直接搞定WPA和WPA2 无线密码P解工具

chinajack

coWPAtty for Windows MAIN:
1 _+ q' R( w  c+ y3 j1 Y. @

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
. B, K+ v) s- Y7 H) W

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

  E6 q* k* ]3 [5 \9 S

Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

coWPAtty Dictionary Attack

! o( Y" Z8 b, Y

Precomputing WPA PMK to crack WPA PSK

# B# J; m) d8 B# \. V

coWPAtty Precomputed WPA Attack

coWPAtty Recomputed WPA2 Attack

' Q; o0 n, U; ]5 d- |- r3 K! j: H0 I0 Z

coWPAtty Tables

coWPAtty Usage:

$ j" o3 H" o& \( M
& r' R: b8 u% v( e4 kcoWPAtty Dictionary Attack:

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

2 V& f! \0 n- w0 L# y9 D& c

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

8 O5 ?' {) T$ K: L

" s) `) `' K" p* F; H  s8 O7 d
- r. l' m5 {+ R4 t7 P* j

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

) v! I  e3 d9 `0 K! o

wpapsk-linksys.dump is the capture containing the four-way handshake

dict is the password file

& q2 _" x% `+ i4 G$ @0 r

linksys is the network SSID

, G- x! N# F8 u0 G- a) ~! z6 s, H: oPrecomputing WPA PMK to crack WPA PSK:
, T5 U5 a9 U- o8 L7 @0 f

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

! r+ H, f! o. z

So to generate some hash files for a network using the SSID cuckoo we use:

  N9 H6 f! e7 s1 p8 `0 O7 O

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

+ u" j- J; B1 d" s9 B
4 e! v/ s3 D3 q5 g5 G5 q0 _% l

, d& J1 Z/ U) j  Z
& T( ]+ V. E7 o1 `

dict is the password file

linksys.hashfile is our output file

" z  u% L( E5 i3 S3 m

linksys is the network ESSID

coWPAtty Precomputed WPA Attack:

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

2 M% h6 b1 D. \& N' t$ V4 W: C
) X8 t; p5 K/ |$ z3 f8 J( |. O

cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

: B  v# H! [# S& X8 T

7 r. h3 y% n  H
1 G! i5 d1 N+ ?, [( A# J; C

wpa-test-01.cap is the capture containing the four-way handshake

linksys.hashfile are our precomputed hashes

linksys is the network ESSID

+ q8 W6 t/ }3 [) Z8 _9 P& M: E

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

coWPAtty Precomputed WPA2 Attack:

coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

8 A+ Z) Q8 B1 C

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

: i' p8 [" a: _' r

wpa2psk-linksys.dump is the capture containing the four-way handshake

: c% a7 c- w7 v

dict is the password file

) Z. h& {8 M4 G1 E6 ^

linksys is the network SSID

coWPAtty Tables:
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19

& T! o$ Q; \6 b  z% qA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/

. P! T6 ]3 Q4 `! q/ Z) gOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/

ivwsiqny

上当了？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？

hfbm

这么贵  不买

bo936239

这么贵 。。。。。。。。。。。。。

bo936239

直接搞定WPA和WPA2 无线密码破解工具

bo936239

是不是真的。。。。。。。。。。。

simon310

什么都没说

ljd8112

fytytfytfyufyu

ljd8112

bjhgyugyugvuyg

ljd8112

bjhbuvgcyctrftxrezsrefdxfj

ljd8112

ujbvugiugigohgiuhgiu

ckc1208

劳动成果，应该尊重，付款吧！！