直接搞定WPA和WPA2 无线密码P解工具

sk_feder

很怀疑，wpa这么容易搞定么？

syisgg

知识是无价的。

syisgg

全是E文看不懂

wt3636

胃口也太大了。。。。。。

gongbing118

真的这么牛??看看先!

gongbing118

上当了,为什么还要登录密码!!

zhousx

收费太贵吧

smilebomb

0 {: w% j3 _8 Y- [$ y5 X本人最讨厌这种人
5 W0 j0 B0 U6 e& Q0 I# U# s" e

coWPAtty for Windows MAIN:
0 ^% A6 k9 V2 @7 `

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol."
! H5 T, ^5 p& V5 W, e) y- Joshua Wright.
1 p) v& V/ W# ]4 H9 W! N. @4 P6 l
! p& g, [; f% N: O8 h

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

  R4 J: `& r* s# B( H7 s
& k# V6 E2 n* E; C+ `* ]5 w, ?5 X
% @0 d6 I# F' F+ }Local Mirror: Cowpatty-4.0-win32.zip
* j; q$ \6 @( @2 AMD5: aa9ead2aacfcc493da3684351425d4c6

' k7 d% }: x( s3 F$ J2 H7 h% ?+ I" m+ k; P  g* r1 A! |0 k% Q
/ O4 ^1 {. s+ M! i; PcoWPAtty Dictionary Attack

3 q- f; E! E4 N$ C( w  g; R
6 }8 H1 O8 r" ?# fPrecomputing WPA PMK to crack WPA PSK

+ t6 t; S5 }$ y1 K% ]
coWPAtty Precomputed WPA Attack

" H/ A3 _) S. g! ~: _0 i: U+ L7 AcoWPAtty Recomputed WPA2 Attack

+ H+ d* V- T3 \
coWPAtty Tables

  w$ ?7 R5 x2 E! x! U
; I. Z0 j, c5 ^$ {8 u' pcoWPAtty Usage:6 ~$

coWPAtty Dictionary Attack:
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

! ~" V+ t5 q6 z1 S* F, c' D3 t( M+ N" m
+ e7 }! a5 {) s
/ e" U0 T" m# [+ y

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

0 d4 E6 I  Y, L7 |% n5 j6 Y3 w8 Q
; g5 W: x+ b$ f- ]" Cwpapsk-linksys.dumpis the capture containing the four-way handshake

dict is the password file

3 R  X1 @6 D- L8 ylinksys is the network SSID

1 n$ x1 }9 R, J! C
# A( ~* n& i; ~9 n; N- x* uPrecomputing WPA PMK to crack WPA PSK:
8 G4 C- {4 U& \- v8 _: Hgenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

5 e/ o) B5 k8 \6 ~6 {% T3 YSo to generate some hash files for a network using the SSID cuckoo we use:

7 @) @# C* G* b6 c6 L  X3 w) i4 ?
2 Q- n* U0 t1 d0 i3 w+ C" Y
genpmk  -f  dict  -d linksys.hashfile  -s linksys

% o% I! g! a! G. Z! Y9 V3 e0 X: @) {+ t' r8 @0 T
' f; q: }5 t2 _: T" A( U6 T: P' K$ O5 n) ]! h9 T
- F/ [- D5 s/ y  o  F; c

; C; G( j  _* H* g
2 B( Z6 d5 C# @8 z9 |

dict is the password file

' E, R7 R  i- f$ i' W$ S7 Y& e! X
# S5 z+ ^% S6 f0 I2 Mlinksys.hashfile is our output file

( E7 _$ F' x( g) W! a; `" o
$ e" p. K* y9 w4 tlinksysis the network ESSID

" a8 |9 k; }" i8 m9 ?0 O# w1 w2 q0 s: @* O5 C4 N( D
coWPAtty Precomputed WPA Attack:- z5 |# j1 r  d
( y+ l$ S& i/ ~6 P, n0 s, C( R, QNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

3 u1 d; w& R  \; l0 n. N* {# \8 I

; e% ~$ U# P) Gcowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys

( W, L1 N0 G, ^( _/ A$ t

4 c. ]" P' n5 m5 Y( B
+ @4 Z) w( b0 d+ H" u8 s8 f

wpa-test-01.capis the capture containing the four-way handshake

+ }$ u! ?) h4 o* V2 R7 P+ Glinksys.hashfile are our precomputed hashes

: x" E  Y. h; I: ?3 a) x
/ e! g2 Q/ M; plinksys is the network ESSID

) P# o- _0 Y! R$ ^  d& hNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

# \& x* i* B5 t% T$ }3 P
. [3 {& M1 |  |8 u# f+ acoWPAtty Precomputed WPA2 Attack:
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

; V6 e4 g3 h: l' p: Q; f& w+ `cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

4 r/ h/ m+ J( i. C

* \, t. I- J) `8 a* r- ^9 i; i5 e+ Q3 a1 C/ A( l9 [' X8 P8 X) [! B
" V0 C/ c7 p! e1 V$ P& @" I

wpa2psk-linksys.dumpis the capture containing the four-way handshake

dict is the password file

+ w' a6 j# w+ b* Klinksys is the network SSID

# [8 l& Y$ V( f$ ?4 v
: ^; O0 g& X# g$ o5 B* g) x8 g: u2 Q
coWPAtty Tables:" q# T+ c, n. p; [+ W
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

% I- j) ~9 [" H" X0 rhttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19/ p+ G7 n" D4 e8 ]0 E. V
: x7 S$ l6 R, N: `! [
A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/
% \- R* _, O. ?9 Y
1 e2 d" E+ @( f; p$ p+ UOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/

can0839

我看什么好看的  我自己挂字典算还行

momokill

路过支持。。

cbc19800207

ddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd

laughing159

不是買了嗎？
4 h0 Q% F1 f, _8 d看一次 就不能再看？