Original subtitles

1

The third injection method we're going to talk about is the fragmentation attack the fragmentation attack

2

is very similar to the previous one.

3

But in this attack we have to obtain one thousand five hundred bytes of the R-Ga. the pseudo random

4

generation algorithm because we need to order the full fifteen hundred bytes this attack is we need

5

to be closer to the target network to successfully run this attack.

6

But it's much quicker than the Korac chop chop attack.

7

So again after we obtained the R-Ga. we can use it to create to forge a new packet and then we're going

8

to inject this new force packet into the into the traffic to increase the number of Iberis very quickly.

9

So the concept is very simple we're going to capture a packet determine its P R-GA create a forge in

10

your pocket and then inject that packet into the air.

11

So let's see how we can do this.

12

Again first thing is going to be running aero dump against the target network.

13

So I'm just going to change the name here from chop chop to fragmentation or just going to code fragment

14

hit enter.

15

And here we go.

16

A dump is launched on our target network.

17

Second step as always is fake authentication so that the access point doesn't ignore us and it starts

18

communicating with us.

19

So we do that and we see here we have successfully associated with the target network and the authentication

20

has changed to open.

21

So that's very good.

22

Third step is going to be our fragmentation them.

23

It's very similar to the chop shop attack so you can see here that's my chop shop code that I used the

24

chapter come on.

25

So it's exactly the same command just set up chop chop.

26

I'm going to say fragment.

27

So it's airplay and you fragment be the target address of my target network and then change the MAC

28

address of my own network sort of my own network.

29

So I'm just going to associate myself again and do the fragmentation attack.

30

So it's waiting for a packet now wants to capture the packet it's going to try to terminate its p r

31

g a.

32

Here we go.

33

We got a packet.

34

So it's asking me do I want to use this.

35

I'm going to say yes please.

36

Now I was trying to determine the R-Ga.

37

So the packet wasn't useful.

38

I'm just waiting for another packet to use it's asking me do I want to use this.

39

I'm going to say yes again.

40

Again that packet wasn't too useful.

41

So we're just waiting for another useful packet.

42

I'm going to re associate myself in the meanwhile and I'm going to say yes

43

OK now this time this package was useful.

44

And the keystream is saved to this file.

45

Okay now we're just going to need to again the same as we did in chop chop.

46

We're going to use this keystream to create forced buckets.

47

So I'm just going to copy it's name and I'm going to use the same amount.

48

I'm just going to clear this for you.

49

And I'm going to use the same command that we use with the chop chop attack.

50

The only difference is I'm going to remove the y and I'm going to put the name of the new keystream

51

that we captured and the name of the packet we're going to create.

52

I'm going to call this fragment first packet.

53

So we're just going to go over the commands again.

54

It's Puckett's porridge minus zero to create an a.p packet.

55

We put the target Mac address.

56

Hey it's my own Mac address.

57

And then K and L are the destination and the source IP address is.

58

Why is the name of the keystream file.

59

So it's the file that way that has been created from the previous step.

60

And that's the name of it.

61

And then W is the file name that's going to be created.

62

That's going to contain the first packet and it's going to be called fragments.

63

Fact and is still not stopped.

64

It's been successfully read into this file.

65

So again just like the chop chop I think we're going to inject this new packet into the air.

66

And this is going to be done using airplay ngi with the minus to option the reply option.

67

The repair option just going to paste the name of my new first bucket.

68

So we got airplay and you minus two for a replay or the name of my first packet and zero is my wife

69

I carried with monitor mode before I do this.

70

I'm going to associate myself again and then I'm going to hit enter here.

71

It's asking me do I want to use this because I'm going to say yes.

72

And here we go we can see the data is flying.

73

We're injecting around 400 packets per second.

74

And what's that number is large enough we're going to be able to crack the key.

75

I can just go here to crack ngi.

76

So it's going to be a crack.

77

Angie

78

fragment test

79

Cup here is here we go we can see the key that's the key.

80

And we have 70000 Ivey's.

81

So if we go back here probably even more 35000.

82

And the numbers are increasing quickly.

83

So that was the three methods to inject packets into the air.

84

There is more methods but that's in my opinion the best three methods to increase the number of data

85

into the networks.

86

This way we're able to crack any WEP encrypted network.