WPA and WEP

[incideagent]

yea def agree that wep is alot more insecure than wap, i like your setup there horse with the cisco gear, wep you can defeat actaulty very quickly, ive done it on my laptop, when a computer wants to associate with a router it sends an associate frame to it, when it wants to disassociate it sends a disassociate frame, you can actually steal a wep key by sending disassociate frame from the your wardriving laptop and then send a associate frame and you got yourself a wep key, if that doesnt work then you gotta sit around for a couple days and wait for enough packets, i tested and got it to work with airsnort but the file was 20mb of packets, the tool described above i believe is monkey jack, it was quite hard to get it to configure with my laptop (alot of editing and frustration) there is also a perl script out there called wepcrack.

[thehorse13]

Yes, there are many, many toolz out there of similar capabilities. This was the driving force to switch to a far superior auth scheme than WEP. We showed that we could get onto any WAP in a matter of minutes using the technique you have described (disassociate frame attack).

[Merlin775]

If I happen to be wrong please correct me, but to my knowledge there still is not a WPA cracking tool available for download.

Merlin

[thehorse13]

I haven't seen one that is legit.

[incideagent]

i have to find a tool to crack wap either, but then again there is always the tool of social engineering the weakest link is the human

[secure_lockdown]

isn't the big issue with cracking WEP that you need to capture and collect a lot of packets. people tend to notice when you are parked in front of thier house for 3 days straight.

[thehorse13]

That is one way to do it. There is a much more efficient way (that came about later) to get the WEP key without sitting there with airsnort for days - disassociate frame attacks.

[incideagent]

yea that is true, waiting for like three days is pretty obvious, what i was just talking about the disassociate and associate attacks are much faster, if not that then maybe if you could close enoug h to the target, such as here i have three wireless ap's outside my window, so its easy to get packets with no problem minus the obviousness

[secure_lockdown]

i wonder is there are apps out there that can detect W-NIC's opearting in promicuous mode.???

[incideagent]

yea there are programs to detect nics in prom mode. effective way of keeping people out is also mac filter, but this depends, if the attacker can mac clone and get the mac of your ap and clone to that ap's mac and still gain access, this just adds another step to trying to get in. unless he/she is determined.