直接搞定WPA和WPA2 无线密码P解工具

ghc00259

5金币就给你一堆英文的，你看懂了吗

bamboossom

这么贵  不买

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
% G7 ]  u  G1 N8 @/ w4 y+ M4 Y9 t
  A; F1 M+ H- b; ^! K/ R; h, H. T"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H

3 L# \, R6 ?9 q& Y, w; r3 f( |3 O" Y; vProject Homepage: http://www.willhackforsushi.com/Cowpatty.html
% x- ^* e0 c/ g; Y; O; }
7 d7 b& }6 g1 R. m0 r  P
5 \+ v3 t3 j' F0 r
) ^) R- d4 x9 ?( w7 |9 E% R6 Q$ G, i# @- u* B% {2 _1 v2 r- t
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6


: B1 s8 @9 a* o' `( A' I! E( W. S# W
0 K7 Y! [" v8 k/ D. G" D* o! t$ U! w( d) a, G4 S7 _* s
coWPAtty Dictionary Attack


) `$ t# `' \) y& s2 u# i/ }9 S: S$ ~$ T4 `: h& H
, N4 N2 I. Q& w' JPrecomputing WPA PMK to crack WPA PSK
6 ~/ Z) b5 O0 ~' B5 W  }/ z
  C8 R: t+ f7 `' ^& R

coWPAtty Precomputed WPA Attack
. z3 R0 @" i. O4 @, p- ]: e$ y5 d

( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack
( w) c' v1 Z! q: M9 B& N; J9 ]
& R4 e- X2 {, T( B( ~7 K/ u5 U# ]7 x3 u+ q" i
4 T% s* ^1 F8 @1 [7 Y
coWPAtty Tables

. k# R' s( d' s, o  J# }; v2 a: X/ ]3 g! I7 U
, M; A. t7 j# H% i. q) PcoWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?
6 Y. Z, j! S: {* Z. `. ~* O0 m
8 Y7 K. M+ ~: M  G% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
6 `, ~2 G" @5 K( C% C* P
+ R4 c. D, _' ?' B7 C$ `! w- o! Y: q7 }" F6 I% c9 w) l

4 g! {& C( M3 q# l7 DIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
/ d% B9 Y& c$ y( Y! Z+ \
* \, r) H# L" |9 R8 L/ g5 ?- e
7 w6 `) H4 p: E, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
9 d* C7 H& e6 Kcowpatty -f dict -r wpapsk-linksys.dump  -s linksys


; s! t7 r7 z2 ]! a: T4 q
7 T0 F2 `, P' B. T! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
4 P- \! q  v- O" s, I
9 Z8 o7 J7 f5 s" d, b, \8 r8 x; G9 ^" ^
1 ^- a7 e0 u+ b& ?) o7 t
As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).


; P( J: j. a% W, @
* k2 s, v) s3 I; B) e& |$ hwpapsk-linksys.dump is the capture containing the four-way handshake

5 k7 P% [7 V0 ^4 o+ P1 }6 ^

dict is the password file
- `7 _8 D5 h1 J
. @$ ~. Y+ y4 t; o' U
( ?3 m3 `# m* \* z0 V
7 R7 A3 C' y+ `" A! m1 V8 elinksys is the network SSID
& p! K% K) l, O$ A( Q& I

" L( t( P5 j/ l% o) L% _4 D7 E4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
9 Z' [3 D$ J! o4 v. P8 {Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
+ t/ h5 V2 a& s) fgenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

, n3 R/ a' d+ Q% y
6 Q; S, q6 {, F! p' `' _  ?4 u0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
0 ^6 z% M8 V  x+ C2 H& c0 j2 l
" T7 Z# s  q* b1 Q& E1 S+ j' B  OSo to generate some hash files for a network using the SSID cuckoo we use:
; g7 P- {) U: n3 e$ M1 \% J4 }

& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

3 r( c% ?) b6 C# R0 X
0 _' _* `; ^% _4 z) N, S/ N* t



% i/ D2 C! ^$ `1 U# @1 B
4 D( n; l1 M( ]3 L. Z& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

% w+ |. R( ~5 k. ~% kdict is the password file
& S7 j$ p$ _7 u4 U" I( P
, e  D9 m6 `/ ?0 `- [
9 s9 T& F" C9 X! z. V% l
linksys.hashfile is our output file


; j* Q* x( b1 a* N$ A2 U6 w8 H, h$ t) S0 p: o
3 C3 Z2 V3 V% q7 a4 {8 ^4 z( |& O4 [+ i3 olinksys is the network ESSID

# E# k+ t' ^9 C
! E4 c/ ]" U, }% q& R# M
- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
  `- i# @) t$ @6 h' T- m
3 W7 v  P$ k9 p' D. f% D
( c8 W, U8 h' j; e) R# Q8 ?- t
( ~3 ?' \) T+ a+ j- d: g- o: q- X2 Y- ?9 u3 c. o
; ?7 N; `. Y( Q+ l, D9 Bcowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
' ]0 S& D3 h* B; Z% m/ [

+ Y$ [6 d0 G" c, ^6 P" c
; x$ }/ S8 @) ?. B2 B- B

1 }( G) N; n3 L
0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P

wpa-test-01.cap is the capture containing the four-way handshake

1 E3 U3 b. x- [2 }
, ?6 D0 }/ I+ k9 q$ _; a
% V: X0 O- u: E+ R4 {! v7 n3 C( e# G% xlinksys.hashfile are our precomputed hashes
: e! Y4 R2 c& _( e% S! ]3 t
+ l4 G! o6 S8 V. @
) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID
4 X! r# C% u0 ~2 o
8 @2 Z" Q: \, O8 t$ \0 S+ B2 z3 D' ~% Q9 e& m; I6 d
( a0 X( u) O* ?% ~( Y( `) I
. K2 N. v( h" [7 E
/ L* D8 {3 C. F/ kNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

' d) t; T8 X8 o- L5 n# T+ e9 Q1 P
( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
7 h2 y6 o0 j' K6 f9 q) scoWPAtty Precomputed WPA2 Attack:
; w; U9 Z. k( P- m) w$ [# x! P- V$ E' z* M# \" I
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.


, @8 V& l/ A% W. H# o* [$ o9 [. Y: b  U* F  q2 a! I% d
$ A+ l, n% \) Rcowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

" ^+ _- b6 t5 x( @# x7 }

0 s) n9 o! n0 Y5 f& ?


; H' h# @/ |4 F( ?7 }/ j! o# B* A4 N5 X; D
( e) x6 a  c" K) o0 `) i3 Z
$ F7 `( p# B1 f# {9 \: [/ a$ J! iwpa2psk-linksys.dump is the capture containing the four-way handshake

; p+ \" d, |) L% _" O3 Y% E/ E
. X( _8 v3 U, B+ i" p
dict is the password file
4 X0 ]  H* }' x9 T0 l5 j# y' v
7 u! S! O$ n; ]% B& u- \) d. v( p0 P- s& ?. R3 V1 k! [# B0 b

linksys is the network SSID

! w5 k3 Z$ K- V1 ~! g& _

' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
% I8 k! _5 O+ c$ c; [1 W$ {2 RThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
9 Z; c. J4 X% \1 g% t2 c, g! d" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
5 M( R& t% [) Q* l4 |( ^- |5 @http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
+ W& J, y' _& l) ?+ l
# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
0 S" ^7 k) l$ u( ?3 s: x5 y
6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道