-: In the previous lectures, 2 2
we've seen how to crack the WEP encryption in minutes 3 3
even if the target network is not busy. 4 4
Now in the next lectures, 5 5
we will talk about cracking WPA and WPA2. 6 6
First of all before we start talking 7 7
about how to crack these encryptions, 8 8
it is very important to understand 9 9
that both of them are very very similar, 10 10
the only difference between them 11 11
is the encryption used to ensure message integrity. 12 12
WPA uses TKIP 13 13
and WPA2 uses an encryption called CCMP. 14 14
In any case, this does not affect the methods 15 15
that we're gonna use to crack WPA and WPA2. 16 16
Therefore, all of the methods that I'm gonna show you 17 17
from now on, will work on both WPA and WPA2. 18 18
Now both of these encryptions came after WEP 19 19
and they were designed to address the weaknesses in it. 20 20
Therefore both of them are much more secure 21 21
and cracking them is more challenging. 22 22
So, before we start talking about how to crack them, 23 23
I want to cover a feature that if enabled and misconfigured, 24 24
can be exploited to recover the key 25 25
without having to crack the actual encryption. 26 26
The feature is called WPS. 27 27
It allows devices to connect the network easily 28 28
without having to enter the key for the network. 29 29
So it was designed to simplify 30 30
the process of connecting printers and such devices. 31 31
You can actually see a WPS button 32 32
on most wireless-enabled printers. 33 33
If this button is pressed 34 34
and then you press the WPS button on the router, 35 35
you'll notice that the printer will connect to the router 36 36
without you having to enter the key. 37 37
This way, the authentication is done 38 38
using an eight-digit PIN. 39 39
So you can think of this, as a password 40 40
made up of only numbers 41 41
and the length of this password is only eight. 42 42
So this actually gives us 43 43
a relatively small list of possible passwords 44 44
and we can try all of these possible passwords 45 45
within a relatively short time. 46 46
Once we get this PIN, 47 47
it can be used to recover the actual WPA or WPA2 key. 48 48
So as you can see with this method 49 49
we are not exploiting WPA or WPA2, 50 50
we are actually exploiting a feature 51 51
that can be enabled on these encryptions. 52 52
So for this to work, first of all we need WPS 53 53
to be enabled on the network because it can't be disabled. 54 54
Also it needs to be misconfigured, 55 55
so it needs to be configured 56 56
to use a normal PIN authentication 57 57
and not a Push Button Authentication . 58 58
If Push Button Authentication is used, 59 59
then the router will refuse any PINs that we try 60 60
unless the WPS button is pressed on the router. 61 61
Therefore, the method will not work 62 62
if push button or PBC is enabled. 63 63
So in most modern routers, PBC comes enabled 64 64
by default or WPS will be disabled by default 65 65
so this method might not work but because WPA and WPA2 66 66
are so secure and so challenging, 67 67
it is always a good idea to check if WPS is enabled 68 68
and tried the method that I'm gonna show you 69 69
to crack the network. 70 70
If it fails, then you can try the other methods 71 71
that I'm gonna show you after the next lecture.