WinAircrack

------------------------------------------------------------------------------- aircrack documentation ------------------------------------------------------------------------------- What is aircrack ? aircrack is a set of tools for auditing wireless networks: + airodump: 802.11 packet capture program + aireplay: 802.11 packet injection program + aircrack: static WEP and WPA-PSK key cracker + airdecap: decrypts WEP/WPA capture files It says "cygwin1.dll not found" when I start aircrack.exe. You can download this library from: http://100h.org/wlan/aircrack/. To use aircrack, drag&drop your .cap or .ivs capture file(s) over aircrack.exe. If you want to pass options to the program you'll have to start a shell (cmd.exe) and manually type the command line; there are no plans to develop a GUI for aircrack. C:\TEMP> aircrack.exe -n 64 -f 8 out1.cap out2.cap See below for a list of options. Note: you can also use Kismet .dump files for WEP cracking. Where can I download peek.dll ? Both peek.dll and peek5.sys are provided in Peek.zip. They should be put in the same directory as airodump.exe. To use airodump, you must check your hardware compatibility and install a supported driver. Where to download aircrack ? The official download location is http://www.cr0.net:8040/code/network/. However, if you can't access port 8040 for some reason, you may use this mirror instead: http://100h.org/wlan/aircrack/. Also check this WEP cracking video, and this other WPA cracking video (flash required). Is there an aircrack discussion forum ? There is no aircrack mailing-list, however you can post your bugreports and feature requests on the netstumbler Linux forum which I read quite regularly. What is the song in that WEP cracking video ? The name of the song is Moskau, performed by Dschinghis Khan. How do I crack a static WEP key ? The basic idea is to capture as much encrypted traffic as possible using airodump. Each WEP data packet has an associated 3-byte Initialization Vector (IV): after a sufficient number of data packets have been collected, run aircrack on the resulting capture file. aircrack will then perform a set of statistical attacks developped by a talented hacker named KoreK. How many IVs are required to crack WEP ? WEP cracking is not an exact science. The number of required IVs depends on the WEP key length, and it also depends on your luck. Usually, 40-bit WEP can be cracked with 300.000 IVs, and 104-bit WEP can be cracked with 1.000.000 IVs; if you're out of luck you may need two million IVs, or more. There's no way to know the WEP key length: this information is kept hidden and never announced, either in management or data packets; as a consequence, airodump can not report the WEP key length. Thus, it is recommended to run aircrack twice: when you have 250.000 IVs, start aircrack with "-n 64" to crack 40-bit WEP. Then if the key isn't found, restart aircrack (without the -n option) to crack 104-bit WEP. I can't seem to capture any IVs ! Possible reasons: + You are standing too far from the access point. + There is no traffic on the target wireless network. + There is some G traffic but you're capturing in B mode. + Something is wrong with your card (firmware problem ?) By the way, beacons are just unencrypted announcement packets. They're totally useless for WEP cracking. Why is there no Windows version of aireplay ? The PEEK driver doesn't support 802.11 packet injection. In fact, there are no windows drivers supporting injection AT ALL. And I am NOT going to write one, so don't bother asking me. Also, the PEEK driver is only compatible with Windows 2000 / XP. It will not work under Windows 9x. Is my card compatible with airodump / aireplay ? First of all, search Google to find which chipset your card has. For example, if you have a Linksys WPC54G search for "wpc54g chipset linux". +-------------------------------------------------------------------+ | | Supported by | Supported by | Supported by | | Chipset | airodump for | airodump for | aireplay for | | | Windows ? | Linux ? | Linux ? | |------------+----------------+-------------------+-----------------| | | YES (Agere | YES (patched | NO (firmware | | HermesI | driver) | orinoco driver) | corrupts the | | | | | MAC header) | |------------+----------------+-------------------+-----------------| | | | YES (HostAP or | YES (either | | | NO, but see | wlan-ng driver), | with HostAP or | | Prism2/3 | LinkFerret for | STA firmware | wlan-ng, driver | | | an alternative | 1.5.6 or newer | patching | | | | required | required) | |------------+----------------+-------------------+-----------------| | | NO, but see | YES (prism54 | YES (driver | | PrismGT | LinkFerret for | driver, FullMAC | patching | | | an alternative | cards only!) | recommended) | | | (FullMAC only) | | | |------------+----------------+-------------------+-----------------| | | YES (Atheros | YES (madwifi | YES (driver | | Atheros | driver) | driver) | patching | | | | | required) | |------------+----------------+-------------------+-----------------| | | | | YES (driver | | | YES (Realtek | YES ( | patching | | RTL8180 | driver) | rtl8180-sa2400 | required), but | | | | driver) | somewhat | | | | | unreliable | |------------+----------------+-------------------+-----------------| | | YES (Cisco | YES (airo driver, | | | Aironet | driver) | firmware 4.25.30 | NO | | | | recommended) | | |------------+----------------+-------------------+-----------------| | | | | YES (driver | | Ralink | NO | YES (rt2500 / | patching | | | | rt2570 driver) | required for | | | | | rt2570) | |------------+----------------+-------------------+-----------------| | | | PARTIAL: the | | | Centrino b | NO | ipw2100 driver | NO | | | | doesn't discard | | | | | corrupted packets | | |------------+----------------+-------------------+-----------------| | Centrino b | NO | YES (ipw2200 | NO (firmware | | /g | | driver) | drops packets) | |------------+----------------+-------------------+-----------------| | | | NO (and by the | | | Br