直接搞定WPA和WPA2 无线密码P解工具

怡佳

谢谢楼主 分享

speaks

有用吗？用过的说说

cdl_1

不懂用，太贵了！！！

LeeTien

不管好不好，先鄙视下楼主
我不会下的

encle

真的有这么神奇的工具么？这个要学习一下了。

huoyuan

没钱啦。。。

regweb

不是吧  这么贵

sadamu9527

呵呵     ，妈的全是EN

sadamu9527

能不能有用啊。呵呵

ghc00259

coWPAtty for Windows MAIN:
* d- G. a$ H. W
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
, v& T. o3 E0 [) J8 m. k8 r1 [1 Y/ _
9 o  ?" Z9 _" R) j
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html


4 z4 ^+ c9 b5 v  F, G" N
5 M# f! j( s! F: J+ q* M9 @0 l# y( z0 X$ U+ C/ S. y1 A
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6


8 E$ l4 M& W  f1 E! B- }' e/ g; r! ]6 V6 [: u2 Q  M! G& L6 F
4 C9 }4 Q$ |. P. H4 f
6 t( m( D4 N8 icoWPAtty Dictionary Attack

; ]* i- B9 ^( @$ W- @6 F9 Q: v) |+ G4 z6 y9 O

Precomputing WPA PMK to crack WPA PSK

8 L  @* c$ r1 y  V

5 d5 T% ~8 G" S! C5 Z2 |coWPAtty Precomputed WPA Attack
& P' u& W1 _) G! F8 d" M; v
* f: K3 k3 C% I9 h/ ~
, r0 |2 h4 X+ S9 A
# g5 M, s9 N0 {5 wcoWPAtty Recomputed WPA2 Attack


# p5 ]+ Y8 o' o( A% P8 ?, G# K- [" ^( b3 O- G% L( _6 }2 V+ L% V2 M8 I7 v, s* z
( N7 L3 H4 T3 |+ j4 _3 R# ucoWPAtty Tables
+ C/ j+ u# }6 W" |( d
  J  Z6 w0 w* B6 l! i: K
coWPAtty Usage:
8 K. k7 M8 N: D) g% G- L! P/ i* _1 j; a3 c
3 t) z% k- i/ d& D ( z+ A& s, x0 t( m- d- R
coWPAtty Dictionary Attack:: u, g: R' Q( j- T5 Y  i1 O1 g2 T

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
$ }1 @, m0 A# C" k
7 u7 l' g+ d7 G" ^' W" b9 P) F( S2 I3 h0 x/ j. y2 Z' {% b

0 {: s' T6 X! [+ \1 ^! {; ~In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

. c2 z1 S) z3 X5 P1 d" ~) `/ x& L0 O1 M  v6 V* g9 j, e3 Y% k* k

8 B8 L! O; G+ u7 W" _cowpatty -f dict -r wpapsk-linksys.dump  -s linksys
% \4 B$ D! j! Z' q4 C% t4 O. l

5 U6 f) y' N! }3 L2 E0 d
9 x  t3 n3 s' e1 r, b% J% I  _
8 j" O. D0 F( w3 }$ p/ r" Q" o# n( r# M: {
% O: c0 A: Y  b0 J; ]( m9 U, S1 e2 y" L6 F+ }' F0 v: Q6 y
. `+ u) [, Q0 Y/ p
As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
9 ?! T8 Z6 L& z, Z; N0 H# P# g; q
" ]4 J$ i- @; I, n/ t* a$ O
! M# {. Z! t7 Z8 D: @; x* X/ J; M
wpapsk-linksys.dump is the capture containing the four-way handshake
) y6 V0 c+ Z( Y3 l7 |
0 N. I5 h9 e" V/ f  T

% O, k% \: F- p  L9 W9 ^* ?  bdict is the password file

, ~) W: L! d6 I& f' h5 w9 K. g) ?

1 Y- q2 x) n; G) z1 B; f; }3 s$ L  nlinksys is the network SSID

& o( F+ o) R8 Z7 q3 p
# J2 _* M* w' T0 y) n( c6 J8 W' V& W2 D; {# f7 H  Z. m% @4 y6 r- `( c* R* e( I
, [& |! m# [( H/ uPrecomputing WPA PMK to crack WPA PSK:
. ^% z1 ^) f3 h/ M: {" Q
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.


7 N7 D: \3 T: U1 S9 u+ X# o5 Y  I0 x* \4 |1 f! b3 g! F) ?& X# n2 M  _
6 ?/ X- C7 ?  I' t7 ?/ f
" V9 ]( [. ]9 zSo to generate some hash files for a network using the SSID cuckoo we use:
. C  n+ s, {, t# ^2 |# K' b( z
' _( S5 y# d% q; n8 e. {2 I  j' Q0 Z6 e, W; l' Y
. \4 F3 {  l% Z9 i# w% L0 a
8 t; J: I( l% B6 C
genpmk  -f  dict  -d linksys.hashfile  -s linksys  

8 M4 z7 x0 S( b3 I- F. P# |( F
. O3 F# M4 ^  i3 s
% ]" X1 i- c9 H+ z: t: {0 L  m& V- ?2 i8 E  ]3 Y. R4 Q0 N3 |6 ?0 Z
4 K+ S0 w( x( x, G2 S- H: y& n
# o2 y/ T  C1 ?8 @; _0 g

* |* S  j: `# [5 m" k/ ?7 H) f& S
- M9 }" }( p5 W. ~) h: p1 F( c$ E, W  ?* s6 Y
6 }$ S* _1 E/ }4 Jdict is the password file
+ V5 c9 ^0 F1 L' ?$ j6 E  Z
1 v! Q. v1 \4 H/ j# W% ^1 y) G
3 [6 A' B( S7 q7 E8 r
9 ]0 O) t8 R1 o4 n( dlinksys.hashfile is our output file
2 V5 }( S) I6 l- H" L; `5 A
9 C1 `0 I$ m; E; |
5 v" _4 z0 @& O7 e
linksys is the network ESSID
8 y/ D+ \1 x4 @5 L$ m6 c/ X

6 v6 {7 b0 b5 H' {* S; ^4 B
) v& L8 w( Z8 j  L, i( P8 a% S% `0 r5 r( XcoWPAtty Precomputed WPA Attack:# ?/ x) d2 _& C+ W/ i

- v, g4 N5 U& T7 |6 }# aNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
& Q6 Q1 M4 x' }* m8 o$ l! H
) \4 [9 T) U- X% H6 _' D- C; O& V5 M3 m" r/ l3 a2 G; @+ I# A1 Q
7 K6 G8 m4 S4 x9 @3 v/ G0 K; o" p/ Z+ I5 u+ @! H
0 d, `' G$ g! L* h4 a( |4 q
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

* M' E! \: o2 L: }( J+ {# d  \& b( s, m, N
( n. M/ l5 o& \7 [
& P1 W* q$ W( Y- F! {

& R1 V1 X  u4 A# O

# }( e$ }9 ?( M' |! ]9 l
8 z5 c' K3 S* o% \4 U& K' n: H" Swpa-test-01.cap is the capture containing the four-way handshake
2 ^0 @+ f/ m; k& I
. {  e2 R  w8 A3 n% x7 S% K
3 l+ r1 F2 t7 F6 }
1 h1 i) r( s1 m* S/ }3 Q; Mlinksys.hashfile are our precomputed hashes
* T5 H3 y, Q; J
8 K, t) I" z) U0 g3 v0 ]! A: l$ M: G
; e- M" y* t# g+ i
linksys is the network ESSID

+ H! o  [1 |3 a8 E8 y0 l& e
+ y4 ]9 w% u" d' N: d' S. H) h
# w) ?( }2 j( u# n9 x
* u" g7 D2 N) _, L9 u& c0 DNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

" k& a: p/ u. L4 |* C0 e
8 v& Z8 b. G4 m1 z4 O: }- l$ l- F$ O* _$ C3 _
( h# u% C) @! {coWPAtty Precomputed WPA2 Attack:
0 P$ y5 O0 Z3 d
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

2 M  Q! _0 b) f( g8 L- W9 m7 }. Z' Q! B1 S

cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys
# M9 g# }$ A% p8 f

/ L( x% N8 d% i4 Q6 O4 e8 e; G* X9 x' b# N3 J$ o* S


. C1 G+ o% ?9 W. \) V) V3 e# h: S0 |6 {$ p$ h6 _3 }8 ?/ U4 W
2 T! f7 x% e1 c8 w% g6 _# a! f  X( K1 ?

wpa2psk-linksys.dump is the capture containing the four-way handshake
+ w4 j0 B1 r* _! Q
6 O8 l6 N, C/ w, B5 E7 f8 R

- G% e3 ]' u0 H8 m: C5 {% L+ i& @dict is the password file
7 q! y0 R' |- `. Z
6 E% `/ y: Y# I2 b
; q: v! U/ ?6 a2 J1 x
0 o8 @$ L/ |! e6 ?5 Qlinksys is the network SSID
3 I3 _3 X$ T6 k' N
+ S! m& n4 m! a6 a# |; u8 }
, M% i: e! ?% G# W1 n  _! m, M' b9 {9 @, A8 {
coWPAtty Tables:
& m7 K4 T. M, n2 i2 I; ], f: ~. u& `4 t, P8 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
+ u  ~( W) a2 a, \1 J8 N  b9 v  e! c+ W0 y6 }0 e. M7 k* j
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
8 {+ R) R! I* t& P/ @( _+ F4 M3 K9 d5 d
4 l% Y- E. {3 Z5 w9 B$ PA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/1 P" V6 G( J9 W
6 J3 t- q, E; ^0 A0 Z
- C5 g$ ]: h7 I  D* d5 IOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/. J% }2 r' B; I6 C+ ~; `

ghc00259

5金币就给你一堆英文的，你看懂了吗

bamboossom

这么贵  不买