WEP

03-wep-cracking.pdf the theory behind web cracking is that it uses very weak encryption with an algorithm called RC4. Hence, the transmitter encrypts the data with a key and transfers it with a key and every time tries to generate a unique key which is called IV stands for the initialization vector which is only 24 bit! this IV is added to the password of the network so both the password of the network and the IV are used to encrypt the packets. the IV can be read in plain text! and the size of it is too small so the IV will be repeated in the network so what we are going to do is to capture a large number of packets which means a large number of IVs in this attack and in order to crack the password of a WEP network we are going to use 2 tools: 1- airodump-ng to capture the data 2- aircrack-ng to crack the IV this is the command that we are going to run against the network that we want to attack and we are going to look at the #Data section well to make sure to capture a large amount of data (there are cases where there is a very small amount of data in the network and there is a solution for this we will talk about it later)

airodump-ng --bssid <the MAC of the target network> --channel <the channel number the network is into> --write <the name of the file you want to store the data into> <network interface you want to start sniffing on>

after finish capturing airmon-ng tool will generate 4 files in the directory we ran the tool in those files are:

.cap               .csv              .kismet.csv              .kismet.netxml 

and then we will run aircrack-ng on. cap file (we can run it when the airodump-ng still capturing)

aircrack-ng [filename].cap

  ###############      SUCCESSED YOUR PASS IS: XXXXXXXXXXX      ###############

after the aircrack-ng did cracking the password it will give us two keys on is the ASCII text which is the real clear text password and 10 digits key in this format 00:00:00:00:00 and we can connect to the network using both of them just without the columns 0000000000. to see more about the cracking process in depth with the algorithm follow this link: https://stackoverflow.com/questions/62673983/wep-hacking-and-why-iv-capture-is-needed

The network is not busy and the #Data section is stuck [SOLVED] First solution: Force the AP to generate new IVs [Fake Authentication] this attack is also called an Apreplay attack this can be explained as your clicking on a network on your mobile device even though you don't know the password but the router sees that you tried to connect to it so this way it will not ignore the message we will send it after fake authentication with it the command to fake authentication is:

aireplay-ng --fakeauth <how many times to do this> -a <the mac address of the target network> -h <your machine NIC MAC> <the name of wireless adapter in monitor mode>

now after associating successfully with the network we are going to monitor the network and wait for the arp packet to retransmitting it again and again to increase the data in this network and to make the router busy answering our arp packets to do that we are going to use aireplay-ng again the command will be:

aireplay-ng --arpreplay -b <the mac address of the target network> -h <your machine NIC MAC> <the name of wireless adapter in monitor mode>

notice that this time the “-b” argument stands for the mac address of the target network and not “-a”, after entering this command aireplay-ng will intercept all the data in the network waiting for the arp packet and when it captures one it retransmits it until we told it to stop. At the same time, we can run aircrack-ng with the name of the file that inside there is the data the name of the file is what we wrote in the previous command then all we need is just wait...

 Second solution: Packet injection Korek chop-chop attack in this method, we will capture an ARP packet and attempt to guess its keystream and use it to forge a new packet (using packetforge-ng), then we can inject this new forged packet into the traffic to generate new IVs. to capture the packet and determine its keystream we are going to use the following command:

aireplay-ng --chopchop -b <target MAC> -h <your MAC> [interface] 

then to forge a new packet:

packetforge-ng -0 -a [target MAC] -h [your MAC] -k 255.255.255.255 -l 255.255.255.255 -y [out from last step] -w [output]

 then inject the forced packet into the traffic to generate new IVs

aireplay-ng -2 -r [out from last step] [interface] 

Third solution: Packet injection Fragmentation attack the goal of this method is to obtain 1500 bytes of the PRGA (pseudo-random injected algorithm), this can be used to forge a new packet that can be injected into the traffic to generate new IVs. first is to obtain the PRGA:

aireplay-ng --fragment -b [target MAC] -h [your MAC] interface 

second is to forge a new packet:

packetforge-ng -0 -a [target MAC] -h [your MAC] -k 255.255.255.255 -l 255.255.255.255 -y [out from last step] -w [output]

third and last thing is toinject the forged packet into the traffic to generate new IVs

aireplay-ng -2 -r [out from last step] [interface]