2KKUU7ita

Chapter 9: Wireless LANs
Airodump and aircrack are very simple to run in Windows. You simply download
and extract the aircrack programs, the cygwin Linux simulation environment,
and the supporting peek files from http://aircrack-ng.org and
you’re ready to capture packets and crack away!
A longer key length, such as 128 bits or 192 bits, doesn’t make WEP exponentially
more difficult to crack. This is because WEP’s static key scheduling algorithm
requires that only about 20,000 or so additional packets be captured to
crack a key for every extra bit in the key length.
The wireless industry came up with a solution to the WEP problem called
Wi-Fi Protected Access (WPA). WPA uses the Temporal Key Integrity Protocol
(TKIP) encryption system, which fixes all the known WEP issues. WPA2,
which replaced the original WPA, uses an even stronger encryption method
called Counter Mode with Cipher Block Chaining Message Authentication
Code Protocol (say that fast three times), or CCMP for short, based on the
Advanced Encryption Standard (AES). WPA and WPA2 running in “enterprise
mode” require an 802.1x authentication server, such as a RADIUS server,
to manage user accounts for the WLAN. Check with your vendor for WPA
updates.
For non-enterprise wireless APs (and there are plenty out there in business),
there’s no good reason to not be running WPA2.
You can also use aircrack to crack WPA and WPA2 pre-shared keys (PSKs).
To crack WPA-PSK encryption, you have to wait for a wireless client to
authenticate with its access point. A quick (and dirty) way to force the reauthentication
process is to send a de-authenticate packet to the broadcast
address. This is something my co-author, Peter T. Davis, and I cover in detail
in our book, Hacking Wireless Networks For Dummies.
You can use airodump to capture packets and then start aircrack (you can
also run them simultaneously) to initiate cracking the pre-shared key by
using the following command-line options:
#aircrack-ng -a2 -w path_to_wordlist
CommView for WiFi is my tool of choice for WEP/WPA cracking. It’s simple
to use and works well. Cracking WEP or WPA is simply a matter of 1) loading
CommView for WiFi, 2) starting a packet capture on the wireless channel you
want test, and 3) clicking the Tools menu and selecting either the WEP or
WPA Key Recovery option. A recovered WEP key is shown in Figure 9-7.
167