Linux

Site Search

Windows

WIN32 tools, Howtos   Tools Index

General

Miscellaneous WI-FI   Default WI-FI Settings   Rogue AP Howtos   WI-FI Certifications   802.11 Standards   STEP BY STEP Guides   Formats / Extensions   WI-FI Home Security   Useful Links

aireplay:

Project Homepage: http://www.cr0.net:8040/code/network/ (OFFLINE)

Project Homepage: Local Mirror of Homepage  aircrack-2.41.tgz  MD5: 05A37C8A165EFB11EA226829C809DEB3

NOTE: The next generation of Aircrack, Aircrack-ng has far superseded the functionality of the original; Aircrack-ng's project homepage can be found here: http://www.aircrack-ng.org/doku.php

aireplay is an 802.11 packet injection program. 

*Orinoco drivers not supported

Disassociate client to find ESSID and for WPA dictionary attack

Producing encrypted packets for WEP breaking - Client Present

Producing encrypted packets for WEP breaking - No Client Present

Receiving no ARP requests?

Receiving: "AP rejects source MAC address?"

The MAC address in the following examples represent:

11:11:11:11:11:11 = BSSID or MAC of the Access Point

22:22:22:22:22:22 = Valid client MAC address

33:33:33:33:33:33 = Source MAC for our attacks (may be valid client MAC that is not currently active on the network)

Disassociate client to find ESSID and for WPA dictionary attack

The disassociation process is the same whether we wish to find a hidden ESSID or to force a WPA client to reassociate so we can capture the WPA handshake to perform a dictionary attack.  All that differs is the number of disassociation packets we need to send.

aireplay -0 1  -a 11:11:11:11:11:11 -c 22:22:22:22:22:22 [interface]

The hidden ESSID will now appear in the airodump windows

However, to capture the WPA handshake to perform the WPA dictionary attack we have to ensure the client is totally disassociated:

aireplay -0 15  -a 11:11:11:11:11:11 -c 22:22:22:22:22:22 [interface]

In the example above we send 15 disassociation packets (increase if the handshake capture fails)

We now have the clients WPA handshake and can attempt a dictionary attack utilising aircrack.

Producing encrypted packets for WEP breaking - Client Present:

This injection procedure is required when there is not enough encrypted traffic being passed across the WLAN to break the WEP key (approximately 300,000 packets are required for breaking 64-bit WEP and approximately 1,000,000 packets for 128-bit WEP).  This process involves:

• Deauthing a valid client (to increase the chances of acquiring an ARP packet, will also allows us to determine a hidden ESSID.

   

• Capture and replay of a valid ARP packet to speedup/generate the collection of encrypted packets.

We now start listening for ARP requests with the -3 option. The -h option is mandatory and has to be the MAC address of an associated client:

As an example:

aireplay -3 -b 11:11:11:11:11:11  -h 22:22:22:22:22:22 [interface]

Captures of around 30,000 encrypted packets in (10 minutes) to over 75,000 encrypted packets in (10 minutes) against previously  inactive 802.11b networks were observed. 

Further Notes:

• Appending the -x (no. of packets per second) option with a variety of different values failed to significantly increase the number of encrypted packets collected.

aireplay -3  -x  900  -b 11:11:11:11:11:11  -h 22:22:22:22:22:22 [interface]

• Utilising the -n,  -m and -d options similarly failed to show any marked improvement.

aireplay -3  -n  68  -m  68 -d  ff:ff:ff:ff:ff:ff  -b 11:11:11:11:11:11  -h 22:22:22:22:22:22 [interface]

The many switches provided with aireplay should be examined and experimented with.  But on the whole it seemed very much down to luck and which particular packet was replayed that determined the speed at which encrypted packets could be collected and not whether the -n, -m, -d or -x switches were utilised.

Producing encrypted packets for WEP breaking - No Client Present:

This attack is only useful when you need an associated MAC address there is currently no associated client. However it is generally better to use the MAC address of a real client as in the Producing encrypted packets for WEP breaking - Client Present attack.

Open a console and start airodump: