直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S

; V  {$ {. ]0 H. ~"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
& K3 x" _' X" N1 t5 P6 c8 R5 C
5 ~% }, |' J3 y7 V4 Y( z' yProject Homepage: http://www.willhackforsushi.com/Cowpatty.html
- R* K* V1 C" x0 R- e) B2 D
9 c+ q% q- L* P' a/ X4 Y7 d7 b& }6 g1 R. m0 r  P
! h' K* i* b* {; O" K
, i# @- u* B% {2 _1 v2 r- t
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
+ K$ h1 m5 v: V) P( L
) _. l- A& G) a+ q6 a
  N) t# |" Q( i% Q/ Z  @( A' I! E( W. S# W
$ U! w( d) a, G4 S7 _* s
# w+ f( L% I: f0 q# v9 {+ i0 i7 WcoWPAtty Dictionary Attack
+ E& o& B& i. o/ a  _

: F0 U, w' S6 F/ V& H$ u. }7 ~: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK

  C8 R: t+ f7 `' ^& R
* d2 h. M  v! e* K% F& U+ F' [
$ A' G: I. @: B2 J: u; ?coWPAtty Precomputed WPA Attack

9 S6 \5 D' S6 ~: ?' d5 k+ B
: p+ S: r* ]& D. Z8 ?( q+ }& i, [0 H5 g: ~
6 a0 f: J0 I, X8 e3 ycoWPAtty Recomputed WPA2 Attack

( ~7 K/ u5 U# ]7 x3 u+ q" i
! x( i: O- i0 J5 _5 y  E
coWPAtty Tables
9 B/ T4 x: ~; N. A$ @4 R
: X/ ]3 g! I7 U
coWPAtty Usage:7 b, W( \( k$ \! _
8 P* i8 {( S8 ?9 K7 |3 g6 S1 m+ V: T7 v5 p$ Z6 ?

  p+ X% z3 q7 T% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
' O/ s. d# o" J$ `$ i1 Y; v) V) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

7 }" F6 I% c9 w) l

6 q$ Y3 I' q6 |* i, Z# MIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

; A$ P- A/ j' X2 y6 \
( P( h& Z/ S$ s5 n" g3 F* O, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys
: M' K! o5 a- \: D$ M* Z
' E" c+ R) B8 M9 k4 z- y7 T# r
; s! t7 r7 z2 ]! a: T4 q
+ w" j( S0 ^* k: {+ x! H- D! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
4 P- \! q  v- O" s, I
, \8 r8 x; G9 ^" ^

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
$ K) J. j' w. w# l1 H! J/ x

7 k) p7 b. J; c2 k* u, N, k( h; P( J: j. a% W, @
7 Z. `' S. z1 B1 U, b( P& Rwpapsk-linksys.dump is the capture containing the four-way handshake
6 ]# g- L6 g3 }- \, U9 e/ ?
5 k7 P% [7 V0 ^4 o+ P1 }6 ^

dict is the password file
$ Y3 o  H+ Z2 \1 X7 H8 T0 E

( ?3 m3 `# m* \* z0 V
linksys is the network SSID
$ ], |. E. X. m! P' M6 b

/ J5 W1 N! J4 ~4 h- p, C+ p' ]7 @4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
% a4 t6 [+ {1 @& [) _Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
2 v0 m* u  c, f! E, ?genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

* F" _+ |* h' Y! w6 B
0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |

& c# D9 e9 D$ [; G9 \' g% oSo to generate some hash files for a network using the SSID cuckoo we use:
. j3 b/ m4 n! Z* v

) E1 M' N# k+ v3 s& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

. I0 A, W: `% jgenpmk  -f  dict  -d linksys.hashfile  -s linksys  
4 V4 j5 J& n( l
, N* z" A+ v7 u3 H7 a4 j3 r( c% ?) b6 C# R0 X
: l+ @$ a& H7 Z$ O. J0 _' _* `; ^% _4 z) N, S/ N* t

: r+ E7 |' U7 z/ Y! M

9 x5 C: Z- _$ t8 i
* ^3 {" [# O+ l9 ]" [  O" I& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

/ d# I# i' O" D% V& F2 v+ \9 S# f" Ddict is the password file

5 W0 ~! z0 g# w# z; H( ^; o7 B
9 s9 T& F" C9 X! z. V% l
linksys.hashfile is our output file


2 U6 w8 H, h$ t) S0 p: o
5 g( H5 V0 {( O$ l/ N& Llinksys is the network ESSID
* y$ u. b# R& L. U8 j# k7 b4 R
3 R  z* |! a, ?4 s% A# E# k+ t' ^9 C

3 v: Z/ _: H% i* p6 r7 d- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
$ H/ A0 f) d( Q- P; B& r5 ], M3 a" Q8 [/ o# h- o% ^4 R
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
5 w( K; i, S6 H9 ^
& O9 T$ V1 {' z
2 B  v6 w. }: @; u( c8 W, U8 h' j; e) R# Q8 ?- t
# J" ~5 A: z6 H- o: b. ~9 A- o: q- X2 Y- ?9 u3 c. o
, {% C4 y. o. B# Q" d$ tcowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
  u# g- i4 q6 B: o0 n! A
9 H+ Y8 H$ M8 y6 b# q! b
+ Y$ [6 d0 G" c, ^6 P" c
2 o) q6 _3 ^* T0 }

$ B$ V1 |* I: k' O5 T$ U- ?; E; q
0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P
" a! u* d) L3 G7 q" D" y* l
wpa-test-01.cap is the capture containing the four-way handshake
4 R- x/ E+ B& V9 M

' V' b  Y& H& Y+ z0 _, ?6 D0 }/ I+ k9 q$ _; a
, B" ~. r+ ]  y+ C% ilinksys.hashfile are our precomputed hashes


0 {4 j! H. }) }- r$ ?+ p) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID

- r0 F/ [, b7 x* G2 z3 D' ~% Q9 e& m; I6 d
( a0 X( u) O* ?% ~( Y( `) I

0 T2 y& u8 K  j( }: D* o7 m/ ^Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
$ A6 c; m2 G" D% Q/ o2 n3 V7 m4 g

( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
! y( y% O5 h4 {% acoWPAtty Precomputed WPA2 Attack:
$ [# x! P- V$ E' z* M# \" I
( q( f/ m/ U. x0 D: L" X, BcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
$ n0 u  G% _6 w5 N  L6 i1 G* X
+ a! ^/ R7 k, \  S( y
  C8 c: C& J1 ?7 u2 [2 O3 I9 [. Y: b  U* F  q2 a! I% d
! r. C% Y0 l7 ocowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

0 ~: s' y6 M9 M( o! t" ^+ _- b6 t5 x( @# x7 }




8 G& B% s$ K  k/ a) o9 J/ j! o# B* A4 N5 X; D
# a) `6 {' A9 h( V- f) J$ X7 N( e) x6 a  c" K) o0 `) i3 Z
7 U9 M* b& V* b2 ?" _* ]& C5 S; Dwpa2psk-linksys.dump is the capture containing the four-way handshake
- {% M1 x$ ^8 }7 E7 Q

: Z" E6 M* Z. ?* U" R4 Z2 Z. X( _8 v3 U, B+ i" p
dict is the password file
" V7 j! z( G7 O0 f9 S. m
. v( p0 P- s& ?. R3 V1 k! [# B0 b
: U6 f7 T- `7 Q5 x
linksys is the network SSID

- `. q" F, V3 t7 N! w5 k3 Z$ K- V1 ~! g& _
" M, M7 q3 Z& }! n% d
' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
, S$ o6 r4 P/ ^$ j) ]  c" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z

7 N' i# k' H- n7 b# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
% T- v- F# ^5 w# G0 q( u( A) ^
6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
) @- h6 ]7 e( S6 j' t6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊