直接搞定WPA和WPA2 无线密码P解工具

xj.kk520

你太强了，请给我发一个，谢谢！jiankang.520@163.com

skyli550

有点坑人的嫌疑！！

灵雾山

没有找到介绍。

colinhd8

估计是假的？

happysky

太貴了，我不想买

longya

ALFAjiushile

25213170

5555555555555555555555

25213170

coWPAtty for Windows MAIN:
0 r1 o* N7 Z; H- b$ W' m0 R( K- c( G% ~% ?& [
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright. & \4 h; g. W% d3 v6 M

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html
# p" \. l5 S1 ^9 K
# O/ h5 L2 R; v* l' x; Y8 C
& B+ w: {+ G" P( @. X
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

* W1 j8 W/ I) G% Y4 j( u% u, ~& w1 w4 I5 s0 l
6 Y9 B! t) |- O$ G. s
coWPAtty Dictionary Attack
. R* m2 z/ d/ G7 |, P" a
; x1 u8 m# g) b! d' N! R  R8 l. [  i* r
Precomputing WPA PMK to crack WPA PSK
9 R+ X. ^# p9 n, c4 V0 N" t' b
% ?! ]* B, K0 c2 c; y# N6 X" K4 A
6 e% `; `7 X7 Z7 vcoWPAtty Precomputed WPA Attack

  i% W. i* B+ b/ Z: L% f1 s" c! d0 f: G4 g
coWPAtty Recomputed WPA2 Attack
! H' b& N  W& d* `! z- H" ]8 [9 ]( u* m4 h5 ^

coWPAtty Tables
& k' J9 n/ B! \0 [" L; e3 a
  N& l! e0 W, D0 z+ Q7 KcoWPAtty Usage:
1 `) ]. f% `+ w5 N  e* N$ r  D2 T" b( Y( g
! I" k! ?2 s0 l6 u8 A3 p% g1 K$ r; F" ~" O( L
$ q) O; o8 N0 X* \. r$ G+ H: G: |coWPAtty Dictionary Attack:
( o: Z1 ~4 y% w0 \0 q. _6 e6 f
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
* k6 |( @/ }! Z6 W, u4 l+ O, f+ @6 ~( ?5 y- a9 z

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
! ~6 Y" n: Q% [3 G! s! Z5 h2 R- b- w, d' s% m
/ h% z9 I. E1 X+ V, l* o
- f9 M3 b5 q  `cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

! s, I8 n6 a) w. t2 x( `: {4 D( Z2 B9 M' q& _8 D( W+ ?. |5 r

6 s7 j7 X8 e. }: J( u9 n+ F9 G0 n( B9 @( j8 ]
+ {% x7 I8 G  P  d9 @1 ^1 J7 Y; L8 x( T2 R! W0 p4 Z
0 M6 W7 D3 }! `! C$ e
1 c: E( j& |6 V1 |: H$ U7 t; K7 [1 ^As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
/ Q2 w5 F! ^! p; O& S$ i

wpapsk-linksys.dump is the capture containing the four-way handshake
, ^! }* H4 X; t9 G  M. O5 a- o  |3 Q4 I
2 A8 ~, D4 \: b- i* S; ^
/ |5 K5 y( D5 m& N% Vdict is the password file

- \4 t5 K9 o) _2 e4 P4 e% G8 H# X! Z& D' D$ f
linksys is the network SSID
$ J1 w" V& B% j7 A2 J; _" O
' b( g$ S4 M# t
, B. l8 Z: D( uPrecomputing WPA PMK to crack WPA PSK:, {# Z6 Q  T, s( e) w" c- s" E8 u

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
0 n2 B+ u/ M4 P4 h& l
, D; p- h6 P# D: U# C, F. V0 P0 ]
! U0 z: U8 ?$ m! L5 E
So to generate some hash files for a network using the SSID cuckoo we use:
9 g9 h/ ~- |" B7 p
( v6 J/ _" w3 h3 r, n
0 m% ]2 @" E3 @2 m
8 _0 D  E! H, A6 Q8 I4 dgenpmk  -f  dict  -d linksys.hashfile  -s linksys  
: K: J& J! `) b! C* }3 T# w) L! Z. r' P) k/ \: k+ n
( B2 \* T) \7 B& f+ {4 s+ L, ]2 \! k  b" q$ ~

( d$ z$ j' D# o$ }8 u
+ b5 H% c' z; ]5 P& C7 A0 k% ^$ ]! ~0 X  Z" S
1 t5 v8 y0 ^" y+ W: H1 d4 k. F/ Z. V+ s# e6 u1 u
% G+ L9 i9 D9 m
1 h7 X0 a  x( |- G( A9 }dict is the password file

1 M6 t  y; T9 k& m2 O7 ]3 p
linksys.hashfile is our output file

/ x: k# X, N- E+ C6 D6 s; x' R! q
1 u$ S2 x4 l+ ~  nlinksys is the network ESSID

! w6 b6 z, H( D" A6 u* D# L6 F) T# D) D& ?+ A( j( l; A! T0 K3 t0 K
coWPAtty Precomputed WPA Attack r4 n4 v$ |) [- ]* }/ }3 D
5 L5 @* b8 e, j: k$ U
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
5 e  M2 [9 F- U+ {5 t2 S! x

" m( }9 _8 N6 |
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
1 F# h0 F& L  B2 Q; k, C1 w
' |1 z8 P3 h- X5 O
0 }' `8 u% w) x4 c7 f' j

/ E. I, `: ^! y6 k) W" X* L. Q; C  E" c6 x
4 z5 H. L3 b8 V4 y1 y6 l) H1 ?; W" a% b6 F7 d- K$ F
wpa-test-01.cap is the capture containing the four-way handshake
& }, r1 H; M0 a! X8 ]6 G

, o7 _' K( f2 Rlinksys.hashfile are our precomputed hashes

7 i2 l% D* t7 W4 d5 {& S2 @: ]1 S+ W' b" g: U, @
linksys is the network ESSID

  ~/ K& g* I- B0 r9 c/ F3 ?( E- |2 U" ^' H- P2 ?& F; z  D/ D' B: L" ?/ N4 j. P/ @$ g- J8 m& g

4 i5 n* |  x$ d# W8 \- I# FNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

$ A+ g' \8 Y! p$ D- Y
$ U$ B! m6 u% M' L& I6 m" ?1 I8 M- kcoWPAtty Precomputed WPA2 Attack:
$ M" u7 ?5 o6 F$ _
3 k* p( D$ w! ?6 }6 gcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
1 D0 j, P; f0 i! g: f8 u4 |) ?7 O
9 a2 f: n* r3 l5 z4 T5 |
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys
1 q& m& `; O3 M& u* x! A' u( `


6 U8 }/ L6 Z- H
- A* u6 M# X5 X1 Q
6 c7 {" I( `( w' H8 r/ A* p  F: r7 [" \
1 U7 ^! p8 G& E( S& R1 jwpa2psk-linksys.dump is the capture containing the four-way handshake
3 g- l# S) ~0 @- j1 b: K$ x8 n2 H" m/ I  T

dict is the password file

4 d  L8 t0 Q$ ?7 C* {0 g7 Y/ L. x0 O
% P% P9 k' }6 i* {2 S. u% b; Zlinksys is the network SSID
0 J1 m) \3 D0 o; P+ h0 t
9 T5 i' ?  G/ N# {& z% |5 u4 Q5 m8 [. b7 {9 {
coWPAtty Tables:
- E# r' A7 D7 r/ g2 X% z' s$ O5 _. PThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:& @) N; `' R2 Y- a

4 {; `8 {# I# n$ lhttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-197 e0 b3 o8 O4 D) j2 ^5 C2 s! Y

- l6 K. ^0 z6 e: m# q2 ~A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/7 ^, e/ H) c1 v7 w: \9 I6 x! q/ F: ?
* g9 W0 ?# z5 u
Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
  F7 U- o& V3 l6 J# t  H& p* P; \2 _# m本文地址:http://forum.anywlan.com/thread-37302-1-1.html

superboy1

怎么ME看不见阿...5555....

kira8085

想分享的话，就别搞的这么贵嘛

yz_86665886

上当了........

icxoinfo

fffffffffffffffffffffffffffffffffffffff