直接搞定WPA和WPA2 无线密码P解工具

chinajack

coWPAtty for Windows MAIN:

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

6 c$ U% y" T; `2 ^9 K* K

Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

coWPAtty Dictionary Attack

Precomputing WPA PMK to crack WPA PSK

5 D+ `( h2 H2 m) p1 {

coWPAtty Precomputed WPA Attack

- n- F$ e2 f% i

coWPAtty Recomputed WPA2 Attack

9 {% k# Q6 u- K* e

coWPAtty Tables

coWPAtty Usage:
2 J. A4 p1 U- n2 R4 D% }8 ~
* N1 A$ V" M, X! q6 A/ [6 T
3 U% r# {& M2 b3 y8 l% T2 ^coWPAtty Dictionary Attack:

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

4 j( E+ `( [' {6 n4 U

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

* c5 f1 A1 e; A5 [6 j  s

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

2 P+ W2 M+ Y- }7 G* p( {9 u

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

. k% h+ @& s" X" \

wpapsk-linksys.dump is the capture containing the four-way handshake

: T4 l  j. \/ ?+ S& w1 ^* M7 f

dict is the password file

linksys is the network SSID

Precomputing WPA PMK to crack WPA PSK:

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

So to generate some hash files for a network using the SSID cuckoo we use:

+ j# o: v% I* ^1 L$ [

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

! B2 O" u1 ?- K% X- R, V$ F2 z6 }
( d+ S+ P; h$ Z" D7 j4 D3 ~

dict is the password file

# w' K7 w6 H$ p7 A1 h4 l

linksys.hashfile is our output file

linksys is the network ESSID

6 N3 i6 o8 O7 S* q, KcoWPAtty Precomputed WPA Attack:

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

9 Q9 V4 @6 u* Z

cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

  ]+ }9 j2 S5 a* v/ B$ |' [/ p

wpa-test-01.cap is the capture containing the four-way handshake

" d: m' j3 i; @% B. C; t

linksys.hashfile are our precomputed hashes

0 y6 P) j1 z# j

linksys is the network ESSID

6 I- D9 G+ b+ C% L! y
. b1 s" o" s4 q

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

' M3 s5 p) R. p, I. |2 ]' k8 ?coWPAtty Precomputed WPA2 Attack:

coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

3 C4 _) v. H5 `  p$ g

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

/ v  S- e! G6 p7 X: D* R

& s9 M  R3 h7 s! n- p$ r( x+ s

wpa2psk-linksys.dump is the capture containing the four-way handshake

dict is the password file

% }( ^. U7 e/ q6 D4 l

linksys is the network SSID

coWPAtty Tables:
The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:

http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19

A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/
& M* N- y+ S8 _! H; \9 z  W
$ @8 a! D/ i; NOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
; P/ H& w+ E3 F0 u' r$ s

ivwsiqny

上当了？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？

hfbm

这么贵  不买

bo936239

这么贵 。。。。。。。。。。。。。

bo936239

直接搞定WPA和WPA2 无线密码破解工具

bo936239

是不是真的。。。。。。。。。。。

simon310

什么都没说

ljd8112

fytytfytfyufyu

ljd8112

bjhgyugyugvuyg

ljd8112

bjhbuvgcyctrftxrezsrefdxfj

ljd8112

ujbvugiugigohgiuhgiu

ckc1208

劳动成果，应该尊重，付款吧！！