直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
' R9 Z+ R0 y! Z' j2 u
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
$ d/ e9 H5 K1 n5 R2 o# C7 }/ h9 R: N0 H
, @' ^* K1 [" c1 j) x
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html
" |" {9 g% o3 ]" V
  t8 Z3 T. f/ P$ z; c  }7 d7 b& }6 g1 R. m0 r  P

, i# @- u* B% {2 _1 v2 r- t
6 M. ]1 K/ N: c$ e# `! ]Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
5 c" Z0 F9 \  g7 W( U" i1 {

( A' I! E( W. S# W
$ U! w( d) a, G4 S7 _* s
! y8 }# d2 @: ?- ocoWPAtty Dictionary Attack


: S$ ~$ T4 `: h& H
6 ~( n2 V5 @7 |+ k" aPrecomputing WPA PMK to crack WPA PSK
/ X" I; Q; C) R: y
  C8 R: t+ f7 `' ^& R

/ x6 x. a* S4 t$ ncoWPAtty Precomputed WPA Attack


( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack

$ G4 X2 u9 w, k% P: U8 t4 j( ~7 K/ u5 U# ]7 x3 u+ q" i
4 y; j  k; L8 u6 M) u2 q4 n# P6 x  N& c
coWPAtty Tables

3 y& Q$ w; w8 E' K: X/ ]3 g! I7 U
1 C/ B5 j/ |3 e3 P6 x/ V/ Y8 K  n' L9 IcoWPAtty Usage:7 b, W( \( k$ \! _
  R$ a% v. ^; x; ~0 D1 m+ V: T7 v5 p$ Z6 ?
" e  w& p" f0 [  O, J- W
% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
8 K3 e8 l6 J3 O* M, {) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
+ E$ C7 a6 v. {4 \! G6 Z2 ^
5 P% x- o  P& E9 ?' x) h' k" l7 }" F6 I% c9 w) l
" [4 N+ B2 ^) [5 v  S4 I
In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.


, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
' g& u# R7 ^) c4 y# n6 [cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

) R1 }% J; t9 h$ H7 X9 D
; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
% `+ ]  L2 y& t4 P- \! q  v- O" s, I
+ o* q: W1 `3 J. {, \8 r8 x; G9 ^" ^

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).


; P( J: j. a% W, @
% `3 x. a1 u+ Ewpapsk-linksys.dump is the capture containing the four-way handshake

  i( D# K, x1 m4 j: P: F* k5 k7 P% [7 V0 ^4 o+ P1 }6 ^
9 v7 U" e, n4 J& X! X9 F' M
+ M0 v( o$ o6 j  E0 Pdict is the password file
+ f) e$ j0 m: J, b' N( z
: f8 l4 Y6 B/ L6 y* |
( ?3 m3 `# m* \* z0 V
0 n! @( ^4 y6 e  qlinksys is the network SSID


6 G- W5 U3 s) ~0 s- C4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
6 H$ h2 |) B1 _( D! B, x9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
4 z2 N/ S0 t* B% [# ]genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

* l! \8 }& t& j/ g3 a1 q* ~
$ m7 R$ M9 ^2 m0 o7 M0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
  z; i( J, ^& h$ O! Q9 y
$ X/ G) d% k8 V$ O( n1 \6 eSo to generate some hash files for a network using the SSID cuckoo we use:


+ J1 E1 Q, R5 x+ @' U% j& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g
# d. ?. ^2 N; ^
genpmk  -f  dict  -d linksys.hashfile  -s linksys  
& |5 l' W' y7 u5 G% B
! V2 m! x, ?& A) x/ S0 V3 r( c% ?) b6 C# R0 X
' z1 t  ~) u8 w5 o1 J7 K' N; ~0 _' _* `; ^% _4 z) N, S/ N* t
+ n3 v4 ~' R0 p  m, O$ G8 v
- z: Y( Z; k+ G! t$ G
7 U" t! B0 n( u; K
# m, m) L0 Z2 A/ C! r, v5 Y5 O
& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

5 v* d5 R1 t8 Ydict is the password file


9 z# y* X- a& r( f8 J+ w3 l9 s9 T& F" C9 X! z. V% l
6 n- G% ^& m% u6 @" g  @1 X; Glinksys.hashfile is our output file


. h5 }! Z; B* K& e3 x' Q2 U6 w8 H, h$ t) S0 p: o
, r* d3 u/ Z# B1 Y, l$ f4 Plinksys is the network ESSID
) @' I: i, Y0 [9 L: }" i
# E# k+ t' ^9 C

- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
# @+ [! u" o: L; u2 KNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

* L% b, G5 @, j* n, g- ]
" q/ E. I2 a/ {$ i( c8 W, U8 h' j; e) R# Q8 ?- t
* O# S  i* |8 N! R0 k- o: q- X2 Y- ?9 u3 c. o
" G" O) G- l& ?cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


! [6 r5 ~" W# Q4 S1 f4 _+ Y$ [6 d0 G" c, ^6 P" c

& H- P: `: {: |
! I$ N- h4 d. k3 s) r
. C6 `6 h* D: T5 ^5 q, h4 H& L4 `0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P
! W0 g( \) Y" _+ o% Y
wpa-test-01.cap is the capture containing the four-way handshake

+ |" D. e8 G4 H  e4 A3 m
$ ~' u) O* ^0 K# \$ `7 u% w, ?6 D0 }/ I+ k9 q$ _; a
3 `& W6 @) p! d$ ]+ O5 dlinksys.hashfile are our precomputed hashes

  U8 P, z2 l) `) s
: X4 A: r0 g( ^8 K) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID
( v9 I1 u' `7 a) V: y3 n$ |$ j
( Y# A+ _# |* G1 I( a2 z3 D' ~% Q9 e& m; I6 d
7 Z1 F- x1 ^" z' |2 }, S( a0 X( u) O* ?% ~( Y( `) I

, E5 W6 H$ c  f% SNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
' X( ]5 q3 F9 l6 M* v6 M
, z# P0 ]% V9 p/ b2 [: l3 K
( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
coWPAtty Precomputed WPA2 Attack:
' \) z3 G! Z: c: n  A$ [# x! P- V$ E' z* M# \" I
% b* W% L: g& y6 m: \6 CcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

1 C( L. I) B5 _# j+ Z8 p
$ d& @2 D) `' a: V9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

4 W! h! z- w& I" ^+ _- b6 t5 x( @# x7 }
9 K. }( k6 U) D/ v/ V0 E

/ [. P/ X+ a& Q% Y! F8 o" `& X3 _
% L6 f5 G7 l/ f3 g- s
  Z7 Y* g- f6 X6 F2 f/ j! o# B* A4 N5 X; D
. }% H, a7 R, \$ j- ~: W( e) x6 a  c" K) o0 `) i3 Z
wpa2psk-linksys.dump is the capture containing the four-way handshake
  f; l2 i$ T9 F0 H$ T) R  J

* }3 w* i; K3 e7 E& h4 c6 b. X( _8 v3 U, B+ i" p
. A# Z$ T1 y4 K' I! s* j( N! \dict is the password file

. v( p0 P- s& ?. R3 V1 k! [# B0 b
! K. o; D% C( ]- B& D
linksys is the network SSID
- y) k- v0 {' D0 a( F
! w5 k3 Z$ K- V1 ~! g& _

% R  S( H% K+ X. t' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
7 _' ^) B5 G( u8 x. Q& i
# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
! ?* r$ w6 U. b: V- l8 d9 D/ W
6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊