How to use Airodump-ng - Revision history

24.84.196.44 at 07:37, 14 December 2015

2015-12-14T07:37:14Z

24.84.196.44 at 07:36, 14 December 2015

2015-12-14T07:36:58Z

24.84.196.44 at 07:36, 14 December 2015

2015-12-14T07:36:19Z

24.84.196.44 at 07:34, 14 December 2015

2015-12-14T07:34:07Z

24.84.196.44 at 07:33, 14 December 2015

2015-12-14T07:33:24Z

New page

Set monitor mode:
wconfig wlan0 mode monitor

Start airmon-ng service:
airmon-ng start wlan0

Start Scan:
airodump-ng wlan0

'''Sniffing IVs'''

Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:

airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump rausb0

With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The “--bssid” combined with the AP MAC address limits the capture to the one AP. The “--bssid” option is only available on new versions of airodump-ng.

Before being able to crack WEP you'll usually need between 40 000 and 85 000 different Initialization Vectors (IVs). Every data packet contains an IV. IVs can be re-used, so the number of different IVs is usually a bit lower than the number of data packets captured.

So you'll have to wait and capture 40K to 85K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.

'''Cracking'''

If you've got enough IVs captured in one or more file, you can try to crack the WEP key:

aircrack-ng -b 00:01:02:03:04:05 dump-01.cap

The MAC after the -b option is the BSSID of the target and dump-01.cap the file containing the captured packets. You can use multiple files, just add all their names or you can use a wildcard such as dump*.cap.

For more information about aircrack-ng parameters, description of the output and usage see the manual.

The number of IVs you need to crack a key is not fixed. This is because some IVs are weaker and leak more information about the key than others. Usually these weak IVs are randomly mixed in between the stronger ones. So if you are lucky, you can crack a key with only 20 000 IVs. But often this it not enough and aircrack-ng will run a long time (up to a week or even longer with a high fudge factor) and then tell you the key could not be cracked. If you have more IVs cracking can be done a lot faster and is usually done in a few minutes, or even seconds. Experience shows that 40 000 to 85 000 IVs is usually enough for cracking.

There are some more advanced APs out there that use an algorithm to filter out weak IVs. The result is either that you can't get more than “n” different IVs from the AP or that you'll need millions (like 5 to 7 million) to crack the key. Search in the Forum, there are some threads about cases like this and what to do.

Active attacks
Injection support

Most devices don't support injection - at least not without patched drivers. Some only support certain attacks. Take a look at the compatibility page, column aireplay. Sometimes this table is not up-to-date, so if you see a “NO” for your driver there don't give up yet, but look at the driver homepage, the driver mailing list or our Forum. If you were able to successfully replay using a driver which is not listed as supported, don't hesitate to update the compatibility page table and add a link to a short howto. (To do this, request a wiki account on IRC.)

The first step is to make sure packet injection really works with your card and driver. The easiest way to test it is the injection test attack. Make sure to perform this test prior to proceeding. Your card must be able to successfully inject in order to perform the following steps.

You'll need the BSSID (AP MAC) and ESSID (network name) of an AP that does not do MAC filtering (e.g. your own) and must be in range of the AP.

Try to connect to your AP using aireplay-ng:

aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00:01:02:03:04:05 rausb0

The value after -a is the BSSID of your AP.

If injection works you should see something like this:

12:14:06 Sending Authentication Request
12:14:06 Authentication successful
12:14:06 Sending Association Request
12:14:07 Association successful :-)

←Older revision		Revision as of 07:37, 14 December 2015
Line 1:		Line 1:
		+	== Setup ==
		+
	Set monitor mode:		Set monitor mode:
	wconfig wlan0 mode monitor		wconfig wlan0 mode monitor

←Older revision		Revision as of 07:36, 14 December 2015
Line 100:		Line 100:

	Further tools and information		Further tools and information
		+
		+
		+	[http://www.aircrack-ng.org/doku.php?id=newbie_guide Source]

@@ Line 8: / Line 8: @@
   airodump-ng wlan0
-'''Sniffing IVs'''
+== Sniffing IVs ==
 Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:
@@ Line 20: / Line 20: @@
 So you'll have to wait and capture 40K to 85K of data packets (IVs). If the network is not busy it will take a very long time. Often you can speed it up a lot by using an active attack (=packet replay). See the next chapter.
-'''Cracking'''
+== Cracking ==
 If you've got enough IVs captured in one or more file, you can try to crack the WEP key:
@@ Line 55: / Line 55: @@
 :14:06  Sending Association Request
 :14:07  Association successful :-)

@@ Line 12: / Line 12: @@
 Because of the channel hopping you won't capture all packets from your target net. So we want to listen just on one channel and additionally write all data to disk to be able to use it for cracking:
-  airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump rausb0
+  airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump wlan0
 With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The “--bssid” combined with the AP MAC address limits the capture to the one AP. The “--bssid” option is only available on new versions of airodump-ng.
@@ Line 45: / Line 45: @@
 Try to connect to your AP using aireplay-ng:
-  aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00:01:02:03:04:05 rausb0
+  aireplay-ng --fakeauth 0 -e "your network ESSID" -a 00:01:02:03:04:05 wlan0
 The value after -a is the BSSID of your AP.