无线论坛»论坛 › 无线安全 - 有影响力的无线安全论坛 › 无线安全深入攻防 › 直接搞定WPA和WPA2 无线密码P解工具

12 3 4 5 6 7 8 9 10 ... 110 / 110 页下一页

返回列表

查看: 205318|回复: 1312

[分享] 直接搞定WPA和WPA2 无线密码P解工具

[复制链接]

chinajack

191 回帖	8045 积分	37 小时在线时间

中校

注册时间: 2009-7-16

金币: 7816 个

威望: 0 个

荣誉: 0 个

发消息

尚未签到

发表于 2009-8-28 17:55 |显示全部楼层

coWPAtty for Windows MAIN:

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright. ) w2 s C- t. i

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

Local Mirror: Cowpatty-4.0-win32.zip MD5: aa9ead2aacfcc493da3684351425d4c6

coWPAtty Dictionary Attack

Precomputing WPA PMK to crack WPA PSK

coWPAtty Precomputed WPA Attack

coWPAtty Recomputed WPA2 Attack

coWPAtty Tables

coWPAtty Usage:

coWPAtty Dictionary Attack:

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

cowpatty -f dict -r wpapsk-linksys.dump -s linksys

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

wpapsk-linksys.dump is the capture containing the four-way handshake

dict is the password file

linksys is the network SSID

Precomputing WPA PMK to crack WPA PSK:

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks. There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash. This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

So to generate some hash files for a network using the SSID cuckoo we use:

genpmk -f dict -d linksys.hashfile -s linksys

dict is the password file

linksys.hashfile is our output file

linksys is the network ESSID

coWPAtty Precomputed WPA Attack:

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo. Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

cowpatty -d linksys.hashfile -r wpapsk-linksys.dump -s linksys

wpa-test-01.cap is the capture containing the four-way handshake

linksys.hashfile are our precomputed hashes

linksys is the network ESSID

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack. However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

coWPAtty Precomputed WPA2 Attack:

coWPAtty4.0 is also capable of attacking WPA2 captures. Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

cowpatty -d linksys.hashfile -r wpa2psk-linksys.dump -s linksys

wpa2psk-linksys.dump is the capture containing the four-way handshake

dict is the password file

linksys is the network SSID

coWPAtty Tables:
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file. The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19

A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/

Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/

WPA, 解工具, 密码, 无线