直接搞定WPA和WPA2 无线密码P解工具

wap9898

先看看 搞不定再找楼主

wap9898

假的。。。。。。。。。。。。。。。。。

怡佳

谢谢楼主 分享

speaks

有用吗？用过的说说

cdl_1

不懂用，太贵了！！！

LeeTien

不管好不好，先鄙视下楼主
我不会下的

encle

真的有这么神奇的工具么？这个要学习一下了。

huoyuan

没钱啦。。。

regweb

不是吧  这么贵

sadamu9527

呵呵     ，妈的全是EN

sadamu9527

能不能有用啊。呵呵

ghc00259

coWPAtty for Windows MAIN:
6 o! G' M) M+ n; ]3 o6 r* d- G. a$ H. W
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
+ z3 H0 G$ q( B  B% T% W. l( C, v& T. o3 E0 [) J8 m. k8 r1 [1 Y/ _

$ `2 q3 n& z0 i! A" _8 R8 ]3 tProject Homepage: http://www.willhackforsushi.com/Cowpatty.html
% G+ E% D+ l$ Y& R
, X- e. n/ R9 o) Y/ F
4 z4 ^+ c9 b5 v  F, G" N
0 l# y( z0 X$ U+ C/ S. y1 A
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
4 I9 d5 ]- ~$ H$ ?
8 a7 }9 ^6 N% q1 B: T+ f
8 E$ l4 M& W  f1 E! B- }' e/ g; r! ]6 V6 [: u2 Q  M! G& L6 F

coWPAtty Dictionary Attack

. R* A6 M" x9 D. n1 }: v) |+ G4 z6 y9 O
' F8 `4 @: ^& _5 g, q) Z
Precomputing WPA PMK to crack WPA PSK
+ q7 v- \$ a' o* z* F2 v0 c4 h
8 L  @* c$ r1 y  V

coWPAtty Precomputed WPA Attack


% J) X! y  l& D! P+ o' q9 ~% P* C, r0 |2 h4 X+ S9 A
coWPAtty Recomputed WPA2 Attack


6 f  f4 o/ w( x4 P/ q% q2 P; M. S0 k( b3 O- G% L( _6 }2 V+ L% V2 M8 I7 v, s* z
coWPAtty Tables

# l& g# q9 t4 ^. Q9 g3 t- f3 n  J  Z6 w0 w* B6 l! i: K
# p6 L3 @) m2 ]+ N/ a  D* @6 vcoWPAtty Usage:
' m0 x' b% K1 ~$ f5 i% u! P/ i* _1 j; a3 c
+ f- }  L1 v! v3 t) z% k- i/ d& D ( z+ A& s, x0 t( m- d- R
/ J& `) x" t1 z% jcoWPAtty Dictionary Attack:: u, g: R' Q( j- T5 Y  i1 O1 g2 T
9 F! T- i5 P5 ^- `
, n2 f, Z1 |; R' u; ]6 H9 G, Y' EToperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

. {  |5 M: k/ ]( S2 I3 h0 x/ j. y2 Z' {% b

- R) h% Q! ]. v0 V/ D; zIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

7 \  |' e: ~7 \( Z% p$ u/ x& L0 O1 M  v6 V* g9 j, e3 Y% k* k
( A! Z! `: h) C& C" v1 t5 F
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys
# f! Q4 E4 w7 H* X$ K$ Y
" v3 i/ {7 P0 q* T0 B
5 U6 f) y' N! }3 L2 E0 d
& ^! c; \8 K4 r, x. R+ H  R9 x  t3 n3 s' e1 r, b% J% I  _
8 j" O. D0 F( w3 }$ p/ r" Q" o# n( r# M: {
" L6 F+ }' F0 v: Q6 y

; G  B. e: W& O  ZAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).


( O8 L- W: l' ]$ W' U& Y: @; x* X/ J; M
wpapsk-linksys.dump is the capture containing the four-way handshake
. ^! P. J" X6 L* ~, p
0 N. I5 h9 e" V/ f  T
/ P$ ?% V5 f% m) R7 ?- r7 L
5 }, W# E% y9 h& G8 D8 Edict is the password file

# v0 b! R6 O9 e  f0 @, ~) W: L! d6 I& f' h5 w9 K. g) ?

' d- o; |& h- ^1 ?- ]  f* Llinksys is the network SSID


$ u/ y, T) _% _: H0 M  z; l9 Z# h' V& W2 D; {# f7 H  Z. m% @4 y6 r- `( c* R* e( I
Precomputing WPA PMK to crack WPA PSK:
. h3 k  o2 R; r9 U5 q. ^% z1 ^) f3 h/ M: {" Q
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.


1 `; D4 W* C6 ~+ X# o5 Y  I0 x* \4 |1 f! b3 g! F) ?& X# n2 M  _
6 x" E' h% h0 L7 X3 s
So to generate some hash files for a network using the SSID cuckoo we use:
4 [9 S- v7 c1 N+ v
. {2 I  j' Q0 Z6 e, W; l' Y

' N; G/ E' n" p: I8 t; J: I( l% B6 C
genpmk  -f  dict  -d linksys.hashfile  -s linksys  

8 M4 z7 x0 S( b3 I- F. P# |( F

- ?2 i8 E  ]3 Y. R4 Q0 N3 |6 ?0 Z
/ r: s& ?6 A: v; A: H* `$ h( g
7 @# }+ ^$ F* z4 X4 `$ L5 K# p
! D& S( `6 ?4 i1 M1 w3 s7 w
5 m" k/ ?7 H) f& S
1 F( c$ E, W  ?* s6 Y
3 r$ ^( a3 }2 f. \, I6 Cdict is the password file
- o8 O! Q! |; x; X5 _) B% t* R
- z. z9 N# H! D( i  W; f1 v! Q. v1 \4 H/ j# W% ^1 y) G
% h0 e7 e. e2 A
: u' n$ R, }/ U8 _; e+ ~  Jlinksys.hashfile is our output file
6 G/ g8 e' @) e3 b: D3 c6 ^- n
9 C1 `0 I$ m; E; |

linksys is the network ESSID

8 g, L5 b% l& |( D! o, r4 D" s0 B
' W( H" l) T/ j: f  \  w6 Z1 s6 v6 {7 b0 b5 H' {* S; ^4 B
, s3 Z% U3 k0 P& }# u3 S( P8 a% S% `0 r5 r( XcoWPAtty Precomputed WPA Attack:# ?/ x) d2 _& C+ W/ i

5 ?) F; e! H: BNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
2 G! X8 Z, R; c) O
3 m" r/ l3 a2 G; @+ I# A1 Q
0 K; o" p/ Z+ I5 u+ @! H
( u# k" X5 d+ z! n# s
% f% w9 a" ~) F' @2 \* K) c9 _cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
- ^0 G" h% f, W- e% u* ]3 Y
) @8 g- H6 v% T$ I' E, p4 h1 Q5 p) ^+ {# d  \& b( s, m, N
" o! o) ?, V& s9 F) f+ T* j

' o) {& F( }; I0 l( s
; X+ h" Z7 r6 e5 P# Y& R1 V1 X  u4 A# O

$ d$ L5 y; O9 M' h# }( e$ }9 ?( M' |! ]9 l
wpa-test-01.cap is the capture containing the four-way handshake
3 @% N$ u' R# B0 I$ l  @5 h
. {  e2 R  w8 A3 n% x7 S% K

linksys.hashfile are our precomputed hashes

$ ]* t7 u1 k# u* n+ w
; z' q: ^5 d4 Y7 I$ X4 w3 Q' [, V; e- M" y* t# g+ i
linksys is the network ESSID

+ H! o  [1 |3 a8 E8 y0 l& e

! g4 ~8 f  m% V! D# c# w) ?( }2 j( u# n9 x
Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

" k& a: p/ u. L4 |* C0 e
, w* F( M5 e: L: X. D1 z4 O: }- l$ l- F$ O* _$ C3 _
( d; t$ i: c& I, l7 c8 bcoWPAtty Precomputed WPA2 Attack:
0 P$ y5 O0 Z3 d
$ j3 y, b" Z; L8 i% VcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

5 [- \7 t, }1 ]- W9 m7 }. Z' Q! B1 S

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys


8 p0 D  i; x) B% t2 |6 c; G* X9 x' b# N3 J$ o* S

% [% c' j! `* u9 i( u
, j% e: w8 H! c& ?- F, Y# h: S0 |6 {$ p$ h6 _3 }8 ?/ U4 W
% g6 _# a! f  X( K1 ?
% J6 U# K% X0 u, b2 C
& y# D5 O# z+ X% ^3 B! t; t) F5 owpa2psk-linksys.dump is the capture containing the four-way handshake

6 O8 l6 N, C/ w, B5 E7 f8 R
$ B& u! O: J/ @3 a: _
; r+ [& z2 m  l! w5 j3 D& _0 Sdict is the password file

6 E% `/ y: Y# I2 b
! E% D# d  J3 ]/ Y
linksys is the network SSID

! Z" q+ |1 |  W0 _+ S! m& n4 m! a6 a# |; u8 }
9 x, X8 Y0 l' W7 H  _! m, M' b9 {9 @, A8 {
7 ]+ @' c! `/ @4 IcoWPAtty Tables:
2 I; ], f: ~. u& `4 t, P8 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
% P9 m% {0 @- p9 M# V% b+ u  ~( W) a2 a, \1 J8 N  b9 v  e! c+ W0 y6 }0 e. M7 k* j
& b$ N) ~/ X1 o- Ghttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
6 e9 e& J+ g' m7 |9 I( _+ F4 M3 K9 d5 d
6 K$ G( h- F& z3 ~  w, u4 l% Y- E. {3 Z5 w9 B$ PA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/1 P" V6 G( J9 W
6 J3 t- q, E; ^0 A0 Z
Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/. J% }2 r' B; I6 C+ ~; `