Easside-ng

Easside-ng is an auto-magic tool which allows you to communicate via an WEP-encrypted access point (AP) without knowing the WEP key. It first identifies a network, then proceeds to associate with it, obtain PRGA (pseudo random generation algorithm) xor data, determine the network IP scheme and then setup a TAP interface so that you can communicate with the AP without requiring the WEP key. All this is done without your intervention.

There are two primary papers “The Fragmentation Attack in Practice” by Andrea Bittau and “The Final Nail in WEP's Coffin” by Andrea Bittau, Mark Handley and Josua Lockey which are of interest. See the the links page for these papers and more. The papers referenced provide excellent background information if you would like to understand the underlying methodologies. The concepts for the fragment attack currently incorporated in aircrack-ng came from these papers.

In order to access the wireless network without knowing the WEP key is done by having the AP itself decrypt the packets. This is achieved having a “buddy” process running on a server accessible on the Internet. This “buddy” server echoes back the decrypted packets to the system running easside-ng. This imposes a number of critical requirements for easside-ng to work:

The target access point must be able to communicate with the Internet.
A “buddy” server must exist on the Internet without firewalling of the port used by easside-ng. The default is TCP and UDP port 6969.
The system running easside-ng must have access to the Internet and be able to communicate with the “buddy” server.
There are two overall phases:

Establish basic connectivity between easside-ng, buddy server and the access point.
Communication with the WIFI network.