NetStumbler.org Forums

Go Back   NetStumbler.org Forums > Software > Unix/Linux
Reload this Page (Aircrack)Yet another WEP cracking tool for Linux
Register Search Today's Posts Mark Forums Read

Closed Thread
Page 7 of 22 « First < 56 7 8917 > Last »
 
LinkBack Thread Tools Display Modes
Old 08-25-2004   #91 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
cool ;-)
sylvain is offline  
Old 08-25-2004   #92 (permalink)
devine
Emergence
 
Join Date: Jul 2004
Location: Paris
Posts: 389
Quote:
Originally Posted by devine
Coming soon I had fun rewriting airodump, Kismet-style
btw, I'm also on #aircrack (irc.freenode.net)
devine is offline  
Old 08-25-2004   #93 (permalink)
topolb
Registered Member
 
Join Date: Jun 2004
Posts: 67
Quote:
Originally Posted by KoreK
Well in theory, you can. Working on it Packet reinjection is quite laborious. Let's see if reality sticks to theory...

PS: b0nk, read the forum rules/FAQ before posting.
Well, you are right. You can insert custom packets if you have the keystream derived from a known plaintext attack without knowking the key.

I saw somewhere a tool that implements this
topolb is offline  
Old 08-25-2004   #94 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by topolb
Well, you are right. You can insert custom packets if you have the keystream derived from a known plaintext attack without knowking the key.

I saw somewhere a tool that implements this
that could be a good idea to implement it ..
sylvain is offline  
Old 08-25-2004   #95 (permalink)
kleptophobiac
Registered Member
 
Join Date: Sep 2002
Posts: 310
Quote:
Originally Posted by topolb
Well, you are right. You can insert custom packets if you have the keystream derived from a known plaintext attack without knowking the key.

I saw somewhere a tool that implements this
Would having a known set of data go over the network be a big help?
kleptophobiac is offline  
Old 08-25-2004   #96 (permalink)
devine
Emergence
 
Join Date: Jul 2004
Location: Paris
Posts: 389
Quote:
Originally Posted by sylvain
Did you release aircrack-1.4 ?
Promises are made to be kept

http://www.cr0.net:8040/code/network/aircrack-1.4.tgz
devine is offline  
Old 08-26-2004   #97 (permalink)
topolb
Registered Member
 
Join Date: Jun 2004
Posts: 67
Quote:
Originally Posted by kleptophobiac
Would having a known set of data go over the network be a big help?
Of course,

In fact you only need a big known (plaintext) packet to be able to create any custom encrypted packet using the same IV and wihout having the key. That is because if you know the plaintext and the cyphertext you can derive the keystream for this specific IV. With this keystream you can encrypt/decrypt anything with this IV.

This way there is no need to crack the key. Only problem is that with one only packet you only can encrypt/decrypt for this IV. For sending packets it is not a problem as the sender is who select the IV. But for decrypting packets you need a known (plaintext) packet for each IV. That's 2^24

It is not so complicated to make this known plain-text. You can for example inject some packet in the wlan from internet (it will be encrypted by the AP), or guess some packet by trafic analysis.
topolb is offline  
Old 08-26-2004   #98 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by devine
cool I ma going to test it right now
sylvain is offline  
Old 08-26-2004   #99 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by topolb
Of course,

In fact you only need a big known (plaintext) packet to be able to create any custom encrypted packet using the same IV and wihout having the key. That is because if you know the plaintext and the cyphertext you can derive the keystream for this specific IV. With this keystream you can encrypt/decrypt anything with this IV.

This way there is no need to crack the key. Only problem is that with one only packet you only can encrypt/decrypt for this IV. For sending packets it is not a problem as the sender is who select the IV. But for decrypting packets you need a known (plaintext) packet for each IV. That's 2^24

It is not so complicated to make this known plain-text. You can for example inject some packet in the wlan from internet (it will be encrypted by the AP), or guess some packet by trafic analysis.

can we imagine if we have a big known (plaintext paquet) to spoof the IP/MAC address of the access point and to build a crafted broadcast ping encrypted packet ? so that clients with respond to it and generate other encrypted packets...
sylvain is offline  
Old 08-26-2004   #100 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by sylvain
cool I ma going to test it right now

why is chopper included in aircrack-1.4 ? how do we have to install it (chopper.sh) and use it ...
you should write an INSTALL file ;-)
sylvain is offline  
Old 08-26-2004   #101 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by sylvain
why is chopper included in aircrack-1.4 ? how do we have to install it (chopper.sh) and use it ...
you should write an INSTALL file ;-)

I found three little bugs in aircrack-1.4
- the displayed SSID is not always good as the length of the SSID can be longer that what aircrack displays..you should use a longer length for the variable.

- it seems that only active networks are shown .. contrary to Kismet, you don't show previous discovered AP which are not active...

- I could not leave airodump in a proper way
sylvain is offline  
Old 08-26-2004   #102 (permalink)
devine
Emergence
 
Join Date: Jul 2004
Location: Paris
Posts: 389
Quote:
Originally Posted by sylvain
Why is chopper included in aircrack-1.4 ?

The SSID can be longer that what aircrack displays

It seems that only active networks are shown

I could not leave airodump in a proper way
* chopper.sh is actually a channel hopper script you can use together with airodump when wardriving.

* The essid is truncated to 20 characters to fit in a 80 column display. Indeed, when the window size is larger the full essid (32 bytes) can be displayed. I've added this in my TODO list.

* After 2mn of inactivity, the discovered APs are hidden; this feature is especially helpful when wardriving. Note that when you exit airodump, it saves the complete list of detected Access Points in CSV format.

* airodump detects when the user presses Ctrl-C and exits gracefully.
devine is offline  
Old 08-26-2004   #103 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by devine
* chopper.sh is actually a channel hopper script you can use together with airodump when wardriving.

* The essid is truncated to 20 characters to fit in a 80 column display. Indeed, when the window size is larger the full essid (32 bytes) can be displayed. I've added this in my TODO list.

* After 2mn of inactivity, the discovered APs are hidden; this feature is especially helpful when wardriving. Note that when you exit airodump, it saves the complete list of detected Access Points in CSV format.

* airodump detects when the user presses Ctrl-C and exits gracefully.
Hum I made a Crtl-C and airodump did not exit .. I had to close my terminal window..oterwise when I exited I only had a pcap file created and no csv file...
sylvain is offline  
Old 08-26-2004   #104 (permalink)
devine
Emergence
 
Join Date: Jul 2004
Location: Paris
Posts: 389
Quote:
Originally Posted by sylvain
Hum I made a Crtl-C and airodump did not exit .. I had to close my terminal window..oterwise when I exited I only had a pcap file created and no csv file...
Right, this almost certainly happened because airodump was waiting for a packet in read(), thus not checking the do_exit flag; I'll put back the select() call so as to check do_exit regularly. Thanks for reporting this bug
devine is offline  
Old 08-26-2004   #105 (permalink)
sylvain
Wireless Auditor
 
Join Date: Jun 2004
Location: Paris, France
Posts: 175
Quote:
Originally Posted by sylvain
can we imagine if we have a big known (plaintext paquet) to spoof the IP/MAC address of the access point and to build a crafted broadcast ping encrypted packet ? so that clients with respond to it and generate other encrypted packets...

and what do you think of what I said earlier devine ?
sylvain is offline  
Closed Thread
Page 7 of 22 « First < 56 7 8917 > Last »

« Remote-exploit is down so in your infinite Linux wisdom help me with initrd | Problems with Void11 (From Auditor CD) »

Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



Google
 
Web NetStumbler.org

All times are GMT -7. The time now is 08:10 AM.

Contact Us - NetStumbler.org - NetStumbler.com - Online Backup - Archive - Top

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.0.0 ©2007, Crawlability, Inc.


All messages express the views of the author and are for entertainment purposes only. Netstumbler.org cannot be held responsible for the authenticity of the content or the actions of its members. By using this site and its services, you warrant that you will not post any messages that are discriminating, obscene, hateful, threatening, or otherwise violates any laws and you release Netstumbler.org from any future claims of any kind whatsoever including, but not limited to, addiction and loss of productivity. All forum messages, private messages and any other content are properties of Netstumbler.org. Even if publicly available, personal or copyrighted information are not to be posted without the consent of the owner. Distribution of licensed and copyrighted materials in any way not endorsed by the copyright owner is strictly prohibited. You may not use this site and its resources to spam other sites or individuals or perform any action that violates any law. Items sold or bought in the For Sale forum are sold as is and no warranty or insurance of any kind is provided. Netstumbler.org cannot be held responsible for the outcome of any transactions and no warranty of any kind is provided, either express or implied. Vulgar words are not allowed in the subject lines ; they may be used in the message body in any forum. The Administrator, Super Moderators and Moderators of Netstumbler.org have the right to remove, edit, move or close any thread for any reason and to reveal your identity and other known information in the event of a complaint or legal action arising from any message posted by you.