How to Hack Wi-Fi: Cracking WEP Passwords with Aircrack-Ng « Null Byte :: WonderHowTo

Welcome back, my rookie hackers!When Wi-Fi was first developed and popularized in the late '90s, security was not a major concern. Unlike wired connections, anyone could simply connect to a Wi-Fi access point (AP) and steal bandwidth, or worse—sniff the traffic.The first attempt at securing these access points was termed Wired Equivalent Privacy, or simply WEP. This encryption method has been around for quite awhile and a number of weaknesses have been discovered. It has been largely replaced by WPA and WPA2.Despite these known weaknesses, there are still a significant number of these legacy APs in use. I was recently (July 2013) working at a major U.S. Department of Defense contractor in Northern Virginia, and in that building, probably a quarter of the wireless APs were still using WEP!Don't Miss:Hunting Down & Cracking WEP Networks with Besside-ngApparently, a number of home users and small businesses bought their APs years ago, have never upgraded, and don't realize or don't care about its lack of security.The flaws in WEP make it susceptible to various statistical cracking techniques. WEP uses RC4 for encryption, and RC4 requires that the initialization vectors (IVs) be random. The implementation of RC4 in WEP repeats that IV about every 6,000 frames. If we can capture enough of the IVs, we can decipher the key!Now, you might be asking yourself, "Why would I want tohack Wi-Fiwhen I have my own Wi-Fi router and access?" The answer is multi-fold.First, if you hack someone else's Wi-Fi router, you can navigate around the web anonymously, or more precisely, with someone else's IP address. Second, once you hack the Wi-Fi router, you can decrypt their traffic and use a sniffing tool likeWiresharkortcpdumpto capture and spy on all of their traffic. Third, if you use torrents to download large files, you can use someone else's bandwidth, rather than your own.Let's take a look at cracking WEP with the best wireless hacking tool available,aircrack-ng! Hacking wireless is one of my personal favorites!Step 1: Open Aircrack-Ng in BackTrackLet's start by firing upBackTrackand make certain that ourwireless adapteris recognized and operational.iwconfigLet's note that our wireless adapter is recognized by BackTrack and is renamed wlan0. Yours may be wlan1 or wlan2.Step 2: Put the Wireless Adapter into Monitor ModeNext, we need to put the wireless adapter into monitor or promiscuous mode. We can do that by typing:airmon-ng start wlan0Note that the interface's name has been changed to mon0 by airmon-ng.Step 3: Start Capturing TrafficWe now need to start capturing traffic. We do this by using the airmon-ng command with the monitoring interface, mon0.airodump-ng mon0As we can see, we are now able to see all the APs and clients within our range!Step 4: Start a Specific Capture on the APAs you can see from the screenshot above, there are several APs with WEP encryption. Let's target the second one from the top with the ESSID of "wonderhowto." Let's copy the BSSID from this AP and begin a capture on that AP.airodump-ng --bssid 00:09:5B:6F:64:1E -c 11 -w WEPcrack mon0This will start capturing packets from the SSID "wonderhowto" on channel 11 and write them to file WEPcrack in the pcap format. This command alone will now allow us to capture packets in order to crack the WEP key, if we are VERY patient.But we're not patient, we want it now! We want to crack this key ASAP, and to do that, we will need to inject packets into the AP.We now need to wait for someone to connect to the AP so that we can get the MAC address from their network card. When we have their MAC address, we can spoof their MAC and inject packets into their AP. As we can see at the bottom of the screenshot, someone has connected to the "wonderhowto" AP. Now we can hasten our attack!Step 5: Inject ARP TrafficTo spoof their MAC and inject packets, we can use theaireplay-ngcommand. We need the BSSID of the AP and the MAC address of the client who connected to the AP. We will be capturing an ARP packet and then replaying that ARP thousands of times in order to generate the IVs that we need to crack WEP.aireplay-ng -3 -b 00::09:58:6F:64:1E -h 44:60:57:c8:58:A0 mon0Now when we inject the ARPs into the AP, we will capture the IVs that are generated in our airodump file WEPcrack.Step 6: Crack the PasswordOnce we have several thousand IVs in our WEPcrack file, all we need to do is run that file against aircrack-ng, such as this:aircrack-ng WEPcrack-01.capIf we have enough IVs, aircrack-ng will display the key on our screen, usually in hexadecimal format. Simply take that hex key and apply it when logging into the remote AP and you have free wireless!Stay Tuned for More Wireless Hacking GuidesKeep coming back for more on Wi-Fi hacking and other hacking techniques. Haven't seen the other Wi-Fi hacking guides yet?Check them out here. If you have questions on any of this, please ask them in the comments below. If it's something unrelated, try asking in theNull Byte forum.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRouter,blurred user, andWiFiimages via ShutterstockRelatedHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow To:Crack Wi-Fi Passwords—For Beginners!How to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow To:Hack into wireless networksHack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Hack a WEP-protected WiFi network with BackTrack 3How To:Use Aircrack-ng to crack a WEP wireless network with no clientsHow to Hack Wi-Fi:DoSing a Wireless AP ContinuouslyHow To:Crack a WEP password with version 4 of the BackTrack Linux distributionHow To:Crack a 64-bit WEP key on a Linux computer with Aircrack-ngHow To:Crack a WEP key with Backtrack 4 and Aircrack-ngHow to Hack Wi-Fi:Capturing WPA Passwords by Targeting Users with a Fluxion AttackHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Hack Wi-Fi Networks with BettercapHow To:Hack into WEP encrypted wireless networksHow To:Crack Wi-Fi Passwords with Your Android Phone and Get Free Internet!How To:Automate Wi-Fi Hacking with Wifite2How To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)How To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterVideo:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Bypass a Local Network Proxy for Free InternetHow To:Fix the Channel -1 Glitch in Airodump on the Latest KernelNews:Advanced Cracking Techniques, Part 1: Custom DictionariesNews:Best Hacking Software