Atatacks Wifi wireless card And You're Auditing Your Own Network here guides!

Kiw Kiw Februari 22, 2020 0

Wep attacks

Attacks not using a client

If you have no connected clients (for example, if you've only got one wireless card, and you're auditing your own network) you might need to use this attacks.

Fake auth (Automatic)

Airoscript here performs a fake auth attack, to associate with AP, and a arp replay attack for injection, typically doing something like:

aireplay-ng WIFI_INTERFACE --arpreplay -b TARJET_MAC -d INJECTION_MAC -f 1 -m 68 -h FAKE_MAC -x 1000
aireplay-ng -3 -b AP_MAC -h SOURCE_MAC WIFI_INTERFACE

Where source mac (in this case) is INJ_MAC

That is, fake auth and arp replay attacks. Basically, according to aircrack-ng wiki:

The fake authentication attack allows you to perform the two types of WEP
authentication (Open System and Shared Key) plus associate with the access point (AP).
This is only useful when you need an associated MAC address in various aireplay-ng attacks
and there is currently no associated client. It should be noted that the fake authentication
attack does NOT generate any ARP packets. Fake authentication cannot be used to
authenticate/associate with WPA/WPA2 Access Points.

The classic ARP request replay attack is the most effective way to generate new
initialization vectors (IVs), and works very reliably. The program listens for an ARP packet
then retransmits it back to the access point. This, in turn, causes the access point to repeat
the ARP packet with a new IV. The program retransmits the same ARP packet over and over.
However, each ARP packet repeated by the access point has a new IVs. It is all these new IVs
which allow you to determine the WEP key.

In interactive mode, you'll be asked for the "f" (from-to destination bit), making you able to make it into a t, and the destmac (wich, by default, is FF:FF:FF:FF:FF:FF)

Have a look at _Fake auth at aircrack-ng wiki: https://www.aircrack-ng.org/doku.php?id=fake_authentication and _ARP replay at: https://www.aircrack-ng.org/doku.php?id=arp-request_reinjection

Fake auth (Interactive)

Almost same as fake auth, automatic, except for aireplay being called in interactive mode, wich will force the user to select a packet instead of injecting the first that it gets.

Have a look at _Fake auth at aircrack-ng wiki: https://www.aircrack-ng.org/doku.php?id=fake_authentication

Fragmentation attack

Here, airoscript-ng kills every airodump-ng and aireplay-ng processes (-9 kill, be careful as all airodump processes will stop recording and not save data) and removes all old fragmentation captures and normal captures (hard-cleans everything). Be careful!

Note to self: IF NO _DUMP_PATH_ PROVIDED, AND NO HOST MAC PROVIDED (It's imposible to get here with airoscript, just if you source attacks/wep and execute directly wep_attacks_fragmentation) it will do a rm /* wich is dangerous

Then it launches aireplay, in this case, assuming you've no clients, with injection (-5, --fragment option) like this:

aireplay-ng -5 -b AP_MAC -h FAKE_MAC -k FRAG_CLIENT_IP -l FRAG_HOST_IP WIFI_INTERFACE

Have a look at _Fragmentation at aircrack-ng wiki: www.aircrack-ng.org/doku.php?id=fragmentation

Chopchop attack

Makes a hardclean. Starts capturing, fake auth (3) and aireplay with chopchop attack, then it calls the _Injection menu: injection.html

aireplay --chopchop -b AP_MAC -h FAKE_MAC WIFI_INTERFACE

According to aircrack-ng wiki:

This attack, when successful, can decrypt a WEP data packet without knowing the key.
It can even work against dynamic WEP. This attack does not recover the WEP key itself,
but merely reveals the plaintext. However, some access points are not vulnerable to this
attack. Some may seem vulnerable at first but actually drop data packets shorter
that 60 bytes. If the access point drops packets shorter than 42 bytes, aireplay
tries to guess the rest of the missing data, as far as the headers are predictable.
If an IP packet is captured, it additionally checks if the checksum of the header
is correct after guessing the missing parts of it. This attack requires at
least one WEP data packet.

Have a look at its aircrack-ng docs at _aircrack-ng wiki: https://www.aircrack-ng.org/doku.php?id=korek_chopchop

Attacks using a client

When the ap has a client connected, you can use the following attacks.

Arp replay (Automatic)

Calls aireplay-ng for a arpreplay, as in fake auth, except that does not execute a fake auth attack.

aireplay WIFI_INTERFACE --arpreplay -b AP_MAC -d INJECTION_MAC\
-f 1 -m 68 -n 86 -h CLIENT_MAC -x INJECTRATE

Arp replay (Interactive)

Same as previous attack, interactive mode.

Fragmentation attack

Have a look at fragmentation attack without clients, this is basically the same, except for aireplay-ng being called with -7 option, like this:

aireplay-ng -7 -b AP_MAC -h CLIENT_MAC -k FRAG_CLIENT_IP -l FRAG_HOST_IP WIFI_INTERFACE

Have a look at _Fragmentation at aircrack-ng wiki: www.aircrack-ng.org/doku.php?id=fragmentation

Chopchop attack

Almost the same as non-client directed chopchop, except this one does not make a fake_auth attack, and provides client_mac like this:

aireplay-ng --chopchop -h CLIENT_MAC WIFI_INTERFACE

It also calls inject menu, directed for chopchop.

Cafe latte attack

It just executes fakeauth3 and caffe late attack ( -6 option to aireplay-ng )

According to aircrack-ng wiki:

The Cafe Latte attack allows you to obtain a WEP key from a client system.
Briefly, this is done by capturing an ARP packet from the client, manipulating
it and then send it back to the client. The client in turn generates packets
which can be captured by airodump-ng. Subsequently, aircrack-ng can be used
to determine the WEP key.

Have a look at its aircrack-ng docs at _aircrack-ng wiki: https://www.aircrack-ng.org/doku.php?id=caffe-lat

Feb 22, 2020 10:12:28 AM wapmild cyber sites.