直接搞定WPA和WPA2 无线密码P解工具

chinajack

coWPAtty for Windows MAIN:

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
1 E4 T0 p( p$ b4 }8 `: O

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

8 b6 ~3 ?7 z7 t! _3 z6 |  S
5 m3 V. J+ l2 S! d

Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6

' t8 e% K# k" X/ G
& S+ ]  \' K* L2 ~

coWPAtty Dictionary Attack

3 B$ F' V! _) R( Y' a" t" f5 q1 G$ v

Precomputing WPA PMK to crack WPA PSK

# i# _! q# C; a2 z+ K, G$ j9 U+ C3 E

coWPAtty Precomputed WPA Attack

coWPAtty Recomputed WPA2 Attack

coWPAtty Tables

coWPAtty Usage:
/ @4 q3 ^8 J! u. h& ]1 {( @" k
; \  c, C( r3 i) i* z; m6 n( J/ ^
, V5 Y1 R& i* D( h0 DcoWPAtty Dictionary Attack:

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

  }1 D3 K6 ^' E- X* x$ e8 _

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

& G: Y. z0 w0 \0 H% X4 K+ e

cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

! v7 s; U9 M) ~5 H3 V# P

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

2 P3 r5 G* s5 f3 W5 Y, I/ _

wpapsk-linksys.dump is the capture containing the four-way handshake

# A1 q; d2 Q0 K$ Y% g4 o6 @! `

dict is the password file

linksys is the network SSID

; T! k0 l9 Q4 KPrecomputing WPA PMK to crack WPA PSK:
' u/ ^: B$ G) d- d# R, s1 E0 ]5 j

genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

So to generate some hash files for a network using the SSID cuckoo we use:

+ z% U0 b2 W! u
4 Y, r8 A* H" E" d

genpmk  -f  dict  -d linksys.hashfile  -s linksys  

: b3 A9 a* O; ?

; e% R0 [1 y* q$ n7 A! O

dict is the password file

linksys.hashfile is our output file

linksys is the network ESSID

$ r! t# E+ w9 q4 Z8 P. ScoWPAtty Precomputed WPA Attack:
/ x: S: G' j) f# Q! c. x! e* g

Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

, `4 [' H: s2 Q7 H& S) M* V' i

cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

4 Q7 G4 ~& o% g% q/ q

# o! j. D. B# j( v

wpa-test-01.cap is the capture containing the four-way handshake

linksys.hashfile are our precomputed hashes

linksys is the network ESSID

, k3 ]7 m: C$ r) c

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

coWPAtty Precomputed WPA2 Attack:
) N0 {& r$ u  y( b9 {

coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

4 X; }" {6 J, _- D( |, S

wpa2psk-linksys.dump is the capture containing the four-way handshake

- d  M3 u$ L4 q# h

dict is the password file

4 E; S+ O& T5 R- |6 j

linksys is the network SSID

  _" b) ~' Q" q& e1 U2 G  D+ McoWPAtty Tables:
; i& g" A- v0 D5 L6 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
. ]/ h( X6 N! g7 U3 \4 e+ l$ h; ~
% [$ w" c1 t! b, S0 `http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19

A 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/

! }! Y7 m$ Z& m% Q# s( lOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
' p6 O) K5 L9 w* ^: s

ivwsiqny

上当了？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？？

hfbm

这么贵  不买

bo936239

这么贵 。。。。。。。。。。。。。

bo936239

直接搞定WPA和WPA2 无线密码破解工具

bo936239

是不是真的。。。。。。。。。。。

simon310

什么都没说

ljd8112

fytytfytfyufyu

ljd8112

bjhgyugyugvuyg

ljd8112

bjhbuvgcyctrftxrezsrefdxfj

ljd8112

ujbvugiugigohgiuhgiu

ckc1208

劳动成果，应该尊重，付款吧！！