Instructor: Now that we have associated 2 2
with our target network, 3 3
we can start communicating with it, and it won't ignore us. 4 4
So now we can go and start injecting packets 5 5
into the traffic to force the access point 6 6
to generate new packets with new IVs. 7 7
This will increase the number of data 8 8
really, really quickly, allowing us 9 9
to crack WEP networks in minutes, 10 10
even if the network was not busy, 11 11
like the one that we are targeting right now. 12 12
Now, there are a number of ways to do this, 13 13
but in this course, I'm going to explain 14 14
the most reliable method 15 15
which is using an ARP request replay attack. 16 16
I actually explain other methods 17 17
in my network hacking course, 18 18
but they are a little bit more complex 19 19
and have less success rate. 20 20
So this is the most reliable method 21 21
and it should work against most networks 22 22
if you have a good signal and a good wireless adapter. 23 23
So the idea behind this method is 24 24
to wait for an ARP packet, 25 25
and I'll talk about ARP in more details later on. 26 26
So for now, just think of it as a special type of a packet 27 27
that we're gonna be waiting on. 28 28
Once this packet is sent in the network, 29 29
we're going to capture it and retransmit it. 30 30
Once we do this, the router is forced 31 31
to generate a new packet with a new IV. 32 32
So by repeating this process, we will be forcing the router 33 33
to continuously generate new packets with new IVs. 34 34
Then once we have enough data, once we have enough IVs, 35 35
we can run aircrack-ng, 36 36
exactly as we seen before and crack the key. 37 37
So let me show you how to do this in practice. 38 38
Now, as you can see, 39 39
I'm already running airodump-ng against my target network. 40 40
And I have already associated with it 41 41
as shown in the previous lecture. 42 42
So the only thing that's left right now 43 43
is to run the ARP replay attack 44 44
in order to inject packets into the traffic, 45 45
and force the router to generate new packets 46 46
and increase the number of data. 47 47
To do that, we're gonna use aireplay-ng again. 48 48
And the command is actually gonna be very similar 49 49
to this command right here. 50 50
So I'm actually gonna copy all of this because I'm lazy, 51 51
and I'm gonna clear this, and paste the command here. 52 52
Now, there are only a few things that I need to modify. 53 53
First of all, I don't want to run 54 54
a fake authentication attack, 55 55
so I'm gonna remove all of this, 56 56
and I want to run an ARP replay attack. 57 57
Also, this attack does not take a number, 58 58
so I'm gonna remove this number. 59 59
And I'm also gonna replace the a with b, and we're done. 60 60
So if you look at it, you'll see it's actually very similar 61 61
to this command right here. 62 62
We're using aireplay-ng, 63 63
but instead of doing a fake authentication attack, 64 64
we're doing an ARP replay attack, 65 65
we're giving it the MAC address of my target network 66 66
after the b instead of the a. 67 67
Then we're giving it the MAC address 68 68
of my wireless adapter after the h, 69 69
which is identical to this. 70 70
And then we're giving it 71 71
my wireless adapter in monitor mode. 72 72
Now, I'm actually gonna associate again, before I do that, 73 73
and then I'm gonna hit Enter here. 74 74
And what's happening right now is 75 75
my wireless adapter is waiting for an ARP packet, 76 76
once there is an ARP packet transmitted in this network, 77 77
it's gonna capture it, and it's going to retransmit it. 78 78
Once it does that, the access point will be forced 79 79
to generate a new packet with a new IV, 80 80
and we'll keep doing this, forcing the access point 81 81
to continually generate new packets with new IVs. 82 82
So you should just wait for it right now, 83 83
we're literally just waiting for an ARP packets 84 84
to be sent in the air. 85 85
And as you can see, the number of data 86 86
is increasing now very, very quickly, which means 87 87
that we actually managed to capture an ARP packet. 88 88
This ARP packet got retransmitted, forced the router 89 89
to generate a new packet with a new IV, 90 90
and we are continually doing this process, 91 91
forcing the router to generate new packets with new IVs. 92 92
So right now we can go ahead and run aircrack-ng, 93 93
to crack this network, and before I do that, 94 94
I'll actually just associate one more time. 95 95
And then I'm gonna do aircrack-ng, 96 96
and give it the name of the file 97 97
which we're storing the data in, 98 98
which is called arpreplay-01.cap. 99 99
So I'm gonna hit Enter, 100 100
and you'll notice the cracking process right now 101 101
will actually require more data packets. 102 102
The reason for this is, 103 103
I've actually modified the settings of this network, 104 104
so that it uses 128 bit key, 105 105
because in WEP, you can either use a 64 bit or 128 bit key, 106 106
and obviously, the 128 key is longer. 107 107
Therefore, I actually modified the key length 108 108
for this lecture to make sure it's the longest key possible. 109 109
And as you can see, we still managed to get it 110 110
within about 47,000 packets. 111 111
We have the key right here in ASCII, 112 112
and we have the key in here in hex, 113 113
where we can use after we remove the colons. 114 114
So perfect, now we managed to crack the target network, 115 115
it was idle as you could see, 116 116
the was no data being sent, and we managed to do this 117 117
by forcing the target access point 118 118
to generate new packets with new IVs.