Линукс для aircrack ng

Aircrack-ng

User Tools

Site Tools

Table of Contents

Downloads

Current Sources

This tarball contains the latest Linux sources.

SHA1: ffeb4816476e7b329dc0c154f1aa4a30ad171beb
MD5: 22ddc85549b51ed0da0931d01ef215e5

Legacy Sources

This tarball contains the latest legacy Linux sources.

SHA1: b2f671324d056408b83d32eb1ab6061b7fa87ac5
MD5: f37fdb000d8bad77da6a0a43bc2ef67a

Development Sources

You’ll need subversion to get them.
Latest development sources can be found at github.com/aircrack-ng/aircrack-ng.

By typing the following command in a console, you’ll check them out in aircrack-ng directory:

On windows, you can use TortoiseGit to get them.

Windows binaries

This zip file contains binaries and sources for building it on windows.

SHA1: 590d3e8fd09a21b93908d84057959cb13e73d378
MD5: cbcb23c55ed6933a48b8af5665104fb6

SHA1: ede4ac13ad04e9ec10b973460b36c92ce97829af
MD5: 152ae4f50b7f82f510b4ac152ea57eb2

The following files are automatically download when you run airodump-ng for the first time.
If you prefer to download manually peek files:

Linux packages

Most distros provide (an older version of) Aircrack-ng package in their repositories.

We are now providing git and release packages. Instructions to come.

IPK packages (Zaurus)

Aircrack-ng 0.9.1 is available here (MD5: 87b0bad58db12b86e6a3c0fe6b5d0f99 — SHA1: 9a8da015105c2d77fa8e81d085da304c474ce77b).
Older IPK for Sharp Zaurus are also available here.

Источник

Aircrack-ng

User Tools

Site Tools

Table of Contents

Aircrack-ng Newbie Guide for Linux

Idea and initial work: ASPj
Additions by: a number of good souls
Last updated: Nov 21, 2018

This tutorial will give you the basics to get started using the aircrack-ng suite. It is impossible to provide every piece of information you need and cover every scenario. So be prepared to do some homework and research on your own. The Forum and the Wiki have lots of supplementary tutorials and information.

Although it does not cover all the steps from start to finish like this tutorial, the Simple WEP Crack tutorial covers the actual aircrack-ng steps in much more detail.

Setting up Hardware, Installing Aircrack-ng

The first step in getting aircrack-ng working properly on your Linux system is patching and installing the proper driver for your wireless card. Many cards work with multiple drivers, some of which provide the necessary features for using aircrack-ng, and some of which do not.

Needless to say, you need a wireless card which is compatible with the aircrack-ng suite. This is hardware which is fully compatible and can inject packets. A compatible wireless card can be used to crack a wireless access point in under an hour.

To determine to which category your card belongs to, see hardware compatibility page. Read Tutorial: Is My Wireless Card Compatible? if you don’t know where to look in this table. It still does not hurt to read this tutorial to build your knowledge and confirm your card attributes.

First, you need to know which chipset is used in your wireless card and which driver you need for it. You will have determined this using the information in the previous paragraph. The drivers section will tell you which drivers you need.

Aircrack-ng installation

Get the latest copy of aircrack-ng from the homepage, use our packages or use a penetration testing distribution such as Kali Linux or Pentoo where Aircrack-ng is already installed and up to date.

To install aircrack-ng, refer to the documentation on the installation page.

IEEE 802.11 basics

Ok, now everything is ready, time to make a pit stop before the action finally starts and learn something about how wireless networks work.

The following chapter is very important, if something doesn’t work as expected. Knowing what all is about helps you find the problem or helps you at least to describe it so someone else who can help you. This is a little bit scientific and maybe you feel like skipping it. However, a little knowledge is necessary to crack wireless networks and because it is a little more than just typing one command and letting aircrack do the rest.

How a wireless network is found

This is a short introduction into managed networks, these ones working with Access Points (AP). Every AP sends out about 10 so called beacon frames a second. These packets contain the following information:

This information is then shown in your tool that connects to this network. It is shown when you let your card scan for networks with iwlist scan and when you run airodump-ng.

Every AP has a unique MAC address (48 bit, 6 pair of hexadecimal numbers). It looks like 00:01:23:4A:BC:DE. Every network hardware device has such an address and network devices communicate with each other by using this MAC address. So its basically like a unique name. MAC addresses are unique, no two network devices in the world have the same MAC address.

Connecting with a network

If you want to connect to a wireless network, there are some possibilities. In most cases, Open System Authentication is used. (Optional: If you want to learn more about authentication, check this out.)

Open System Authentication:

This is the simplest case, BUT there could be some problems if you are not legitimate to connect:

Simple sniffing and cracking

Discovering Networks

The first thing to do is looking out for a potential target. The aircrack-ng suite contains airodump-ng for this — but other programs like Kismet can be used too.

Prior to looking for networks, you must put your wireless card into what is called “monitor mode”. Monitor mode is a special mode that allows your computer to listen to every wireless packet. This monitor mode also allows you to optionally inject packets into a network. Injection will be covered later in this tutorial.

To put your wireless card into monitor mode using airmon-ng:

It will create create another interface, and append “mon” to it. So, wlan0 will become wlan0mon. To confirm it is in monitor mode, run “iwconfig” and confirm the mode.

Then, start airodump-ng to look out for networks:

If airodump-ng could connect to the WLAN device, you’ll see a screen like this:

airodump-ng hops from channel to channel and shows all access points it can receive beacons from. Channels 1 to 14 are used for 802.11b and g (in US, they only are allowed to use 1 to 11; 1 to 13 in Europe with some special cases; 1-14 in Japan). 802.11a is in the 5GHz and availability in different countries is more fragmented than on 2.4GHz. In general, known channels starts at 36 (32 in some countries) to 64 (68 in some countries) and 96 to 165. Wikipedia has more details on channel availability. The Linux Central Regulatory Domain Agent takes care of allowing/forbidding transmissions on the different channels for your country; however, it needs to be set appropriately.

The current channel is shown in the top left corner.

After a short time some APs and (hopefully) some associated clients will show up.

The upper data block shows the access points found:

BSSID	The MAC address of the AP
RXQ	Quality of the signal, when locked on a channel
PWR	Signal strength. Some drivers don’t report it
Beacons	Number of beacon frames received. If you don’t have a signal strength you can estimate it by the number of beacons: the more beacons, the better the signal quality
Data	Number of data frames received
CH	Channel the AP is operating on
MB	Speed or AP Mode. 11 is pure 802.11b, 54 pure 802.11g. Values between are a mixture
ENC	Encryption: OPN: no encryption, WEP: WEP encryption, WPA: WPA or WPA2 encryption, WEP?: WEP or WPA (don’t know yet)
ESSID	The network name. Sometimes hidden

The lower data block shows the clients found:

BSSID	The MAC of the AP this client is associated to
STATION	The MAC of the client itself
PWR	Signal strength. Some drivers don’t report it
Packets	Number of data frames received
Probes	Network names (ESSIDs) this client has probed

Now you should look out for a target network. It should have a client connected because cracking networks without a client is an advanced topic (See How to crack WEP with no clients). It should use WEP encryption and have a high signal strength. Maybe you can re-position your antenna to get a better signal. Often a few centimeters make a big difference in signal strength.

In the example above the net 00:01:02:03:04:05 would be the only possible target because it’s the only one with an associated client. But it also has a high signal strength so it’s really a good target to practice.

Sniffing IVs

Because of the channel hopping you won’t capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:

With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The “- -bssid” combined with the AP MAC address limits the capture to the one AP. The “- -bssid” option is only available on new versions of airodump-ng.

Before being able to crack WEP you’ll usually need between 40 000 and 85 000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different IVs is usually a bit lower than the number of data packets captured.

So you’ll have to wait and capture 40K to 85K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.

Cracking

If you’ve got enough IVs captured in one or more file, you can try to crack the WEP key:

The MAC after the -b option is the BSSID of the target and dump-01.cap the file containing the captured packets. You can use multiple files, just add all their names or you can use a wildcard such as dump*.cap.

For more information about aircrack-ng parameters, description of the output and usage see the manual.

The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.

There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can’t get more than “n” different IVs from the AP or that you’ll need millions (like 5 to 7 million) to crack the key. Search in the Forum, there are some threads about cases like this and what to do.

Active attacks

Injection support

Most devices don’t support injection — at least not without patched drivers. Some only support certain attacks. Take a look at the compatibility page, column aireplay. Sometimes this table is not up-to-date, so if you see a “NO” for your driver there don’t give up yet, but look at the driver homepage, the driver mailing list or our Forum. If you were able to successfully replay using a driver which is not listed as supported, don’t hesitate to update the compatibility page table and add a link to a short howto. (To do this, request a wiki account on IRC .)

The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the injection test attack. Make sure to perform this test prior to proceeding. Your card must be able to successfully inject in order to perform the following steps.

You’ll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP.

Try to connect to your AP using aireplay-ng:

The value after -a is the BSSID of your AP.

If injection works you should see something like this:

Источник

Aircrack-ng

User Tools

Site Tools

Table of Contents

Installing Aircrack-ng from Source

Legacy information can be found here.

Requirements

Linux

Windows (Cygwin)

Install the following via Homebrew (brew):

FreeBSD, OpenBSD, NetBSD, Solaris

Install the following via pkg:

Optional stuff

Compiling and installing

Current version

Compiling with AirPcap support (cygwin only)

Compiling on *BSD

Commands are exactly the same as Linux but instead of make, use gmake (with CC=gcc5 CXX=g++5 or any more recent gcc version installed).

Compiling on OS X

Commands are exactly the same as Linux

Latest Git (development) Sources

Note: Compilation parameters can also be used with the sources from our git repository.

./configure flags

When configuring, the following flags can be used and combined to adjust the suite to your choosing:

Troubleshooting Tips

error while loading shared libraries: libaircrack-ng.so.0

Run ldconfig as root or with “sudo” to solve the issue.

«command not found» error message

After you do “make install” then try to use any of the Aircrack-ng suite commands, you get the error message “command not found” or similar. Your system will look for the Aircrack-ng commands in the directories defined by the PATH command.

Normally, the Aircrack-ng suite programs and man pages are placed in:

On your system, to determine which directories have the Aircrack-ng programs enter the following. If using “locate” be sure to first run “updatedb”.

Once you know the directories (exclude the source directories) then determine which directories are in your PATH. To see which directories are included in PATH on your particular system enter:

It should show something like:

At this point compare the actual locations with the directories in your PATH. If the directories are missing from your PATH then you have a few options:

Installing pre-compiled binaries

Linux/BSD/OSX

We offer packages for a number of Linux distributions in 64 bit thanks to PackageCloud.io so you can use your distro’s package manager to install and keep Aircrack-ng up to date:

While most folks want to use our “release” packages, “git” packages are available too for those who decide to use bleeding edge.

More details about them can be found in our blog post.

On OSX, install it is via Macports or brew. Simply do “brew install aircrack-ng” or “sudo ports install aircrack-ng”

Windows

The Windows version of the Aircrack-ng suite does not have an install program. You must manually install (unzipping archive) the software.

Here are the steps to follow for Windows:

Prior to using the software, make sure to install the drivers for your particular wireless card. See this link for the instructions. We currently only support Airpcap; other adapters may be supported but require development of your own DLL so the different tools can interact with it.

To now use the Aircrack-ng suite, start Windows Explorer and double click on Aircrack-ng GUI .exe inside “bin” subdirectory. The GUI requires .NET version 4.6.1 to run.

Источник