coWPAtty for Windows MAIN:" c# [' V" W5 W: S0 @- t+ L- A" K
3 y& }% N; W2 b1 c"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright. ! j4 _$ I9 I$ ~6 {, C, a
7 N! B* J9 d7 ]# ?8 k* Z, C
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html
/ x/ @. F/ z2 d7 G; s3 l* D) d
7 {4 K% j& u, O0 Z/ r+ V% x* X* u& b. U
+ c& g7 a9 F- k" o; O+ E/ cLocal Mirror: Cowpatty-4.0-win32.zip MD5: aa9ead2aacfcc493da3684351425d4c6
9 b3 @4 E& O' [: O7 [7 W/ B+ R5 ]3 f% o
' u8 t9 G) I5 T @9 j& N9 m X8 ^
coWPAtty Dictionary Attack
7 S% L: L! ~8 R; ~7 h4 W' N$ U0 v0 j Precomputing WPA PMK to crack WPA PSK
9 F2 l/ O. G8 y" O X
- F% P/ E$ w7 Q$ e7 b- j coWPAtty Precomputed WPA Attack
; i, y# U4 E4 B; k$ d7 \( i- h8 s
coWPAtty Recomputed WPA2 Attack
$ C( N7 |* e# d. k
) G' s" @) o* jcoWPAtty Tables
$ c& p# j% c# u0 a5 H# L5 S+ [: [- K- w- b! [$ Y8 ? n4 CcoWPAtty Usage:" l' Q1 y& _/ ]; a, B. K
8 V- _9 ]& y1 C& o
5 V! ~) Y/ b2 T- G1 @
, s1 \ b; Z- c- G% a' d8 g* d6 s' \ R# D
- h: P4 C u. G$ u0 h }/ TcoWPAtty Dictionary Attack:& G2 O; d, Z! ?% u) G+ p6 X1 O9 s, E
9 a, {2 P& p m( @ Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
& H: D z! H9 ]) z9 g1 _6 x5 V$ c, m) e: q+ k# @% d In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
0 u' ]8 p( o- ~% F; \1 z; Y$ Q; @& B7 o
' f4 I" j5 t9 C7 O" @9 h/ Xcowpatty -f dict -r wpapsk-linksys.dump -s linksys
' e! ?0 H5 D0 @# p, t% ]% i# x4 t4 \
3 _& H1 X/ P N& ^" Z O, g% \$ B0 p. o* d/ z
; @3 b+ g4 a/ X
, S: ^' f$ N( z, M6 d. m
6 f3 J9 W9 }: N5 T. h5 ^/ s! d; M- }' H" q! g% M/ v% a% e
) `5 |$ F! s6 Q. t( fAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
, M+ W6 X7 x2 \7 F* Y( K0 F# p/ S
! B6 Q3 U7 l* y9 rwpapsk-linksys.dump is the capture containing the four-way handshake
1 G4 P# A/ r" Z# c8 y$ j& x; t0 E7 M" q/ h- S) v5 u, s+ ~1 v# e
dict is the password file
B& R( A8 E) j5 \
( |/ W! k; b+ I( a* I1 U. Hlinksys is the network SSID
& b, @' m2 p4 p4 ^1 @6 C; @2 V
0 C" p! s: y4 w4 K2 o- l; |7 Q& r3 f: [" z; k3 X6 T3 Z
" g9 p; l$ L o8 W& bPrecomputing WPA PMK to crack WPA PSK:& ?( q1 a- w9 ?+ R, ^4 }& y8 k& Z' [
j; ]) g& I1 J9 |' w; `3 Agenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks. There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash. This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
3 g( t: y. w2 B1 A* e0 k5 j/ J; c% [+ H( w8 i8 z5 ]' V4 E2 p; p1 q8 c! u! u7 _, R/ u: K0 j1 N
So to generate some hash files for a network using the SSID cuckoo we use:
3 ~: Z! Q. |$ b/ u2 [& |! Y
. \# A: V" ~4 h' k" X+ q2 X$ n* e0 x' C) z* Z- [0 b. D4 w. D! O
genpmk -f dict -d linksys.hashfile -s linksys
" e: r5 S, a8 M1 L
) I* v, F$ a% K' A3 v+ t9 o. E5 B7 L* M8 [
( E: Q' u1 `( T( K g( ~0 A 
7 ]* i9 Z1 G2 _7 \
' t- \0 G7 ~* y# s! Y. s+ H8 `, i2 {: ~
# p& P# X. l% w6 A7 ^dict is the password file
$ u! {* J: _; d0 ]
. }$ G7 _4 j2 |linksys.hashfile is our output file
: L! Z: H; n& [, G, w. g% F" u( X V' o+ `9 `; P linksys is the network ESSID
& i$ { w' A" Y+ t" v8 X; L7 M: j4 E; n! n9 I4 z# l. N: E5 X, X1 |+ b( P. O( b
+ k- Y U4 X% s* H7 k# v0 PcoWPAtty Precomputed WPA Attack:4 z7 T. n" N& j p5 E1 G! A3 g
' s; q) E) K$ I5 ?' z/ j" J8 |* iNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo. Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
8 @ f& i$ s1 l+ \; n
3 [! w& _. C4 d* z; n( Z' W) n7 _ A) X$ P: B2 N( [. j5 @5 P: L6 ^& A& j- L
cowpatty -d linksys.hashfile -r wpapsk-linksys.dump -s linksys
% A! ^' r& J: V5 |5 @3 y( y. w8 {, G( v' j# c8 G! n3 L! ? 
6 i; c! q* X: V$ \0 I
$ }6 G8 b) O& W e5 U6 K% G$ z3 ]4 e" V5 \8 f2 ^9 d0 A+ P2 r8 }0 N4 Z6 D1 Q( Q0 f3 o
wpa-test-01.cap is the capture containing the four-way handshake
" E6 p! A+ A; d! r% Q0 g. U
) h0 T) X8 j# m linksys.hashfile are our precomputed hashes
8 O: c' o8 `) t9 C9 P( h+ }
/ N( I! Y% d7 e, s linksys is the network ESSID
7 r! r& ?$ D& r: }. A* ~
2 p4 |/ D2 Z2 g1 T6 ~, d/ K: u. o3 D- S7 K* ]: }# u0 Z& x0 N2 T6 \ t. W* j
Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack. However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
! b) [+ S9 C0 ^6 Z8 S: p
8 W& s, p' @& z Y$ j6 \" y: o' k* F t
# `. W7 b$ h- v' ?3 z1 ccoWPAtty Precomputed WPA2 Attack:- d( ^7 X: ~* l+ ]0 B
+ e% Z# p/ u9 i, t4 NcoWPAtty4.0 is also capable of attacking WPA2 captures. Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
3 u+ T4 A. T% z" h% X+ ]& j9 d3 ^+ Y3 p: {; P& A cowpatty -d linksys.hashfile -r wpa2psk-linksys.dump -s linksys
9 [% k: R, @) j
3 v0 F1 M' Z4 k# ~ 
3 y8 E" u [6 T4 X, N) Q0 |3 t. r2 P. n: c& ]4 u
0 Z6 Y6 X }' ~3 Q+ I: Q& W7 S
9 N* U- [" ~# J6 ], c& k7 A+ g wpa2psk-linksys.dump is the capture containing the four-way handshake
# x3 ^" M- i8 d& Q/ j. |4 O- o: ^4 }! m. ~ dict is the password file
, i" }* G1 u6 X- |2 k2 v1 {3 V! b% U0 ?+ Y% O linksys is the network SSID
]/ t N9 Y( E) _: e b0 _/ q1 A
6 j5 A& S+ j* P9 s) d1 \
2 p: u# A. s! q5 m3 A8 G( w5 l: v9 t6 @# J' Y. P7 t* G, X6 `/ LcoWPAtty Tables:
& u+ C6 f# }. |# m# S7 ~8 ?! h5 l% \6 E, G3 `" n9 g1 i( ?- AThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file. The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
5 X# }) j# U0 E/ B* y3 x* G( w0 `+ d& ~3 Z p9 A: H8 d8 ?% c- `& w& B& X' X! y: M, c) o8 y
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
# Y% [+ _7 D) ?4 ~2 K9 `" L& E+ T$ x, r& g4 S9 Q6 H6 y# _! P3 J% n
; Z! Z( \$ ~3 ]( d- d1 `! q8 OA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/$ d5 C" P* g$ p! D, i8 a5 y" \% J$ L& g2 V. F! L
2 U8 N; C" n% \4 j1 N8 u) d+ W% V' ?2 W% rOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
[复制链接]
IP卡
狗仔卡
发表于 2010-3-19 18:39
显身卡
{:2_31:} {:3_47:} 上当了，全是鸟文！