WepAttack

Hello All,

I`m doing a wireless security assessment for a client and they want me to break the WEP key in use on their wireless network, or at least die trying....(this is due to the dept that has hired me to do this wanting to show the dept that uses it that WEP is indeed crappy, a write up on this will not suffice it seems)

Anyway, rather then sit there and run airsnort for hours on end I thought I would give WepAttack http://wepattack.sourceforge.net) a whirl and see how it works out.

Its an offline brute force attack tool that tried to guess the WepKey based on a dictioanry. Now, since the client is use 128 bit WEP am I right in assuming that a full dictionary file of all possible hex values is needed? or am I missing the point?

Also, does anyone know any other offline attack tools for Kismet dumps?

thanks

for a 128 bit WEP, the larger the dictionary, the better it is. You will indeed need a full dictionary, including hex, to solve it in a reasonable time. (unless you wanna leave your computer on trying to crack it for hours).

If you had a Wepon, you could shot a hole through it for access.

Cybr1d, yes I have several large dictioanry files...considered generating a list of all possible hex keys...but that would take a while and I think i would need a SAN to store it.

JuJu thanks for the constructive comment, unfortunately I cannot go around shooting access points..

Please, correct me if I'm wrong...

Brute force is different from dictionary.

A dictionary attack will use only what is in the dictionary file...
Dictionary attacks are good for cracking passwords and the such... cause most of the time, people are going to use an easy to remember/crack password.

Brute force will try everything... no "dictionary" needed...

Right? Wrong?

Quote:

---

Originally posted here by R0n1n
JuJu thanks for the constructive comment, unfortunately I cannot go around shooting access points..

---

Quote:

---

The Jargon Dictionary : Terms : The T Terms : troll


troll
troll v.,n. 1. [From the Usenet group alt.folklore.urban] To utter a posting on Usenet designed to attract predictable responses or flames; or, the post itself. Derives from the phrase "trolling for newbies" which in turn comes from mainstream "trolling", a style of fishing in which one trails bait through a likely spot hoping for a bite. The well-constructed troll is a post that induces lots of newbies and flamers to make themselves look even more clueless than they already do, while subtly conveying to the more savvy and experienced that it is in fact a deliberate troll. If you don't fall for the joke, you get to be in on it. See also YHBT. 2. An individual who chronically trolls in sense 1; regularly posts specious arguments, flames or personal attacks to a newsgroup, discussion list, or in email for no other purpose than to annoy someone or disrupt a discussion. Trolls are recognizable by the fact that the have no real interest in learning about the topic at hand - they simply want to utter flame bait. Like the ugly creatures they are named after, they exhibit no redeeming characteristics, and as such, they are recognized as a lower form of life on the net, as in, "Oh, ignore him, he's just a troll." 3. [Berkeley] Computer lab monitor. A popular campus job for CS students. Duties include helping newbies and ensuring that lab policies are followed. Probably so-called because it involves lurking in dark cavelike corners.
Some people claim that the troll (sense 1) is properly a narrower category than flame bait, that a troll is categorized by containing some assertion that is wrong but not overtly controversial. See also Troll-O-Meter.

The use of `troll' in either sense is a live metaphor that readily produces elaborations and combining forms. For example, one not infrequently sees the warning "Do not feed the troll" as part of a followup to troll postings.

---

Exactly right.

Quote:

---

Its an offline brute force attack tool that tried to guess the WepKey based on a dictioanry.

---

Sounds interesting....sounds maybe like some hybrid that uses both. Maybe some intelligent brute forcer that uses combinations of syllables? Or more likely something that uses dictionary terms first and then combines numbers with words and then uses every other possible combination of digits that hasn't been used yet. I could be way off but I've heard of stuff like that before although I wouldn't know how to go about finding it.

P.S. Sup Phish? I'm baaaack :D

ok, sorry my mistake...its primarily a dicitonary tool...sorry its been a long day....

so, after a shot of caffeine.. WepAttack is a tool that uses a dictionary to attempt to crack wep keys. I`m making a new improved wordlist right now using Egoistic which will hopefully crack the key.

However it also has the ability to be linked into JTR which could then allow it to try brute force as well, right now I`m in wordlist land, brute force is next..

so WepCrack raw = dictionary, WepCrack and JTR = brute force

and its called wepattack! wepcrack was this morning....thats it, i`m going to bed...

lol

sorry this has nothin to do with the thread, but R0n1n, tyhere is a damn edit button, you dont need to post three times in a row.

Quote:

---

Originally posted here by MemorY
sorry this has nothin to do with the thread, but R0n1n, tyhere is a damn edit button, you dont need to post three times in a row.

---

heh.. I'm sorry too.. but memory, if he wants to boost post count and not to have to post to the non-sensical thread, that's one way of doing it.. :p :D

Rofl, I had just scrolled past the 3 posts and was in the middle of saying "holy crap dude, you need to find the freaking edit button...." when I read Memory's post.

Hey if you take all the non-sensical thread posts away i'd still have 1859 posts. So there :p. Now let's get back on topic. I dont wanna be responsible for bringing threads off topic. Like some here do.;)

Ok, so I forgot about the edit button..1 mistake in my posts so far isn`t bad!

now, back to WEP if you please.

(and in an update - using edit)

WepAttack comes a with script - wepattack_inc which is doing a brute force attack based on manipulating dictionary words. The speed isn`t too bad either.

Why wouldn't you just give them the findings of AT&T labs about the ability to break 128bit wep encryption schemes..

http://www.research.att.com/news/200...1Security.html

That alone should convince anyone that it can be broken, and very quickly as well.

Hey guys, im new here, this is my first post, first of all sorry about dragging up an old thread like this but kinda in the same postion here.

ok so heres my problem i just travled up to an exsisting clients work place, and they have just implemented a large scale wireless lan (around their office) and like above they wanted to do a sucirty test on the network.

I though to my self simple ennough then i noticed the floor in my cunning plan ... id only brought my presentation machine (windows) not my linux one, any way theres no way for me to get my linux box here before the report is dew (1 week on monday), so i was woundring if there were any programs on windows with the same capibitly as the linux ones to save me haveing to download and re partion my hhd ?


- Andy

http://www.airscanner.com/pubs/wep.pdf

Heres a little more information on Encryption that might help you on your way.

Airsnort will do what you are looking for, you just have to sniff enough traffic, and hope the WEP key doesn't change. :D
http://airsnort.shmoo.com/

You may want to give aircrack a try. I've found it to crack the WEP keys much faster than airsnort.
Less unique IV's are required.

http://www.cr0.net:8040/code/network/aircrack/

WHAT IS A WEP?

http://en.wikipedia.org/wiki/WEP

Its really not difficult to look things up for yourself.