直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
: \& U' g% x: m, C5 `: |
# ]. {8 p2 R! _5 _% C1 ["coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# \! d% R7 t1 L' K5 L2 `5 c# C7 }/ h9 R: N0 H

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html
0 N7 E; w2 M3 O; V' Q- O5 v6 h
! r, }3 s8 L' P$ [7 d7 b& }6 g1 R. m0 r  P

5 M! Q5 L" e$ I. P5 F, i# @- u* B% {2 _1 v2 r- t
: [9 |1 ]0 ]. R( zLocal Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
2 L" D, B3 C# d$ ~" o+ F- ]
3 m0 q; p9 D$ f& P
) J3 A3 [# a9 b: V& I( A' I! E( W. S# W
$ X2 k1 Y+ e6 u( j( j$ U! w( d) a, G4 S7 _* s
coWPAtty Dictionary Attack


: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK

* \% c' F' L( i( d  h" G  C8 R: t+ f7 `' ^& R

; ~, B6 P( L4 Q) x7 McoWPAtty Precomputed WPA Attack
  ?3 |/ B) K8 R* i5 q3 O* d

( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack
. G" I. ^* V" ]( g* y: W
- S2 \2 h9 u0 `" G* y" D! w, `& @4 u) u( ~7 K/ u5 U# ]7 x3 u+ q" i
: s& G* ^& Q+ y, i
coWPAtty Tables

: X/ ]3 g! I7 U
( s8 W- D6 ^1 ~/ LcoWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?
$ W' _  {) q, {9 ]5 C
7 K9 Q+ q' S; d& s% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) u) I5 n& `4 y* l" A
+ ]) m4 j+ N3 @6 ?. X6 [7 T. TToperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
$ g1 m7 k, |3 A. j/ W$ ^
+ t0 _1 z  z; a% \: g2 S7 }" F6 I% c9 w) l
: `2 ?. c' L/ {7 y$ P
In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
$ F3 N/ P; k9 T

  ~  t6 Z, s, E# j( N% ?, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
  I# z# q' H, ~! hcowpatty -f dict -r wpapsk-linksys.dump  -s linksys
! s4 }, u7 L( D" s; \) H
7 B( G5 c6 e& p+ ?' w  a( d$ o' `
2 F) O! B5 g" H* E; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
4 P- \! q  v- O" s, I
/ D- z) {' J% B3 X, \8 r8 x; G9 ^" ^

8 t) M# U6 J* s5 e. t5 G1 I' T7 vAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
4 s" i. Q$ b' p9 F- s3 X" Q
2 n, X4 H) x8 ~) u
/ C4 D1 q0 _# a! ~7 u# k7 D7 k. d; P( J: j. a% W, @
- C+ t, ?0 t8 l& k, Rwpapsk-linksys.dump is the capture containing the four-way handshake
5 A, O2 h! V4 a9 @) y. g1 _
$ |& F: v7 z# X; c0 D5 k7 P% [7 V0 ^4 o+ P1 }6 ^
7 Z2 R: G0 \0 q1 C
dict is the password file


2 c* T* |4 J% \9 c: Z6 p# b( ?3 m3 `# m* \* z0 V
5 P, N( m9 V5 J' S2 w' K+ Ylinksys is the network SSID
3 G$ w# _# e$ |) p9 }; `8 P

1 E8 t, {5 ?6 ?; b$ B1 ?# B' d4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
9 M. w. S& c1 K  @; wgenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

. G& [- D* j7 O  }% n. }  T: W1 V
2 H3 q3 s8 r! W0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
( {3 q6 o7 g% ?8 M' {
So to generate some hash files for a network using the SSID cuckoo we use:

7 i8 A- b+ y) J9 ]$ U( u" O
* S% [0 S# E& c- [5 j& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g
. f. i- C) P# f* k5 w
: l* `9 @! c! R" h% ~+ @, rgenpmk  -f  dict  -d linksys.hashfile  -s linksys  

3 r( c% ?) b6 C# R0 X
' e2 E" d( ^/ E* S* W0 O- Y0 _' _* `; ^% _4 z) N, S/ N* t
- J% }& v3 `- z7 e5 G% z1 e8 e7 J

9 t+ E. h$ l/ C) j

& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

  |1 B; ~, D% S8 p( j% ]% Cdict is the password file
& _) U, C( _9 I" m% X7 [
# t3 Q, C6 K4 E: N0 q8 ]
: j4 A! [3 R$ _9 s9 T& F" C9 X! z. V% l
linksys.hashfile is our output file
4 _* r* k) A( ?6 B. i  l7 @% W" W

/ z/ W* m! M6 N6 b$ b" K/ |! O2 U6 w8 H, h$ t) S0 p: o
  Q: M/ B# \! x8 M# @% M# Vlinksys is the network ESSID
7 ]5 ?5 _/ A/ s0 |$ Z5 e
) B; [2 P  k0 \/ ]' V/ B# E# k+ t' ^9 C
9 O6 O: S; z/ {" v/ P
- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
- G6 x1 l6 Q0 L3 p2 f7 @6 B6 w+ C" Q8 [/ o# h- o% ^4 R
+ p6 H4 n1 Y" J: Z& j. dNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

8 D4 v# B1 I  m7 m
( c8 W, U8 h' j; e) R# Q8 ?- t
$ \! N& R! h+ U+ G1 R( F( K- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


4 n7 m6 J3 I, c  w' Q2 s+ Y$ [6 d0 G" c, ^6 P" c

  ?% T# d0 y/ R1 N; Q

1 ~$ @& O. ]0 M/ u( s( z' u0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P

wpa-test-01.cap is the capture containing the four-way handshake
, H1 }4 S& z' _' i" D

, ?6 D0 }/ I+ k9 q$ _; a
# A8 N7 n+ x& I$ M$ x2 E5 b$ elinksys.hashfile are our precomputed hashes
& p. w& r& l- O% j4 t
3 Q8 s3 y. U4 |. l- j- j  I% D. q
) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID

# F$ r2 M" i' g2 z3 D' ~% Q9 e& m; I6 d
( a0 X( u) O* ?% ~( Y( `) I

, T. \- Q3 `& cNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

0 ^& [& A4 g1 q4 q# O; `. z
/ A. {3 w- G" C- I( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
4 j$ _+ h$ S! CcoWPAtty Precomputed WPA2 Attack:
$ [# x! P- V$ E' z* M# \" I
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
+ w1 {& @% g2 V( R8 B0 Y, C

9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

# M) p" b2 F% N" ^+ _- b6 t5 x( @# x7 }
* i4 G4 d6 g+ j# |9 n2 O


/ K/ w* `$ R# \  T  g: r- r
) Z( g3 M0 N( X8 T( k& G/ j! o# B* A4 N5 X; D
( e) x6 a  c" K) o0 `) i3 Z
  o( @) }; {9 l/ Q: ywpa2psk-linksys.dump is the capture containing the four-way handshake
" ?' a) {9 f' Z: G. v+ D
+ J( H4 j: }4 N! W- b& E+ [
. X( _8 v3 U, B+ i" p
8 \6 a$ B; W6 l- ^dict is the password file

. v( p0 P- s& ?. R3 V1 k! [# B0 b
) ]. y$ X: H% I
linksys is the network SSID
8 B5 j" s: @; Z9 M
! w5 k3 Z$ K- V1 ~! g& _
1 {* ~! d" a* ?  B4 `
' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
  z% X+ y) H. e! l& Z; {" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
4 z8 R! b4 S3 }( w* C$ shttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z

# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H

% h. d0 M6 m) j) x& j1 Y9 L6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
( d' C( M* \0 A$ a/ E6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊