直接搞定WPA和WPA2 无线密码P解工具

chinajack

coWPAtty for Windows MAIN:

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
4 P+ ^" K3 n0 Q

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

% ]2 k( q* l: i7 m% f7 w2 r

Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

coWPAtty Dictionary Attack

; d$ x  r) [) V  O) Q! ~' |/ \

Precomputing WPA PMK to crack WPA PSK

4 Q5 u1 M( \0 o

coWPAtty Precomputed WPA Attack

coWPAtty Recomputed WPA2 Attack

coWPAtty Tables

3 M: |! H2 l/ fcoWPAtty Usage:

4 W6 @$ W6 c! Q, s0 A2 @
0 e5 Z/ A& Y0 |' D8 V" b1 ?7 GcoWPAtty Dictionary Attack:
! i  l1 D4 @' s* u6 ?

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

wpapsk-linksys.dump is the capture containing the four-way handshake

& K* J% ]3 Z) A

dict is the password file

' ?( {1 ?( I* v4 ?+ x& K  N

linksys is the network SSID

! X# C( M0 p' r: N$ GPrecomputing WPA PMK to crack WPA PSK:

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

So to generate some hash files for a network using the SSID cuckoo we use:

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

5 _% ~# w3 K( b% f1 C! \9 [" `

dict is the password file

linksys.hashfile is our output file

' e; T, d( s0 t% D& W

linksys is the network ESSID

( n: s1 N7 A9 U# U0 Y. Q7 U7 TcoWPAtty Precomputed WPA Attack:
! b9 n, G0 O' A

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

9 ?1 F- i  @" y9 G; R: G
3 J; l2 c! c6 f$ Z' f

cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

: C5 P! ?" m9 A( r4 ~9 s# N

- q& U. E- M, u9 K) Q+ _

wpa-test-01.cap is the capture containing the four-way handshake

linksys.hashfile are our precomputed hashes

2 W  b4 G' I  _5 d: u4 r: u

linksys is the network ESSID

+ ]: k# a$ S( \' x- ~, w

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

  z6 G$ J; L: H0 G  j5 f2 b6 u
coWPAtty Precomputed WPA2 Attack:

coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

  F$ T6 N3 m# s: T  T2 \! L

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

/ v9 H8 [2 j% [5 l

wpa2psk-linksys.dump is the capture containing the four-way handshake

dict is the password file

linksys is the network SSID

% l! P# U8 m, u0 v' {* Y2 ScoWPAtty Tables:
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

7 g9 c" U% E& I( y1 @http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
& w$ Q, b8 C6 p* J$ r  l8 T  I
. Z- {  W! l. S" b- \# k# KA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/

$ \5 A5 i: X7 N! l" Z, B) lOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
  [% }* v. A+ @7 u* p$ g& l

ivwsiqny

上当了？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？

hfbm

这么贵  不买

bo936239

这么贵 。。。。。。。。。。。。。

bo936239

直接搞定WPA和WPA2 无线密码破解工具

bo936239

是不是真的。。。。。。。。。。。

simon310

什么都没说

ljd8112

fytytfytfyufyu

ljd8112

bjhgyugyugvuyg

ljd8112

bjhbuvgcyctrftxrezsrefdxfj

ljd8112

ujbvugiugigohgiuhgiu

ckc1208

劳动成果，应该尊重，付款吧！！