Instructor: So from the previous lecture, 2 2
we know, in order to crack WEP, 3 3
we need to first capture a large number of packets, 4 4
this means that we'll capture a large number of IVs, 5 5
the IVs, because they are short, 6 6
they will be repeated, 7 7
therefore we'll be able to use a tool called aircrack-ng 8 8
to run statistical attacks 9 9
and crack the WEP key. 10 10
So, we're using airodump-ng to capture the data 11 11
and we've seen how to do this before, 12 12
then we're using aircrack-ng 13 13
to analyze this data and break the key. 14 14
Let's see how to do this in practice. 15 15
So I already have my wireless adapter in monitor mode. 16 16
And it's called mon0. 17 17
I've also already run airodump-ng 18 18
to list all the networks around me 19 19
and as you can see, I have only one network using WEP. 20 20
This is called Test AP3 21 21
and this is my actual network 22 22
that I use every day. 23 23
I've just configured it to use WEP 24 24
to make this lecture. 25 25
The main reason why I'm targeting the network 26 26
that I use daily 27 27
because like I said, for this to work, 28 28
we need to capture a large number of packets 29 29
and therefore we need a busy network, 30 30
a network that gets used constantly 31 31
to capture a large number of packets. 32 32
If the network is idle, 33 33
then the process is a little bit complex 34 34
and I will cover that in the next lecture. 35 35
So for now, let's focus on the simplest form 36 36
which is how to break into a busy network. 37 37
So I'm gonna copy the BSSID of this network. 38 38
And I'm gonna run airodump-ng against this network only. 39 39
So I showed you how to do this before. 40 40
I'm gonna do airodump.ng. 41 41
I'm gonna do --bssid to specify the BSSID of the network. 42 42
Then I'm gonna do --channel 43 43
to specify the channel of the network 44 44
and we can see it's running on number one. 45 45
And I'm gonna do --write 46 46
to store everything that we capture into a file 47 47
and let's call this file basic_wep. 48 48
And then I'm gonna specify my wireless adapter 49 49
in monitor mode which is mon0. 50 50
So we ran this command before 51 51
in the targeted sniffing lecture. 52 52
All we're doing is we're running airodump.ng 53 53
against a specific network with this MAC address, 54 54
with this channel and we're storing everything in a file 55 55
called basic_wep. 56 56
I'm gonna hit Enter 57 57
and as you can see, airodump.ng is working 58 58
against my target network 59 59
and if you notice, 60 60
you'll see the data in here 61 61
is increasing really, really fast. 62 62
So this is something that I told you, 63 63
I'll talk about it later 64 64
when we were talking airodump.ng 65 65
because I didn't want to talk about IVs 66 66
at that early stage. 67 67
So basically what you see under the Data column 68 68
is the number of useful packets 69 69
that contain a different IV 70 70
that we can use in order to crack the key. 71 71
So the higher this number is, 72 72
the more likely we will be able 73 73
to crack the key. 74 74
As you can see, this number is increasing very fast 75 75
because like I said, this is a busy network 76 76
that is being used at the moment 77 77
by my own computers and my own devices. 78 78
If yours isn't increasing fast, 79 79
then don't worry, we will tackle this problem 80 80
in the next lectures. 81 81
So for now, we're capturing a lot of data 82 82
and this should actually be enough 83 83
to crack the key. 84 84
So what I'm gonna do, 85 85
I'm gonna go down to my other terminal in here 86 86
and if we actually list the files, 87 87
you'll see that we have the capture file 88 88
that we specified in the write argument 89 89
and like I said, we're always interested in the .cap file. 90 90
So all we have to do right now 91 91
is do step two in here. 92 92
Run aircrack-ng against the file 93 93
that we captured in order to crack the key. 94 94
So I'm gonna do aircrack.ng 95 95
followed by the file name 96 96
which is basic_wep-01.cap. 97 97
I'm gonna hit Enter. 98 98
And as you can see, 99 99
it's telling us that the key is found. 100 100
So let me cancel this here 101 101
and right now, we can connect 102 102
to the target network which is called Test_AP3 103 103
using this ASCII password, 104 104
so you can literally just copy this and paste it 105 105
or you can connect using this key. 106 106
Now, in some cases, 107 107
you will not see this ASCII password. 108 108
That's why I'm gonna show you how to connect 109 109
using this key right here 110 110
because you'll always get this. 111 111
So I'm gonna copy this. 112 112
And I'm just gonna paste it here. 113 113
You can paste it anywhere in a normal text editor 114 114
or anywhere you want. 115 115
And all you have to do 116 116
is remove the colons 117 117
that we see in here between the numbers. 118 118
So I'm gonna remove this one, 119 119
I'm gonna remove this one, 120 120
this one and this. 121 121
And now, we can just copy this. 122 122
And just to show you, 123 123
I'm actually gonna connect from my host machine. 124 124
You can connect from Kali 125 125
but when we enabled monitor mode, 126 126
we killed a lot of processes 127 127
and sometimes even after you restart these processes, 128 128
getting connecting to your target 129 129
will be a little bit buggy 130 130
so it's best to literally just restart Kali 131 131
and connect again. 132 132
So just to save all of this time, 133 133
I'm going to connect from here. 134 134
I'm just gonna click here, 135 135
I'm gonna connect to Test AP3. 136 136
And I'm going to paste the password. 137 137
So I'm just gonna click on Show the Password 138 138
to show it to you. 139 139
Again, the same password, 140 140
we just remove the colons. 141 141
I'm gonna click on Join. 142 142
And as you can see, we managed to connect 143 143
and we can test this connection 144 144
by going to Google and perfect. 145 145
As you can see, it's working 146 146
and we managed to break the WEP encryption.