Original subtitles

1

So cracking WPA or WPA to encrypted networks it's not simple especially that all the Pakistan are sent

2

into the air are not useful for us as they do not contain any information that can help us determine

3

the WPA key.

4

Before we get into cracking WPA and WPA too there is a feature called WPX.

5

It allows users and clients to connect to the network by a push of a button.

6

So on Windows 8 if you look on so my wife my printers they have a W.P. as a button.

7

So if you priced out the Spartan and you go to your router and personally WPX button there as well or

8

go to the configuration page and press the spot on the client the printer or your windows device will

9

connect to the network without having to enter the key.

10

So the purpose of using WPA is it's a feature that allows clients to connect to the network easily without

11

having to enter the WPA key manually.

12

So it's just a feature in routers.

13

This feature works and authenticates the client base using an eight digit PIN.

14

So it doesn't use the actual WPA key.

15

It uses an eight digit PIN.

16

This is the only digits and it's only 8 bits long.

17

So there isn't too many possibilities for this.

18

And if we use a brute force attack we are guaranteed to get this pin.

19

If we successfully get this plan then we can use a tool called River which would calculate the WPA key

20

from this pen.

21

So we're going to brute force the pin the digits on and that because it's only 8 digits we're guaranteed

22

to be able to brute force it successfully.

23

Once we do that we can calculate the WPA key use the river.

24

Again this is only a feature in routers.

25

This flaw is not in WPA or WPA to encryption.

26

The problem is and the WPX feature.

27

So let's see how we do this.

28

First to look for access points that have WPX enabled.

29

We're going to use a tool called wash.

30

So I'm just going to put wash 1 0

31

so we have our test a.p shown up here.

32

That's the AP that we're going to use to crack.

33

So this is actually running on WPA.

34

Now it's not used in wet as we saw in the previous videos.

35

I can confirm that for you here and we are just going to use arundo.

36

This step is not important.

37

I'm just going to use it to show you that test AP is actually used in the encryption.

38

It's not easy.

39

So as you can see here first is used in WPA encryption.

40

Let's just go back.

41

So these are the access points that have WPX enabled to have the Deputy PM feature enabled.

42

And we can see the channel the RSS which is the distance between us and the access point.

43

The WPX version and the WPA slug's.

44

Now some routers when you try to brute force the WPA Espen they lock after a few failed attempts.

45

So if you try for example for wrong pins they're going to lock and not accept any plans for a certain

46

amount of time.

47

So if the WPX law says yes here then you can't actually use this attack now so you need to wait for

48

a little bit and come back to this access point.

49

So to go on Schriever Now river is going to brute force BWP Espin and once it's able to find the WPI

50

spin it's going to work out the WPA key ruber support to pause and resume.

51

So if you reach if you for example brute force 30 percent of the possibilities and cancel the attack

52

if you come back you've got to start again from 30000.

53

You're not going to start from zero.

54

So let's launch reverse we're going to put B to choose to be this idea or the Mac address of the target

55

access point

56

and then see to choose the channel which is 11 and then I choose the Wi-Fi card with my Intel mode and

57

that's 1 0.

58

So very simple reverse access point B as is the channel.

59

And then the wife I had with my timeout atom and not ever associated with the target or sprint it tried

60

to determine the WPA Spen.

61

Now I have an easy pin which is 1 2 3 4 5 6 7 0.

62

And from that it was able to calculate my WPA key.

63

So that's WPA key you or you or them when you as X or.

64

And that's just the name of the access point.

65

So I can just come now and connect to my network and I put the key that we just found

66

then I show the password is you a you or the X or next.

67

As you can see we connected successfully to the network.

68

Now there's a few options that I'd like to show you for either.

69

I'm just going to go river help and that's all the options that you can use with reverb.

70

So as I said some routers would look after a few failed attempts.

71

Therefore you can use some of these other advanced options to make Kleber to get three more to work

72

against these access points.

73

For example you can use the delay option and specify the amount of time in seconds that reverse should

74

wait between each brute force attempt or each pin attempt.

75

You can also use the lock delay to tell revert to wait.

76

For example 60 seconds after if the if the access points gets locked then wait for 60 seconds and then

77

continue your brute force attempt.

78

You can use the full weight as well to set the time that you should wait.

79

After 10 failed attempts you can use the the option to revert to sleep after a certain amount just sleep

80

for a certain amount of seconds after a certain number of tries.

81

You can set up the timeout.

82

You can play with these options the delay options and the time out the fairways and all that.

83

If the access point was locking or was ignoring some of your brute force attempts.