直接搞定WPA和WPA2 无线密码P解工具

chinajack

coWPAtty for Windows MAIN:
9 W7 W" J" x7 G( x) G0 y# [

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
+ J# s  V) L$ L8 k% X, s

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

0 o- F" E8 J0 K! D1 N

Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

' [! \, d) C! Q# n8 }

coWPAtty Dictionary Attack

6 @0 R/ P8 U0 J, X3 o) ~$ h8 d& e

Precomputing WPA PMK to crack WPA PSK

coWPAtty Precomputed WPA Attack

( U. l/ S! F6 p( v, n

coWPAtty Recomputed WPA2 Attack

coWPAtty Tables

coWPAtty Usage:
/ B# v* c! }. ?) X! u

) c5 V, }0 J. e* YcoWPAtty Dictionary Attack:

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

% U: ]& I% v  R

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

9 V% h: Z- n, \- M) d' f2 o7 O3 p9 |

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

, {2 b# M6 _: M; `9 f/ L5 @

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

- \( m9 i% h6 T5 N

wpapsk-linksys.dump is the capture containing the four-way handshake

dict is the password file

linksys is the network SSID

3 a7 q$ S7 U6 x
  l4 D9 D: \3 Y( C& L5 QPrecomputing WPA PMK to crack WPA PSK:

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

, {  O* L2 S! J$ q$ g

So to generate some hash files for a network using the SSID cuckoo we use:

( n8 G. A0 b, W( f

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

' P* l9 h0 ?' ^, R- i" P3 s+ y

dict is the password file

6 v7 B7 ~0 z8 {

linksys.hashfile is our output file

$ m1 G* Z; k" ~5 N1 v* P3 a

linksys is the network ESSID

: J3 N. ]- J1 y# J
coWPAtty Precomputed WPA Attack:
# i) [) N. ~  I, A* R

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

# [( o' I6 C5 m  z

cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

- u* c4 u" n* C  R  F8 s

wpa-test-01.cap is the capture containing the four-way handshake

linksys.hashfile are our precomputed hashes

3 `! A& f) g, |6 K$ {# L, i9 M

linksys is the network ESSID

& A$ U7 _/ J% g2 ~

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

coWPAtty Precomputed WPA2 Attack:
* C0 O# R; G+ a; Y! g8 |

coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

0 j9 V; y# ]/ n+ p

wpa2psk-linksys.dump is the capture containing the four-way handshake

dict is the password file

linksys is the network SSID

coWPAtty Tables:
' z5 s( i8 v5 v6 I# N2 E; F5 k& rThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

6 o" r) n6 |8 P, [http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19

A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/
0 U; B$ c. I0 j; A+ j8 A8 [  e
Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/

ivwsiqny

上当了？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？

hfbm

这么贵  不买

bo936239

这么贵 。。。。。。。。。。。。。

bo936239

直接搞定WPA和WPA2 无线密码破解工具

bo936239

是不是真的。。。。。。。。。。。

simon310

什么都没说

ljd8112

fytytfytfyufyu

ljd8112

bjhgyugyugvuyg

ljd8112

bjhbuvgcyctrftxrezsrefdxfj

ljd8112

ujbvugiugigohgiuhgiu

ckc1208

劳动成果，应该尊重，付款吧！！