Aireplay-ng attacks

Attack 9: Injection Test

This option is used for testing rather than attacking. Not all wireless chipsets support packet ‘injection’. Test if your chipset supports packet injection.

Ex..

aireplay-ng -9 mon0

If an AP is found, aireplay-ng will test injection and give you the output. This is why you bought a specific wireless card that supports injection. You will see how powerful injection can be in later attacks.

Attack 0: Deauthentication

Deauthentication simply kicks clients off of the wireless network. This is useful because when the client reconnects, they often generate an ARP request. (note: you cannot deauth your fake authed card to obtain an ARP request.) In WEP cracking, ARP requests are used to inject and quickly generate IVs. The attack can also force a client to give up the WPA/WPA2 handshake for cracking. Deauth will force a client to give up a hidden ESSID.

            Unlike others, this attack specifically targets the STA (client). If you have issues with this attack make sure you are close enough to the STA.

            This attack requires that you are in monitor mode and that a client is connected to the network you are attacking.

Ex.

aireplay-ng -0 2 –e “jake” –a 00:0C:41:F2:AC:F0 –c 00:23:15:99:2D:1E mon0

o   -0 is the deauth attack

o   2 is the # of deauths you wish to send---0 means infinite

o   -e is the ESSID of the target network

o   -a is the BSSID of the target network

o   -c is the STA or client MAC address of the target network---not using –c will send a deauth to all connected clients.

o   mon0 is the interface used

Attack 1: Fake Authentication

Fake authentication is used to connect to WEP networks. Fake authentication does not mean you have the WEP key and doesn’t mean you bypassed it. It simply means that the AP will accept your MAC address. This is useful when there are no other connected STAs. Fake authentication will not generate any ARP requests.

            The biggest reason why injection attacks fail is because you are not associated with the AP. Using the fake authentication attack solves this problem.

***If your fake auth always fails, MAC address filtering may be enabled***

Ex.

aireplay-ng -1 5 –e “jake” –a 00:0C:41:F2:AC:F0 –h 00:C0:CA:32:3D:85 mon0

·        -1 is the fake auth attack

·        5 is the time in seconds to re-associate. Longer times allow for keep alive packets to be sent, resulting in more traffic.

·        -e is the ESSID of the target network

·        -a is the BSSID of the target network

·        -h is your MAC address

·        mon0 is the interface being used

Issues:

1.      Make sure you are close to the AP

2.      Make sure you are on the same channel as the AP

3.      You can only fake auth to networks using WEP.

4.      Make sure your –a and –h options are correct

5.      If you are using macchanger, check to see if your changed MAC is realistic.

Attack 2: Interactive Packet Replay

            Interactive Packet Replay is used to replay packets and quickly generate IVs for WEP cracking. The tool will grab a packet you want off the network and replay it back to the AP. While any packet can be replayed back, not all of them will successfully generate IVs.

            A certain packet will generate IVs on all access points. This is an ARP request packet. Because the AP sees these packets all the time, it will have no problem replaying it back. Before we successfully replay an ARP request packet we have to know what the packet entails.

            An ARP request packet has the following unique fields:

§  A broadcast destination MAC address of FF:FF:FF:FF:FF:FF

§  The packet will be traveling from a wireless client to the wired network. (the TO DS flag will be set to “1”)

To have aireplay-ng filter out these unique qualities of an ARP request packet we need to use the following options:

·        -d FF:FF:FF:FF:FF:FF

·        -t 1

Before we run this attack we need to fake authenticate first. We also need a client connected to our network to generate the initial ARP request packet. (remember we cannot generate an ARP request from our fake auth) After a successful fake auth, we can begin our packet replay. If you plan to crack the WEP key, make sure to run airodump-ng to capture the IVs you generate.

Ex.

aireplay-ng -2  –b 00:0C:41:F2:AC:F0 -d FF:FF:FF:FF:FF:FF –t 1 mon0

·        -2 will specify the interactive replay attack

·        -b is for the BSSID

·        -d is the destination MAC we are looking for

·        -t 1 will set the TO DS flag bit to 1

·        mon0 is the interface we are using

When the command is run it will look like above. If you look at the packet aireplay-ng grabbed, it is exactly what we filtered out. (try using deauth to force a client to send out an ARP request packet)

Press “y” and enter to use this packet. If you choose “no” aireplay-ng will continue to look for packets.

Aireplay-ng will begin replaying the packet you selected. The smaller the packet size, the faster you will generate IVs.

If you are having issues finding the right packet to inject, try the modified packet replay method. This method is very similar but instead of grabbing a real packet it will modify a packet to act like an ARP request packet.

Ex.

aireplay-ng -2  –b 00:0C:41:F2:AC:F0 –t 1 -d FF:FF:FF:FF:FF:FF  -p0841 mon0

·        -p 0841 will set the Frame control field to make the packet seem as though it’s being sent from a wireless client

·        See above example for explanations on the other options

Attack 3: ARP Request Replay Attack

The best way to generate new IVs is to use the ARP request replay attack. This attack is the most reliable and is the attack I prefer to use over interactive packet replay. The attack simply captures an ARP packet and automatically repeats it to the AP you specify. Because it is an ARP request packet, the AP will retransmit the packet and generate a new IV each time it does so. This allows us to capture a large amount of IVs very quickly for later WEP cracking.

This attack is used on a WEP encrypted network. It requires that you have your card in monitor mode. We need a client on the victim network for this attack to be successful because somebody needs to generate the initial ARP request packet. It is recommended that you run airodump-ng to capture the IVs you generate.

Ex.

aireplay-ng -3 –b 00:0C:41:F2:AC:F0 –h 00:23:15:99:2D:1E mon0

o   -3 specifies the ARP Request Replay Attack

o   -b is the BSSID

o   -h is the source MAC address. This address can be a connected client or our address from fake auth.

o   mon0 is the interface used

Attack 4: KoreK chopchop attack

            The KoreK chopchop attack is used to decrypt WEP encrypted packets. This attack will get the PGRA stream XOR file which is used to decrypt the WEP packets. This is often used with packetforge-ng to forge packets used for injection, but can also be used with wireshark to view decrypted packets. It is important to understand that the chopchop attack DOES NOT reveal the WEP key.

            Note that not all APs are vulnerable to this attack and that it is much slower than the fragmentation attack. However, unlike the fragmentation attack, you do not need to know any IP addresses for a successful chopchop attack.

            Before we attack, we should fake auth with the AP so the frames we send from our card are not dropped.

Ex.

aireplay-ng -4 –h 00:C0:CA:32:3D:85 –b 00:0C:41:F2:AC:F0 mon0

·        -4 specifies the chopchop attack

·        -h is the our MAC used in fake auth

·        -b is the BSSID

·        mon0 is the interface used

Aireplay-ng will begin to read packets. Once you find a packet you wish to decrypt, hit “y” to continue.

The attack can take some time. After it is complete the XOR file will be saved in the directory you launched the attack from. This XOR file can then be used with packetforge-ng and later injected.

Attack 5: Fragmentation Attack

            The fragmentation attack will also get the PGRA stream XOR file. This file is used to decrypt packets and is also necessary to create packets with packetforge-ng. This attack is often faster and more successful compared to the chopchop attack.

            This attack requires that you set the destination and source IP address. If you do not specify a source or destination IP, it will default them both to 255.255.255.255. Lucky for us, most APs will accept this as valid. Because this attack sends out a large number of packets, good signal quality with the AP is important before you start this attack.

Fake auth your card before this attack.

Ex.

aireplay-ng -5 –b 00:0C:41:F2:AC:F0 –h 00:C0:CA:32:3D:85 mon0

·        -5 chooses the fragmentation attack

·        -b is the BSSID

·        -h is your MAC from fake auth

·        mon0 is the interface used

Optional filter arguments:

·        -k set the destination IP address (default is 255.255.255.255 if unset)

·        -l set the source IP address (default is 255.255.255.255 if unset)

·        -m sets minimum packet length

·        -n sets the maximum packet length

Aireplay-ng will begin to read packets. Once you find a packet you wish to decrypt, hit “y” to continue. Remember that the smaller the packet, the faster your injection speed will be.

            This is a successful fragmentation attack. Aireplay-ng saved the output into the “fragment-01130-203902.xor” file. This file is located in your current directory and can be used later to create a packet using packetforge-ng.