直接搞定WPA和WPA2 无线密码P解工具

怡佳

谢谢楼主 分享

speaks

有用吗？用过的说说

cdl_1

不懂用，太贵了！！！

LeeTien

不管好不好，先鄙视下楼主
我不会下的

encle

真的有这么神奇的工具么？这个要学习一下了。

huoyuan

没钱啦。。。

regweb

不是吧  这么贵

sadamu9527

呵呵     ，妈的全是EN

sadamu9527

能不能有用啊。呵呵

ghc00259

coWPAtty for Windows MAIN:
* d- G. a$ H. W
" o3 I/ g7 ^6 B/ n"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
" D# u) w4 Z; s) [5 E, v& T. o3 E0 [) J8 m. k8 r1 [1 Y/ _
/ n: O' \. o$ N/ z! t
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html


, }. D# Y/ V, C2 G9 k& [4 z4 ^+ c9 b5 v  F, G" N
0 l# y( z0 X$ U+ C/ S. y1 A
7 u: w% N7 d2 ]. E& k. ]Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

5 p$ @+ L1 j+ N( v% Q& s
8 E$ l4 M& W  f1 E! B- }' e/ g; r! ]6 V6 [: u2 Q  M! G& L6 F
9 j% D. l# ]: V- y: x& ?# C& ]! I
coWPAtty Dictionary Attack
0 J# V2 a2 g& U- q! g. [7 `3 z, I% {" I
0 w3 s7 r/ e& S4 a" |7 F: v) |+ G4 z6 y9 O
0 P0 E4 ]# i9 W; Y( V1 Z& a5 L
Precomputing WPA PMK to crack WPA PSK
8 H& A) Y2 {* F* k* ?, X& h
8 L  @* c$ r1 y  V
- W- Y% \+ I; x8 K2 W: w# W+ V) y
* B! ^1 A5 g$ D1 E6 j3 P  p' R) {  IcoWPAtty Precomputed WPA Attack


) ~- _' b. P5 }, g9 ^) q1 s, r0 |2 h4 X+ S9 A
coWPAtty Recomputed WPA2 Attack


) I- h3 v& t  z( Z8 |9 B( b3 O- G% L( _6 }2 V+ L% V2 M8 I7 v, s* z
coWPAtty Tables
: Z+ z8 ~' @2 `+ n* K5 Y9 k$ J
  J  Z6 w0 w* B6 l! i: K
coWPAtty Usage:
! P/ i* _1 j; a3 c
3 t) z% k- i/ d& D ( z+ A& s, x0 t( m- d- R
coWPAtty Dictionary Attack:: u, g: R' Q( j- T5 Y  i1 O1 g2 T

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
( f' {5 L) \1 k
( S2 I3 h0 x/ j. y2 Z' {% b

" b; x$ [$ D2 S7 dIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

5 A* D! ]- P- w/ X4 q/ x& L0 O1 M  v6 V* g9 j, e3 Y% k* k
4 ]7 b. |, h. l, F7 U; ]9 o
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

. L- w" t. Q! ?7 d
5 U6 f) y' N! }3 L2 E0 d
' j  G6 H1 ^, E. c: J. d; d) [9 x  t3 n3 s' e1 r, b% J% I  _
8 j" O. D0 F( w3 }$ p/ r" Q" o# n( r# M: {
" L6 F+ }' F0 v: Q6 y
" A. C+ C8 _! u
4 M2 k/ B8 o) _& zAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
8 H# N. P5 F+ p# `% l

) h% K& R3 [, b# t: @; x* X/ J; M
% m. n6 c3 U; `# }: G2 Dwpapsk-linksys.dump is the capture containing the four-way handshake

0 N. I5 h9 e" V/ f  T
0 b/ l4 ~4 \- q: D0 C2 |9 ?2 p
dict is the password file

, ~) W: L! d6 I& f' h5 w9 K. g) ?

linksys is the network SSID

6 ?6 k, b. `$ T* ?- n
' V& W2 D; {# f7 H  Z. m% @4 y6 r- `( c* R* e( I
Precomputing WPA PMK to crack WPA PSK:
. ^% z1 ^) f3 h/ M: {" Q
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.


3 h( J. ]* d3 F- {  F! t! }+ X# o5 Y  I0 x* \4 |1 f! b3 g! F) ?& X# n2 M  _

So to generate some hash files for a network using the SSID cuckoo we use:
7 P9 e0 _6 S4 ^
) i  o& t+ J, w5 l. {2 I  j' Q0 Z6 e, W; l' Y
/ j8 c  j/ k4 i- @& }7 \
$ V, ^) O. E' z4 s$ c) R8 t; J: I( l% B6 C
! x, ^5 b( U6 g* Igenpmk  -f  dict  -d linksys.hashfile  -s linksys  
+ Y* z" X2 R0 w, ]) i
6 z  @2 l5 L8 j2 k0 Y7 h6 R: ~8 M4 z7 x0 S( b3 I- F. P# |( F
: t7 Z6 \- i* F; f, V" o
- ?2 i8 E  ]3 Y. R4 Q0 N3 |6 ?0 Z

* C5 X: Q+ n3 F/ ~( w! ~

5 m" k/ ?7 H) f& S
6 B7 C3 C1 c  E" A& @1 I- q1 F( c$ E, W  ?* s6 Y
/ Z% m: I( t. C5 N* {" Zdict is the password file
. C; V/ P: {8 T8 Y
1 F$ q) k* h% f' ~: ], W1 v! Q. v1 \4 H/ j# W% ^1 y) G
6 _) |  M$ T( x: F0 P
linksys.hashfile is our output file
4 H' T1 @! K4 z
/ G# O. d5 P- ~; P% S# c9 C1 `0 I$ m; E; |

& N- J- R' ]& E$ @8 {0 Wlinksys is the network ESSID
  q0 d7 b6 |$ y. q" N- X

6 v6 {7 b0 b5 H' {* S; ^4 B
) T0 J- ]/ \/ G( P8 a% S% `0 r5 r( XcoWPAtty Precomputed WPA Attack:# ?/ x) d2 _& C+ W/ i

$ b7 _4 q- A) x* P; C. jNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

8 F2 W/ L7 k  }6 T; S% S6 l) K$ w3 m" r/ l3 a2 G; @+ I# A1 Q
$ r/ Y' K1 t0 s; G; @0 K; o" p/ Z+ I5 u+ @! H

  g5 g' D! V1 |7 Q( n/ v$ R, O  Tcowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

+ {# d  \& b( s, m, N
6 F+ \% [/ a) ]- z
$ f7 l: S% ?% z  s# {
7 E  P6 W( {# K
& R1 V1 X  u4 A# O
& [& w( l6 ^( j8 v8 a! L9 D' P
6 [( G" J2 g) {# }( e$ }9 ?( M' |! ]9 l
wpa-test-01.cap is the capture containing the four-way handshake
' z" z) p! F& _7 b1 k; ~' y: K
% _9 V6 {% U: N. {  e2 R  w8 A3 n% x7 S% K

linksys.hashfile are our precomputed hashes
" F; G: z% B, S' P. K* l# w6 \9 w
$ ?5 d( [# _) l, e; ~- I0 W6 q3 N
; e- M" y* t# g+ i
& `, S0 y' U( ~3 T& Clinksys is the network ESSID
, r8 E' K' x# M% Q5 j# g; h$ A
+ H! o  [1 |3 a8 E8 y0 l& e
% l- b  h, }1 _2 k$ m
# w) ?( }2 j( u# n9 x
8 Y" O+ z# v! m: v# I4 ]0 b: eNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

" k& a: p/ u. L4 |* C0 e
1 z4 O: }- l$ l- F$ O* _$ C3 _
coWPAtty Precomputed WPA2 Attack:
& ^) E. @8 ^" D3 R! M6 ~/ ^0 P$ y5 O0 Z3 d
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

; F- i- k* `4 Z- W9 m7 }. Z' Q! B1 S
) w9 X; [: {. W3 N" E
3 n: s/ v0 i. \  Jcowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys


% R1 c9 [# A8 q' K; G* X9 x' b# N3 J$ o* S
' A! X7 f3 F: e

8 N$ l1 I; W/ Y9 D7 t- H! B# h: S0 |6 {$ p$ h6 _3 }8 ?/ U4 W
) ]( q# T* L1 [3 E2 {2 J% g6 _# a! f  X( K1 ?
* s: a4 l2 i9 g% \! q8 t# q( v
wpa2psk-linksys.dump is the capture containing the four-way handshake

  G0 R4 @7 T" ^8 G6 O8 l6 N, C/ w, B5 E7 f8 R
9 I2 j' |  A/ s% H) L" H
: Z$ }1 J; b$ a7 _6 a" ndict is the password file

1 z' T3 |: n! g$ b( p6 E% `/ y: Y# I2 b
! ?: L# p5 g: q! w, x# u% D
linksys is the network SSID
: I  z1 v# m* L
* o7 x2 x7 f" m9 U+ I0 C+ S! m& n4 m! a6 a# |; u8 }
6 u+ P3 A, d7 t% c6 l9 V  _! m, M' b9 {9 @, A8 {
coWPAtty Tables:
2 I; ], f: ~. u& `4 t, P8 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
  A/ G3 a9 {* u* k  \+ u  ~( W) a2 a, \1 J8 N  b9 v  e! c+ W0 y6 }0 e. M7 k* j
. p8 w3 @8 c' R( w0 Ihttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
( _+ F4 M3 K9 d5 d
4 l% Y- E. {3 Z5 w9 B$ PA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/1 P" V6 G( J9 W
6 J3 t- q, E; ^0 A0 Z
Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/. J% }2 r' B; I6 C+ ~; `

ghc00259

5金币就给你一堆英文的，你看懂了吗

bamboossom

这么贵  不买