|
2011-01-30
, 16:33
|
|
Posts: 518 |
Thanked: 334 times |
Joined on Mar 2010
@ italy
|
#202
|
|
2011-01-30
, 19:50
|
Posts: 55 |
Thanked: 4 times |
Joined on Jun 2010
|
#203
|
|
2011-01-30
, 20:32
|
|
Posts: 330 |
Thanked: 483 times |
Joined on Dec 2010
@ Norwich, UK
|
#204
|
Q. Why is WPA so much harder to crack?
A. WEP encryption is weak. Each IV (initialization vector) contains a small portion of the key, so when enough of these are captured the key can be deciphered. WPA however is far more secure and cannot be "cracked". However, when an authenticated client connects to a WPA access point a "handshake" is generated. This handshake can be captured by airodump and aircrack can subsequently run a bruteforce dictionary attack against it, possibly finding the key (however if the exact key is not in the dictionary, it will obviously not work). To capture the handshake you can either wait for a client to connect, or you can launch a deauthentication attack (using my script) to force a client to disconnect and reconnect to the AP, allowing you to capture the handshake.
However, a word list big enough to 100% GUARANTEE to crack an 8-digit alphanumeric case-sensitive wpa key would have up to 62771017353866807638357894232076664161023554444640 34512896 different combinations. And this is WITHOUT symbols.
On the same basis, a 64-digit wpa key would have up to 39402006196394479212279040100143613805079739270465 44666794829340424572177149721061141426625488491564 0806627990306816 different combinations.
These wordlists would be thousands of terabytes in their totality.
In short, it's possible but not feasible. Bearing in mind that a device like the N900 could probably only check around 20-30 keys per second. The best you could do is capture the handshake with the N900 then use a desktop to attempt to crack the password.
Realistically, the only way you are going to bruteforce a wpa key is if the person who the network belongs to (obviously you ) has set something really mundane or stupid as their key. Any default key containing letters and numbers would be near enough impossible and take possibly years to break.
|
2011-01-30
, 20:37
|
Posts: 130 |
Thanked: 24 times |
Joined on Jan 2011
|
#205
|
|
2011-01-30
, 20:39
|
|
Posts: 330 |
Thanked: 483 times |
Joined on Dec 2010
@ Norwich, UK
|
#206
|
|
2011-01-30
, 20:45
|
Posts: 446 |
Thanked: 114 times |
Joined on Jan 2010
@ Lake District, Cumbria, UK
|
#207
|
|
2011-01-30
, 20:51
|
|
Posts: 330 |
Thanked: 483 times |
Joined on Dec 2010
@ Norwich, UK
|
#208
|
Hi frummage...i have been looking into wordlists myself today....i have found lists at around 100-150mb that would have good chances of being succesful due to most or a lot of folks using names places numbers etc and i have found large file lists 1-33 gig....many word lists are out there and easy to obtain. my question is can we add mutliplle wordlists?
|
2011-01-30
, 20:53
|
Posts: 130 |
Thanked: 24 times |
Joined on Jan 2011
|
#209
|
|
2011-01-30
, 20:56
|
|
Posts: 1,187 |
Thanked: 816 times |
Joined on Apr 2010
@ Australia
|
#210
|
The Following User Says Thank You to kingoddball For This Useful Post: | ||
Tags |
aircrack, aircrack-ng, epicfacepalm, pen testing, rtfm dude! |
|
this is a great great tool!
now im trying to get my own key but I've wpa... y just wanna know how to brute force it...