprisonment (first offense), or up to 10 years (repeated offense).

1: https://en.wikipedia.org/wiki/Legality_of_piggybacking#Unite...

2: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

djsumdog3• 9 years ago

Technically using iodine to tunnel via DNS on captive portals is also illegal (I think .. although I'm not sure if anyone has been prosecuted for this .. IANAL)

slackingoff20174• 9 years ago

It is possible to catch 4 way handshakes completely passively. You're not hacking into anything, simply observing.

It's not illegal to receive signals on an unlicensed band with stock equipment

omginternets• 9 years ago

You're not hacking into anything, simply observing.

Technical distinctions don't always map onto legal distinctions. Even if you're eventually acquitted, how much do you want to pay yourself per hours to explain this to a judge?

pavel_lishin• 9 years ago

It's not illegal to receive signals on an unlicensed band with stock equipment

But my neighbors would still be pretty miffed, and would likely have legal recourse, if I passively captured their EM emissions in the 390-700nm band through their bedroom windows at night on a regular basis.

nextstep• 9 years ago

Does this only crack single word passwords? If my password was two common dictionary words or a common word plus a single number, would this try that possibility?

braxxox2• 9 years ago

Using a wordlist with aircrack-ng seems to only try the literal passwords in the dictionary. If you use naive-hashcat, a series of dictionary, rule, combination, and brute-force attacks will be used. I recommend reading up on the hashcat wiki (https://hashcat.net/wiki/) to learn how to conduct your own custom hashing attacks.

bobsgame• 9 years ago

I had the idea a long time ago to make a dd-wrt image which would automatically crack the vulnerable routers within distance, detect the model, and install a compatible version of itself in order to spread virally and create a mesh network. I'm not going to pursue it because it probably breaks a lot of laws, but I'm still curious if it would have been possible. Does anyone know if this is actually feasible? Maybe the radios can't handle that sort of thing?

pletnes• 9 years ago

Did you mean this?

http://gizmodo.com/264050/slurpr-wi-fi-box-sucks-up-six-sign...

crummy• 9 years ago

Probably cracking passwords would be very slow on router hardware - cool idea though.

goda90• 9 years ago

The load could be distributed between nodes, or the original node could be backed by a more powerful machine to do the cracking.

braxxox2• 9 years ago

That certainty breaks the Computer Fraud and Abuse Act, and while impractical, I think you could be charged separately for cracking each router. That said, interesting idea. If I were to do it, I wouldn't crack the passwords on the router itself, but rather attach 3G hardware to the router to "phone home" captured handshakes and run your cracking on GPUs in the cloud, sending results back to the router.

sml156• 9 years ago

It's called evil twin and if you thought of it more than ten years ago you would've had to write your own script.

rootsudo• 9 years ago

Honestly, why reinvent the wheel. Use Wifite2 with a proper password list and done.

thinkxl2• 9 years ago

there are two kinds of people, the ones that want to learn how to do it "manually" and the script kiddies.

jagermo3• 9 years ago

the proper password list part really is the challenge.

thinkxl2• 9 years ago

wifite2[1] is a wrapper tool that does all this automatically.

Not trying to say that easier is better, in this case. Just wanted to show this tool for those who don't know it.

[1] https://github.com/derv82/wifite2

edit: added wifite initially, replaced it with wifite2

tambourine_man• 9 years ago

Anyone tried Apple's Airport drivers and Linux on VirtualBox?

nikkwong• 9 years ago

Can someone help me understand why, from a technical perspective, it is necessary to capture the handshake?

mattfaus• 9 years ago

The handshake contains the encrypted password. The idea is to reverse this encryption to obtain the plaintext password.

nictrix• 9 years ago

The DSL provider in my area sets up customer's wireless networks with their home or mobile phone number as the password. If you know that number or can look it up in public records then you're in. If you can't find it maybe use a dictionary pertaining to the area code of phone numbers and then you're in. When the protocol changes to something more secure, the ISP's customer will still be as insecure as they always were.

c3833174• 9 years ago

That's not as bad as deriving password and SSID (Provider-$generated_number) from the MAC address, it didn't take much for somebody to reverse the algorithm from the bootloader and make various programs to calculate the few possible password from SSID

buschtoens• 9 years ago

The deauthentication packet looks interesting. Does that mean, that I could annoy the hell out of my neighbors by constantly forcing all of their devices to reconnect?

billfor• 9 years ago

Just fyi if you are using Kali the rockyou list is already in /usr/share/wordlists.

Also to reduce the size of the pcap file, you may want filter it for EAPOL packets only:

tshark -r input.pacp -R "eapol || wlan.fc.type_subtype == 0x08" -w small.pcap

Crack WPA/WPA2 Wi-Fi Routers with Aircrack-Ng and Hashcat

Related Stories