Before you can start crack­ing some Wire­less AP, you need some preparation:

Win­dows:

You need to switch your WLAN Card into mon­i­tor mode. The reg­u­lar Win­dows dri­vers pro­vided by the man­u­fac­turer will NOT sup­port this fea­ture. You need spe­cial dri­vers. Wildpackets.com pro­vides those dri­vers for free, but only for a lim­ited range of Cards. Check their web­site for sup­ported Hard­ware. After you installed those dri­vers, you can use Airo­dump. There is one draw­back for the Win­dows plat­form, no packet injec­tion is sup­ported. There are some com­mer­cial tools avail­able, but (I think) the need a spe­cial dri­ver too, so for­get it. You need some addi­tional Files to run Airo­dump, peek.dll and peek5.sys, avail­able from wildpackets.com. Down­load the eval­u­a­tion ver­sion of AiroPeek NX and install it, there you’ll find those 2 files. Be aware that the Win­dows ver­sion of Airo­dump is no 100% sta­ble, from time to time, if you close Airo­dump, peek5.sys cre­ate a BSOD, the rea­son is still unknown. And don’t put your lap­top into sleep­ing mode while Airo­dump is run­ning, as you will get a BSOD as well! To run Air­crack you need this file: cygwin1.dll. The eas­i­est way to get the peek files is, visit this link.

VMWare for Win­dows:
It *should* work but only with USB-Wireless NIC’s. This is due a VMWare lim­i­ta­tion, which doesn’t allow direct HW access. Your PC-Card would be mapped as a reg­u­lar NIC. I can’t test this, as I don’t own a USB Wire­less NIC.

Linux:
The eas­i­est way is to use a live dis­tri­b­u­tion like Audi­tor or Back­Track. Those dis­tri­b­u­tions are bootable from CD and packed with all the tools and dri­vers you need. I’m using the Proxim Orinoco Card 8480-WD, to set this card into the mon­i­tor mode, you need the mad­wifi dri­ver (Audi­tor 2.0 for exam­ple use the dri­ver ath_pci and this dri­ver does not sup­port mon­i­tor mode). As you can see, it’s not that sim­ple. Check this site for a com­plete list­ing of WLAN Adapter Chipset Direc­tory (ok a bit out­dated…). Get the Back­Track disto from here.

To crack a WEP Key, you need to col­lect a lot of IV’s. The Air­crack readme pro­vided those next lines:

How do I crack a sta­tic WEP key?
The basic idea is to cap­ture as much encrypted traf­fic as pos­si­ble using Airo­dump. Each WEP data packet has an asso­ci­ated 3-byte Ini­tial­iza­tion Vec­tor (IV): after a suf­fi­cient num­ber of data pack­ets have been col­lected, run Air­crack on the result­ing cap­ture file.

How many IVs are required to crack WEP?
WEP crack­ing is not an exact sci­ence. The num­ber of required IVs depends on the WEP key length, and it also depends on your luck. Usu­ally, 40-bit WEP can be cracked with 300.000 IVs, and 104-bit WEP can be cracked with 1.000.000 IVs; if you’re out of luck you may need two mil­lion IVs, or more.

Now we fire up Airo­dump to col­lect those IV’s:

Win­dows:
Start “airdump.exe”, select the right driver.

Exam­ple output:

Linux:
Set the Wire­less NIC into mon­i­tor mode. I use ath0 as my Wire­less card, replace this with your card.
# airmon.sh start ath0 0
Now start airo­dump. airo­dump <NIC> <FILENAME> <CHANNEL>. If you use 0 for the chan­nel, all chan­nels will be scanned. Here an exam­ple:
# airo­dump ath0 out 0

depend­ing on your dis­tri­b­u­tion you need another com­mand to set the card into mon­i­tor mode:
#iwpriv ath0 mon­i­tor 2 1      (enables mon­i­tor mode)
#iwpriv ath0 mon­i­tor 0 1      (dis­ables mon­i­tor mode)

Now wait until you col­lected about 900’000 IV’s. If there’s no traf­fic on the AP, no IV’s will be trans­mit­ted. You can gen­er­ate traf­fic by using Aire­play. More about this later.

Start Air­crack to get the WEP Key:
> air­crack –a 1 out.ivs –w /path/to/wordlist
select the BSSID you want to crack and wait.

If you suc­ceeded logon to the AP:

Linux:

#iwcon­fig ath0 mode man­aged key 00:11:22:.… essid ESSID chan­nel 11
#ipcon­fig ath0 up
get ip adress via dhcp
# dhcpcd ath0

Fake the mac address:

Win­dows:
Use Mac­shift tool to change you mac address:
> mac­shift 001122334455 –i “Wire­less Net­work Con­nec­tion 2″
Orig­i­nal Mac­shift Web-site here.

Linux:
#ifcon­fig ath0 down
#ifcon­fig ath0 hw ether 00:11:22:33:44:55
#ifcon­fig ath0 up

In the next arti­cle we will inject some pack­ets to speed up the whole process. And a WPA-PSK crack we’ll show you as well..