Aircrack and John the Ripper - Revision history

Admin: /* John-Aircrack Command */

2018-03-18T01:43:04Z

John-Aircrack Command

← Older revision		Revision as of 01:43, 18 March 2018
Line 50:		Line 50:

	<pre>		<pre>
	$ john -w=10_million_password_list_top_1000.txt --session=attack1 --stdout \| aircrack-ng -a 2 -e ASDF asdf-01.cap -l ~~HONEYPOT~~ -w -		$ john -w=10_million_password_list_top_1000.txt --session=attack1 --stdout \| aircrack-ng -a 2 -e ASDF asdf-01.cap -l HONEY.pot -w -
	</pre>		</pre>

Line 60:		Line 60:

	<code>-a 2</code>: this specifies the encryption protocol as WPA2 (can also do <code>-a wpa</code>).		<code>-a 2</code>: this specifies the encryption protocol as WPA2 (can also do <code>-a wpa</code>).

			<code>-l HONEY.pot</code> specifies that all keys should be written into the file HONEY.pot

	<code>-e ASDF</code>: this is the name of the wireless network whose WPA passphrase we're trying to crack		<code>-e ASDF</code>: this is the name of the wireless network whose WPA passphrase we're trying to crack

Admin: /* John-Aircrack Command */

2018-03-18T01:42:07Z

John-Aircrack Command

← Older revision		Revision as of 01:42, 18 March 2018
Line 50:		Line 50:

	<pre>		<pre>
	$ john -w=10_million_password_list_top_1000.txt --session=attack1 --stdout \| aircrack-ng -a 2 -e ASDF asdf-01.cap -w -		$ john -w=10_million_password_list_top_1000.txt --session=attack1 --stdout \| aircrack-ng -a 2 -e ASDF asdf-01.cap -l HONEYPOT -w -
	</pre>		</pre>

Admin: /* John-Aircrack Command */

2018-03-18T01:41:33Z

John-Aircrack Command

← Older revision		Revision as of 01:41, 18 March 2018
Line 59:		Line 59:
	<code>--stdout</code>: print all words that John would have otherwise tried itself to stdout, so that some other program can use them		<code>--stdout</code>: print all words that John would have otherwise tried itself to stdout, so that some other program can use them

	<code>-a 2</code>: this specifies the encryption protocol as WPA2		<code>-a 2</code>: this specifies the encryption protocol as WPA2 (can also do <code>-a wpa</code>).

	<code>-e ASDF</code>: this is the name of the wireless network whose WPA passphrase we're trying to crack		<code>-e ASDF</code>: this is the name of the wireless network whose WPA passphrase we're trying to crack

Admin: /* How John Works */

2018-03-18T01:37:21Z

How John Works

← Older revision		Revision as of 01:37, 18 March 2018
Line 14:		Line 14:

	==How John Works==		==How John Works==

			{{Main\|John}}

	The way we'll be using John the Ripper is as a password wordlist generator - not as a password cracker. We'll be giving John the Ripper a wordlist, and based on the options we give it at the command line, it will generate a new, longer word list with many variations based on the original wordlist. By operating John in different modes, we can get different resulting wordlists. This allows us to potentially turn a wordlist of 10,000 words into a wordlist of 8 million words (meaning, we should choose wisely: we'll either be waiting a few minutes, or a few years.)		The way we'll be using John the Ripper is as a password wordlist generator - not as a password cracker. We'll be giving John the Ripper a wordlist, and based on the options we give it at the command line, it will generate a new, longer word list with many variations based on the original wordlist. By operating John in different modes, we can get different resulting wordlists. This allows us to potentially turn a wordlist of 10,000 words into a wordlist of 8 million words (meaning, we should choose wisely: we'll either be waiting a few minutes, or a few years.)

Admin: /* Aircrack Command */

2018-03-18T01:36:52Z

Aircrack Command

← Older revision		Revision as of 01:36, 18 March 2018
Line 33:		Line 33:
	</pre>		</pre>

	(where <code>-a 2</code> means attack mode 2, or wpa, <code>-e ASDF</code> narrows down the keys being cracked to one in particular, and <code>-w my_wordlist.list</code> is the wordlist. We can specify ~~stdout~~ by ~~saying~~:		(where <code>-a 2</code> means attack mode 2, or wpa, <code>-e ASDF</code> narrows down the keys being cracked to one in particular, and <code>-w my_wordlist.list</code> is the wordlist.)

			We can specify that the list of passwords will come from stdin by using:

	<pre>		<pre>
Line 39:		Line 41:
	</pre>		</pre>

	Now, we~~'ve got~~ John the Ripper ~~instead~~ of a ~~word~~ list~~. So we can connect these two commands using this trick~~.		Now, we can pipe the output of John the Ripper (which will generate lots and lots of passwords from a list) into aircrack (which tests each password against the WPA key).

	==John-Aircrack Command==		==John-Aircrack Command==

Admin: /* File Formats */

2016-08-18T19:52:21Z

File Formats

← Older revision		Revision as of 19:52, 18 August 2016
Line 423:		Line 423:
	When using John and Aircrack, there are lots of different file formats floating around. Here's a rundown of how to convert which to what.		When using John and Aircrack, there are lots of different file formats floating around. Here's a rundown of how to convert which to what.

	==hccap ~~to john~~==		==cap to hccap==

	hccap is short for hashcat cap file, it is a file type that can contain WPA handshakes. It's also a convenient intermediary format between John and Aircrack. Use the hccap2john utility to convert an hccap file to a john hash file:

	~~<pre>~~
	~~$ hccap2john capture.hccap > hash.johnpw~~
	~~</pre>~~

	~~Now you~~ can ~~crack it with~~ John:		To convert cap files (the normal output file format used by airodump) to hccap files (an intermediary that can be turned into a John hash file), use the cap2hccap utility:

	<pre>		<pre>
	$ ~~john hash~~.~~johnpw~~		$ ./cap2hccap.bin /path/to/my.cap my.hccap
	</pre>		</pre>

Line 445:		Line 439:
	<pre>		<pre>
	$ aircrack-ng -J new.hccap original.ivs # create .hccap file from original .ivs file(s).		$ aircrack-ng -J new.hccap original.ivs # create .hccap file from original .ivs file(s).
	$ hccap2john ~~new~~.hccap > hash.johnpw		</pre>

			==hccap to john==

			hccap is short for hashcat cap file, it is a file type that can contain WPA handshakes. It's also a convenient intermediary format between John and Aircrack. Use the hccap2john utility to convert an hccap file to a john hash file:

			<pre>
			$ hccap2john capture.hccap > hash.johnpw
	</pre>		</pre>

Line 453:		Line 454:
	$ john hash.johnpw		$ john hash.johnpw
	</pre>		</pre>



	=Flags=		=Flags=

Admin: /* Logging */

2016-08-18T19:50:08Z

Logging

← Older revision		Revision as of 19:50, 18 August 2016
Line 267:		Line 267:

	Now if we want to add logging to our fabfile, we just include those statements above.		Now if we want to add logging to our fabfile, we just include those statements above.

			==Sending Aircrack Output to File (VERY IMPORTANT)==

			One of the problems I was having when using the one-liner with everything piped to everything else was, the output was messed up with <code>screen</code> and I couldn't see what the key was once it had been cracked.

			We can save ourselves this headache by using the <code>-l [filename]</code> flag to write the key to a file.

			Checking for the existence of this file will also give us a convenient method to check if a wireless network has been successfully cracked.

	==Putting It All Together==		==Putting It All Together==

Admin: /* Sending Aircrack Output to File */

2016-08-18T19:49:36Z

Sending Aircrack Output to File

← Older revision		Revision as of 19:49, 18 August 2016
Line 255:		Line 255:

	Loooooots of good info on improving on john's rules, particularly if you're cracking lots of passwords and you want to improve your search methodology as you go:: https://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf		Loooooots of good info on improving on john's rules, particularly if you're cracking lots of passwords and you want to improve your search methodology as you go:: https://www.owasp.org/images/a/af/2011-Supercharged-Slides-Redman-OWASP-Feb.pdf

	~~==Sending Aircrack Output to File==~~

	One of the problems I was having when using the one-liner with everything piped to everything else was, the output was messed up with <code>screen</code> and I couldn't see what the key was once it had been cracked.

	~~We can save ourselves this headache by using the <code>-l [filename]</code> flag to write the key to a file.~~

	~~Checking for the existence of this file will also give us a convenient method to check if a wireless network has been successfully cracked.~~

	==Logging==		==Logging==

Admin: /* Putting It All Together */

2016-08-18T19:48:13Z

Putting It All Together

← Older revision		Revision as of 19:48, 18 August 2016
Line 419:		Line 419:


			=File Formats=

			When using John and Aircrack, there are lots of different file formats floating around. Here's a rundown of how to convert which to what.

			==hccap to john==

			hccap is short for hashcat cap file, it is a file type that can contain WPA handshakes. It's also a convenient intermediary format between John and Aircrack. Use the hccap2john utility to convert an hccap file to a john hash file:

			<pre>
			$ hccap2john capture.hccap > hash.johnpw
			</pre>

			Now you can crack it with John:

			<pre>
			$ john hash.johnpw
			</pre>

			==ivs to hccap==

			ivs file version 1 only holds WEP information, but ivs file version 2 holds WPA information as well.

			You can convert an ivs to an hccap using the aircrack <code>-J</code> flag:

			<pre>
			$ aircrack-ng -J new.hccap original.ivs # create .hccap file from original .ivs file(s).
			$ hccap2john new.hccap > hash.johnpw
			</pre>

			Now you can crack it with John:

			<pre>
			$ john hash.johnpw
			</pre>



			=Flags=

	[[Category:Kali]]		[[Category:Kali]]

Admin: /* Scripting with Bash */

2016-03-28T06:17:49Z

Scripting with Bash

← Older revision		Revision as of 06:17, 28 March 2016
Line 103:		Line 103:
	Aircrack's main/default interface is NOT scripting-friendly (example: when you run aircrack on a capture file, and it finds a matching passphrase, it prints the result to the screen - but it doesn't save it to a file. Inexplicably. So if you accidentally close your window after ten days of cranking away, then, too bad, I guess?!?)		Aircrack's main/default interface is NOT scripting-friendly (example: when you run aircrack on a capture file, and it finds a matching passphrase, it prints the result to the screen - but it doesn't save it to a file. Inexplicably. So if you accidentally close your window after ten days of cranking away, then, too bad, I guess?!?)

	~~Fixing~~ this:		Fix this by using the <code>-l [filename]</code> flag. That's the dash L as in log.

	~~Create bash arrays with wordlists~~		Use the -l [filename] flag to write the key to a file.

	Create John the Ripper commands		Make everything more script friendly by writing fancy Bash scripts that do the following:
			* Create bash arrays with wordlists
	Run through all of these with bash array for loops		* Create John the Ripper commands
			* Run through all of these with bash array for loops

	=Scripting with Python=		=Scripting with Python=