Network encryption cracking is the breaching of network encryptions (e.g., WEP, WPA, ...), usually through the use of a special encryption cracking software. It may be done through a range of attacks (active and passive) including injecting traffic, decrypting traffic, and dictionary-based attacks.
Contents
Methods
As mentioned above, several types of attacks are possible. More precisely they are:
Injecting traffic
Injecting traffic means inserting forged encrypted messages into the network. It may be done if either the key is known (to generate new messages), or if the key is not known and only an encrypted message and plaintext message is gathered, through comparison of the two. Programs able to do the latter are Aireplay and WepWedgie.
Decrypting
Decryption often requires 2 tools; 1 for gathering packets and another for analysing the packet and determining the key. Gathering packets may be done through tools such as WireShark or Prismdump and cracking may be done through tools such as WEPCrack, AirSnort, AirCrack, and WEPLab.
When gathering packets, often a great amount of them are required to perform cracking. Depending on the attack used, 5-16 million frames may be required. The attack command itself, however, is surprisingly simple.
WEPCrack
Commands to be inputted into WEPCrack are:
perl progra~1wepcrackpcap-getIV.pl
This command generates a log-file (ivfile.log) from a captured packet obtained by WireShark or prismdump A packet with at least 5 million frames is required.
perl progra~1wepcrackwepcrack.pl ivfile.log
This command asks WEPCrack to determine the key from the log file.
AirCrack
Aircrack is another program that's even simpler to use, as no command need to be entered; instead the user is asked to type in some parameters and click some buttons.
First airodump is started to gather the packets; herefore channel and MAC-filter are asked, yet the user does not need to know them per se (instead 0 and p may be inputted respectively). Then, AirCrack is started, the file just created by airodump is accessed, a 0 needs to be entered and the program determines the key.
AirSnort
AirSnort is an even simpler program, as it is completely interface-based. As the attack is only a simple brute-force attack however, cracking the encryption can take a while (from several days to a few weeks). Especially if traffic is low (only 4 users or so on network, the cracking will take at least 2 weeks).
Comparison of tools
A comparison of the tools noted above may be found at Security Focus.