直接搞定WPA和WPA2 无线密码P解工具

wap9898

先看看 搞不定再找楼主

wap9898

假的。。。。。。。。。。。。。。。。。

怡佳

谢谢楼主 分享

speaks

有用吗？用过的说说

cdl_1

不懂用，太贵了！！！

LeeTien

不管好不好，先鄙视下楼主
我不会下的

encle

真的有这么神奇的工具么？这个要学习一下了。

huoyuan

没钱啦。。。

regweb

不是吧  这么贵

sadamu9527

呵呵     ，妈的全是EN

sadamu9527

能不能有用啊。呵呵

ghc00259

coWPAtty for Windows MAIN:
9 ~6 N) {! Q7 [7 b* d- G. a$ H. W
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
, v& T. o3 E0 [) J8 m. k8 r1 [1 Y/ _
+ }+ B" {# u6 j8 E( p
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

4 I# J- C; q7 v7 X' g' R' K
4 z4 ^+ c9 b5 v  F, G" N
0 l# y( z0 X$ U+ C/ S. y1 A
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
( p$ Y& t" m6 f& K3 _  b8 m
8 |0 w8 V+ j, I1 j
8 E$ l4 M& W  f1 E! B- }' e/ g; r! ]6 V6 [: u2 Q  M! G& L6 F

coWPAtty Dictionary Attack
2 ~+ \$ c3 X( i0 w; v: C9 t
: T5 r+ H4 K% E3 a. x' b/ U6 j+ {: v) |+ G4 z6 y9 O
+ A+ [* a- q" \( V% F; n
% F! W" V8 O4 O$ OPrecomputing WPA PMK to crack WPA PSK
7 n  ?/ A( C7 D7 z1 ?2 v
8 L  @* c$ r1 y  V

coWPAtty Precomputed WPA Attack
0 }4 p1 K/ K% Q$ E) a

, r0 |2 h4 X+ S9 A
coWPAtty Recomputed WPA2 Attack

" K( {- r) x0 d- A: }  h. t& i4 T
1 k" Z3 n* L1 p& Q% w7 Q" [( b3 O- G% L( _6 }2 V+ L% V2 M8 I7 v, s* z
; Z: t7 T, G2 H0 F$ s, J2 ^$ }! p' y) ScoWPAtty Tables

/ d' i' O3 ^$ E  J  Z6 w0 w* B6 l! i: K
2 w7 c6 c' K; C+ R5 N8 k. AcoWPAtty Usage:
! P/ i* _1 j; a3 c
) b5 Y( o9 f) p8 G0 T- R3 t) z% k- i/ d& D ( z+ A& s, x0 t( m- d- R
coWPAtty Dictionary Attack:: u, g: R' Q( j- T5 Y  i1 O1 g2 T

3 D3 ~1 z/ d% a" UToperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

( S2 I3 h0 x/ j. y2 Z' {% b

- k; Z- i3 [2 Y7 z3 TIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

/ x& L0 O1 M  v6 V* g9 j, e3 Y% k* k
: _2 b  W* \0 W" L5 Q
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys


5 U6 f) y' N! }3 L2 E0 d
. C7 ]' C6 w6 Y6 q' L9 x  t3 n3 s' e1 r, b% J% I  _
8 j" O. D0 F( w3 }$ p/ r" Q" o# n( r# M: {
" L6 F+ }' F0 v: Q6 y

7 H( f7 n! _3 gAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

3 @2 R7 X2 d$ Y8 {: C1 c
: @; x* X/ J; M
) S- W; F" E4 W6 p) a) }: [wpapsk-linksys.dump is the capture containing the four-way handshake
# ]1 B7 |9 n" [' A( r
/ P' D4 t9 J( C! p0 N. I5 h9 e" V/ f  T

$ O# n# S* A  F( K. Hdict is the password file
1 ?) E% `6 ]* T- H, a5 E/ F
/ p+ F3 r3 M) U/ G5 L8 S, ~) W: L! d6 I& f' h5 w9 K. g) ?
8 v5 b: ?( a6 F5 Q
linksys is the network SSID


' V& W2 D; {# f7 H  Z. m% @4 y6 r- `( c* R* e( I
4 ]. l: I3 ?9 K, nPrecomputing WPA PMK to crack WPA PSK:
. t. ?( s% w6 J/ Y2 R* R7 k. ^% z1 ^) f3 h/ M: {" Q
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.


+ X# o5 Y  I0 x* \4 |1 f! b3 g! F) ?& X# n2 M  _

5 s; B/ {: w/ t, {0 ^; r( }So to generate some hash files for a network using the SSID cuckoo we use:
' S4 w, ~/ l# Q# b
. {2 I  j' Q0 Z6 e, W; l' Y

4 A5 z; V8 k! C2 v9 Y8 t; J: I( l% B6 C
genpmk  -f  dict  -d linksys.hashfile  -s linksys  
  d. B( y5 s5 c: `, _4 A
8 M4 z7 x0 S( b3 I- F. P# |( F

- ?2 i8 E  ]3 Y. R4 Q0 N3 |6 ?0 Z



5 m" k/ ?7 H) f& S
1 F( c$ E, W  ?* s6 Y
dict is the password file

! B' `- g7 p: ]# O! A( W) ]& L7 e1 v! Q. v1 \4 H/ j# W% ^1 y) G

linksys.hashfile is our output file

0 V1 z- n1 f3 j9 C1 `0 I$ m; E; |
( Q0 B5 d, g: h/ s2 i* e3 L
2 ?# C$ P$ p5 U* mlinksys is the network ESSID


9 z' t; ~' r8 j+ F( \* Z- v5 L6 v6 {7 b0 b5 H' {* S; ^4 B
+ [( H6 P9 S4 m+ r( P8 a% S% `0 r5 r( XcoWPAtty Precomputed WPA Attack:# ?/ x) d2 _& C+ W/ i

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
. X& M4 c& v% K) v
+ G! k4 C  L$ M" R' V  W, h3 f3 m" r/ l3 a2 G; @+ I# A1 Q
" M" X/ b  k' h% h8 o. @; e0 K; o" p/ Z+ I5 u+ @! H
  D& @' X" ^8 L6 n
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

# F1 W3 T$ W/ \$ n+ m+ {# d  \& b( s, m, N
# K4 e: A8 |$ K! H5 i0 r+ ]( l2 _" a


3 e+ y" W: `  Y& R1 V1 X  u4 A# O

; P9 }% s. O1 R2 }. J# }( e$ }9 ?( M' |! ]9 l
wpa-test-01.cap is the capture containing the four-way handshake
7 ~3 A' z" k' M4 r3 n5 Z
. [1 q5 X6 x5 V* q, F" W. {  e2 R  w8 A3 n% x7 S% K
" s2 a" a( Q, F+ S
. l7 w4 @& f) I# u6 slinksys.hashfile are our precomputed hashes
% F! w5 x- d& s5 S1 x8 T& }

* [5 P) D% I! I2 g5 w1 [; e- M" y* t# g+ i
7 x) R& p/ @+ S+ A% u# c! [+ ?! dlinksys is the network ESSID
' ~$ I! p1 z3 P. m) ?3 ^6 t5 P
0 |2 ~4 z2 O: C! r# i/ O- y! l+ H! o  [1 |3 a8 E8 y0 l& e
) x) u: P# o* y/ X2 X" I
, @4 A6 X8 e$ y3 \& Y- N$ k# w) ?( }2 j( u# n9 x
Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

" k& a: p/ u. L4 |* C0 e
1 z4 O: }- l$ l- F$ O* _$ C3 _
: g( C: u2 J+ kcoWPAtty Precomputed WPA2 Attack:
: W6 l! L0 B* s; Y* V) g0 P$ y5 O0 Z3 d
9 N! ?2 t2 F# n' q5 gcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
* i, T% J) o# \! a
- W9 m7 }. Z' Q! B1 S
# x$ ~& l) |% M+ s6 z; B
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys


, `6 R3 e2 i& a6 ]0 d; G* X9 x' b# N3 J$ o* S


6 M( F- t# T* e( K, y# h: S0 |6 {$ p$ h6 _3 }8 ?/ U4 W
% g6 _# a! f  X( K1 ?
$ S/ ?+ K0 n' `2 d. G! I( S! v
wpa2psk-linksys.dump is the capture containing the four-way handshake

0 G0 t" @- D- U, F6 O8 l6 N, C/ w, B5 E7 f8 R

dict is the password file

6 E% `/ y: Y# I2 b

3 h" U6 y( K3 ~$ W3 F* I, Llinksys is the network SSID
& H# W7 C# E$ j7 d
+ S! m& n4 m! a6 a# |; u8 }
  _! m, M' b9 {9 @, A8 {
; o' I5 X7 n9 D! M) R9 kcoWPAtty Tables:
2 I; ], f: ~. u& `4 t, P8 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
3 q- I0 G* U) f3 S9 |, U+ u  ~( W) a2 a, \1 J8 N  b9 v  e! c+ W0 y6 }0 e. M7 k* j
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
0 Y; L+ ?! C: p7 {( _+ F4 M3 K9 d5 d
7 H* ]) g: T$ i3 t1 h% c4 Z' z8 O4 l% Y- E. {3 Z5 w9 B$ PA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/1 P" V6 G( J9 W
6 J3 t- q, E; ^0 A0 Z
, Z/ g* `' {) M( V4 B+ WOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/. J% }2 r' B; I6 C+ ~; `