Hack WPAWPA2 WPS Reaver Kali Linux. When it was known that a WEP network could be hacked by any kid with a laptop and a network connection using easy peasy tutorials like those on our blog, the security guys did succeed in making a much more robust security measure WPAWPA2. Now hacking WPAWPA2 is a very tedious job in most cases. A dictionary attack may take days, and still might not succeed. Also, good dictionaries are huge. An exhaustive bruteforce including all the alphabets uppercase lowercase and numbers, may take years, depending on password length. Rainbow tables are known to speed things up, by completing a part of the guessing job beforehand, but the output rainbow table that needs to be downloaded from the net is disastrously large can be 1. GBs sometimes. And finally the security folks were at peace. But it was not over yet, as the new WPA technology was not at all easy for the users to configure. With this in mind, a new security measure was introduced to compliment WPA. CrackingaWi5.jpg' alt='Wordlist For Wpa Crack App' title='Wordlist For Wpa Crack App' />Wifi Protected Setup WPS. Now basically it was meant to make WPA even tougher to crack, and much easier to configure push a button on router and device connects. However, it had a hole, which is now well known, and tools like reaver can exploit it in a single line statement. The WiFi Protected Setup protocol is vulnerable to a brute force attack that allows an attacker to recover an access points WPS pin, and subsequently the WPAWPA2. It still might take hours, but it is much better than the previous scenario in which months of brute forcing would yield no result. Heres what wikipedia says about WPS Created by the Wi Fi Alliance and introduced in 2. Wi Fi Protected Access, as well as making it easy to add new devices to an existing network without entering long passphrases. Prior to the standard, several competing solutions were developed by different vendors to address the same need. A major security flaw was revealed in December 2. WPS feature, which most recent models have enabled by default. WEP hacking is a joke. WPA is a nightmare. But with WPS enabled, any network can be hacked in nearly 3 hours using Reaver on Kali Linux. This tutorial shows how. Wordlist For Wpa Crack App' title='Wordlist For Wpa Crack App' />Wordlist For Wpa Crack App StoreThe flaw allows a remote attacker to recover the WPS PIN in a few hours with a brute force attack and, with the WPS PIN, the networks WPAWPA2 pre shared key. Users have been urged to turn off the WPS feature, although this may not be possible on some router models. Working Of WPS. Now while most of the things are the same as in WPA, there is a new concept of using pins for authentication. So basically, the client sends 8 digit pins to the access point, which verifies it and then allows the client to connect. Now a pin has 8 digits, and only contains numbers, so its a possible target for bruteforece. Under normal bruteforcing of WPA passwords, you have to consider the fact that there may be number, alphabets, and sometimes symbols and more than 8 letters. This make the task a billion billion times tougher. However, we can try thousands of keys per second, which make it a tad bit easier. Now in WPS, there is a delay because we have to wait for APs response, and we may only try a few keys per second practically the best Ive seen on my PC is 1 key per 2 sec. Basically, 8 digits and 1. Now thatll be years. So, where is this taking us The answer is, there are flaws in this technology that can be used against it. The 8th digit is a checksum of first 7 digits. Two months, still a way to go. The pin number for verification goes in two halves, so we can independently verify the first four and the last four digits. And believe me, its easy to guess 4 digits correct two times, than to guess 8 correct digits at once. Basically, the first half would take 1. Now the guesses would be 1. Now we need 1. 1,0. So thatll take 3 hours approximately. And thats all the combinations, and most probably the correct pin will not be the last combination, so you can expect to reach the result earlier. However, the assumption is that bruteforcing will take place at a key per second. My personal best is a key every 2 seconds, and yours might drop to as low as a key every 1. How to carry out the attack. Now it might have been tough to carry out this attack at some point in history, but now, its a breeze. If you have all the prerequisites, then hacking the network would be as easy as. Cambridge Toefl Ibt Practice Test there. BSSID of target. And if you are already familiar with hacking WEP, then just go to your Kali Linux terminal and type the above command replacing what needs to be replaced. Leave your machine as is, come back 1. However, if youre a newbie, then tag along. First off, you need to have Kali linux or backtrack up and running on your machine. Any other Linux distro might work, but youll need to install Reaver on your own. Now if you dont have Kali Linux installed, you might want to go to this page, which will get you started on hacking with Kali Linux. Reaver has a known issue Sometimes it doesnt work with Virtual Machines, and you might have to do a live boot using live CD or live USB of Kali Linux. See the last section of this post on troubleshooting by scrolling down a bit. Information Gathering. Now you need to find out the following about you target network Does it have WPS enabled. If not, then the attack will not work. The BSSID of the network. Now to check whether the network has WPS enabled or not, you can either use wash or just use the good old airodump ng. Wash is specifically meant to check whether a network has WPS enabled or not, and thereby is much easier to use. Here are the steps Set your wireless interface in monitor mode. Use wash easy but sometimes unable to detect networks even when they have wps enabled. If any network shows up there, it has WPS enabled. Use airodump ng. It will show all networks around you. It tells which of them use WPA. Youll have to assume they have WPS, and then move to next steps. BSSID of the network Now irrespective of what you used, you should have a BSSID column in the result that you get. Copy the BSSID of the network you want to hack. Thats all the information you need. So by now you must have something like XX XX XX XX XX XX, which is the BSSID of your target network. Keep this copied, as youll need it. Now finally we are going to use Reaver to get the password of the WPAWPA2 network. Reaver makes hacking very easy, and all you need to do is enter. XX XX XX XX XX XX. Explanation i   interface used. Remember creating a monitor interface mon. This is what we are using. BSSID of the network that we found out earlier. This is all the information that Reaver needs to get started. However, Reaver comes with many advanced options, and some are recommended by me. Most importantly, you should use the vv option, which increases the verbosity of the tool. Basically, it writes everything thats going on to the terminal. Driver Smart Office Keyboard Ez 7000 Driver. This helps you see whats happening, track the progress, and if needed, do some troubleshooting. So final command should be. XX XX XX XX XX XX vv. After some hours, you will see something like this. The pin in this case was intentionally 1. X is the password of the wireless network. Here is an extra section, which might prove useful. Known problems that are faced Troubleshooting. As in the pic above, you saw the first line read Switching wlan. Yours will be mon. Sometimes, it keeps switching interfaces forever. Sometimes it never gets a beacon frame, and gets stuck in the waiting for beacon frame stage. Sometimes it never associates with the target AP. Sometimes the response is too slow, or never comes, and a 0x. In most cases, such errors suggest Something wrong with wireless card. AP is very choosy, wont let you associate. The AP does not use WPS. You are very far from the AP. Rate Limiting implemented in the router most new router have this.