Wifi Hacking.

Hack/Crack a WiFi Network

Hi all users I think many Windows users here are struggling to hack WiFi networks because most of the tutorials are based on BackTrack and other Linux Tools . So today I'm here for sharing a method to Crack WiFi networks using WEP security protocol .The WEP is a very vuarable to attacks and can be cracked easily .

It takes about 5-6 hours if the password is weak a high signal of the WiFi network you are going to hack and you have sometimes 10-12 for more complicated passwords and if the WiFi signal of the Network is weak .The time taken also changes if the WiFi network you are going to hack has many other clients already accessing it .

You will be using two tools :

1. Commview for WiFi : You will use this tool for capturing the packets sent and recieved through the Access Point you are going to hack .The more packets you capture the better chances of cracking the password .You will need more than 1,00,000 minium packets to crack the password .The packets will be captured in the .ncp format .You will use this tool to convert the .ncp to .cap .

Note :- Some WiFi cards are supported by Commview only in Windows 7 so i suggest you install Win 7 in your Virtual Machine if your card isn't supported .

2. Aircrack-Ng GUI : You will use this tool to crack the password of the Access Point using the . Cap files you obtained from the Commview application .

Note :- You need to run this as administrator .

Now Get Ready to Crack :

Step 1 : Install CommView for WiFi . It doesnt matter whether you install it in VoIP mode or Standard mode . I used VoIP . It automatically installs the necessary drivers . Allow it to install .

Note :- You will not be able to connect to any Network using WiFi when using CommView .

Step 2 : Click on the PLAY ICON in the Left First .

Step 3 : (Choosing the Network (a) ) : A new window should pop up now. Click on the START SCANNING button .

Step 4 : (Choosing the Network (b) ) : Click on the WiFi network you want to hack in the Right Coulumn and Click on CAPTURE.

Note :- This tutorial is only for WEP protected networks .

Step 5 : (Capturing the Packets) : The windows should close now and you should see that CommView has started Capturing Packets .

Step 6 : (Saving the Packets ) : Now that the Packets are getting captured you need to Save them. Click on Settings->Options->Memory Usage Change Maximum Packets in buffer to 20000.

Click on the LOGGING Tab .

Check AUTO-SAVING
In the Maximum Directory Size : 5000
Average Log File Size : 50

Now CommView will automatically Start Saving packets in the .ncp format at a size of 20MB each in the specified directory .

Step 7 : ( Concatenating the Logs ) : Since you are capturing a lot of logs you will need to concatenate them into once file . To do this go to Logging and click on CONCATENATE LOGS Choose all the files that have been saved in your specified folder and Concatenate them .

Now you will have one .ncf file .

Step 8 : (Converting .ncf to .cap ) : Now that you have one file with all the packets you need to Convert it into .cap file for AIRCRACK to crack .

Click on File->Log Viewer->Load Commview Logs-> Choose the .ncf file. Now File->Export->Wireshark/TCP dump format .

How to hack a wi-fi network

Doesn’t it suck when you see your laptop’s catching so many wi-fi signals but none of them is accessible.. don’t you feel like “I wish I could some how break the password and dive into the deep oceans of the information” I beleive everyone should be able to have free internet. If someday I make it big enough and I’ll be having ample money.. I promise I’ll provide free wifi hotspots all over the places.. “Let there be INTERNET”.. even If I don’t get rich.. I’ll become a politician and would make Internet a Fundemental right to every citizen.. Now that would be something..

That’s enough with the Castles in the air.. now lets get back to reality..

What I can do for you right now is that I can tell you how to hack a wifi network to access Internet.. Some would call it stealing.. some like me won’t..

I’ll call it Sharing.. Sharing is what on which the whole Internet is build upon…

So.. Here’s how we do it..

1) First we need to scan for available wireless networks.

Theres this great tool for windows to do this.. called “NetStumbler” or Kismet for Windows and Linux and KisMac for Mac

Below is a screenshot of NetStumbler.. It will show you a list of all the wireless access points in your range.

It’ll also show how the Wi-fi network is secured..

The two most common encryption types are:

1) WEP

2) WAP

WEP i.e Wire Equivalent Privacy is not consideres as safe as WAP i.e Wireless Application Protocol.

WEP have many flaws that allows a hacker to crack a WEP key easily.. whereas

WAP is currently the most secure and best option to secure a wi-fi network..

It can’t be easily cracked as WEP because the only way to retreive a WAP key is to use a brute-force attack or dictionary atack.

Here I’ll tell you how to Crack WEP

To crack WEP we will be using Live Linux distribution called BackTrack to crack WEP.

BackTrack have lots of preinstalled softwares for this very purpose..

The tools we will be using on Backtrack are:

Kismet – a wireless network detector

airodump – captures packets from a wireless router

aireplay – forges ARP requests

aircrack – decrypts the WEP keys

 

 

 

1) First of all we have to find a wireless access point along with its bssid, essid and channel number. To do this we will run kismet by opening up the terminal and typing in kismet. It may ask you for the appropriate adapter which in my case is ath0. You can see your device’s name by typing in the command iwconfig.

 

 

2) To be able to do some of the later things, your wireless adapter must be put into monitor mode. Kismet automatically does this and as long as you keep it open, your wireless adapter will stay in monitor mode.

 

 

3) In kismet you will see the flags Y/N/0. Each one stands for a different type of encryption. In our case we will be looking for access points with the WEP encryption. Y=WEP N=OPEN 0=OTHER(usually WAP).

 

 

4) Once you find an access point, open a text document and paste in the networks broadcast name (essid), its mac address (bssid) and its channel number. To get the above information, use the arrow keys to select an access point and hit <ENTER> to get more information about it.

 

 

 

 

 

5) The next step is to start collecting data from the access point with airodump. Open up a new terminal and start airodump by typing in the command:

airodump-ng -c [channel#] -w [filename] –bssid [bssid] [device]

In the above command airodump-ng starts the program, the channel of your access point goes after -c , the file you wish to output the data goes after -w , and the MAC address of the access point goes after –bssid. The command ends with the device name. Make sure to leave out the brackets.

 

 

6) Leave the above running and open another terminal. Next we will generate some fake packets to the target access point so that the speed of the data output will increase. Put in the following command:

aireplay-ng -1 0 -a [bssid] -h 00:11:22:33:44:55:66 -e [essid] [device]

In the above command we are using the airplay-ng program. The -1 tells the program the specific attack we wish to use which in this case is fake authentication with the access point. The 0 cites the delay between attacks, -a is the MAC address of the target access point, -h is your wireless adapters MAC address, -e is the name (essid) of the target access point, and the command ends with the your wireless adapters device name.

 

 

7) Now, we will force the target access point to send out a huge amount of packets that we will be able to take advantage of by using them to attempt to crack the WEP key. Once the following command is executed, check your airodump-ng terminal and you should see the ARP packet count to start to increase. The command is:

aireplay-ng -3 -b [bssid] -h 00:11:22:33:44:5:66 [device]

In this command, the -3 tells the program the specific type of attack which in this case is packet injection, -b is the MAC address of the target access point, -h is your wireless adapters MAC address, and the wireless adapter device name goes at the end.

 

 

8) Once you have collected around 50k-500k packets, you may begin the attempt to break the WEP key. The command to begin the cracking process is:

aircrack-ng -a 1 -b [bssid] -n 128 [filename].ivs

In this command the -a 1 forces the program into the WEP attack mode, the -b is the targets MAC address, and the -n 128 tells the program the WEP key length. If you don’t know the -n , then leave it out. This should crack the WEP key within seconds. The more packets you capture, the bigger chance you have of cracking the WEP key.

I am sure it might have helped.:)