直接搞定WPA和WPA2 无线密码P解工具

wap9898

先看看 搞不定再找楼主

wap9898

假的。。。。。。。。。。。。。。。。。

怡佳

谢谢楼主 分享

speaks

有用吗？用过的说说

cdl_1

不懂用，太贵了！！！

LeeTien

不管好不好，先鄙视下楼主
我不会下的

encle

真的有这么神奇的工具么？这个要学习一下了。

huoyuan

没钱啦。。。

regweb

不是吧  这么贵

sadamu9527

呵呵     ，妈的全是EN

sadamu9527

能不能有用啊。呵呵

ghc00259

coWPAtty for Windows MAIN:
' B: w! E1 w! o* d- G. a$ H. W
0 {( C: G+ s6 D"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
, v& T. o3 E0 [) J8 m. k8 r1 [1 Y/ _
6 @3 r, o; ]! ~2 b( ^
5 d. m, B# d, j: U6 C0 {Project Homepage: http://www.willhackforsushi.com/Cowpatty.html


4 U5 [! S1 o$ r8 Q- J0 I4 z4 ^+ c9 b5 v  F, G" N
" A* }, x" H- B. Q, C' m' Y& `0 l# y( z0 X$ U+ C/ S. y1 A
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6


9 D/ V, E. N% }, Y$ r2 c2 r8 E$ l4 M& W  f1 E! B- }' e/ g; r! ]6 V6 [: u2 Q  M! G& L6 F
' G. N3 E0 }% A5 P( o
coWPAtty Dictionary Attack
5 X7 O* V- }* x+ J) n
: v) |+ G4 z6 y9 O

Precomputing WPA PMK to crack WPA PSK

8 L  @* c$ r1 y  V
7 i  h* C' U( Y( l; U/ Y
; ?9 i8 h# A" R$ j: g2 TcoWPAtty Precomputed WPA Attack
7 p; P+ |" x/ H) q7 \1 r
; a4 W& ]/ f  |) W4 l# Q3 G$ N
, r0 |2 h4 X+ S9 A
( z; \. S$ d9 [0 TcoWPAtty Recomputed WPA2 Attack


' [+ b& ^! v8 C' Y! [( b3 O- G% L( _6 }2 V+ L% V2 M8 I7 v, s* z
coWPAtty Tables

  J  Z6 w0 w* B6 l! i: K
coWPAtty Usage:
3 G# [7 V/ }8 D2 Z! P/ i* _1 j; a3 c
* Y. X7 h; ^; i$ V% g3 t) z% k- i/ d& D ( z+ A& s, x0 t( m- d- R
& s# i8 c7 j; J2 b/ h1 U& i/ p6 F  ncoWPAtty Dictionary Attack:: u, g: R' Q( j- T5 Y  i1 O1 g2 T

Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
* R) r$ E  h& ?- b! |; a
( S2 I3 h0 x/ j. y2 Z' {% b

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
9 e. M6 ~- C0 A. `; L
/ x& L0 O1 M  v6 V* g9 j, e3 Y% k* k
& B* F! }* B! a6 V
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys

4 [( J; C/ e; @/ W( c
0 L6 o+ q3 [* I1 A7 g5 U6 f) y' N! }3 L2 E0 d
9 x  t3 n3 s' e1 r, b% J% I  _
  T4 J7 C2 h# ]( F& @. |2 D: x& E8 j" O. D0 F( w3 }$ p/ r" Q" o# n( r# M: {
" L6 F+ }' F0 v: Q6 y

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
; |: S& V/ k3 M4 J  t' O; p

# `( ]8 w# u$ @# o: @; x* X/ J; M
0 H4 }2 C$ F: |% ^wpapsk-linksys.dump is the capture containing the four-way handshake

+ o6 J6 ~( H& ^7 n0 N. I5 h9 e" V/ f  T

/ j  b; {& o  udict is the password file
; d1 m& |" S' Z& r3 x* k1 o
, ~) W: L! d6 I& f' h5 w9 K. g) ?
) `( F. }) X3 U7 \& T! d
  _5 S3 q. r* i2 H% w+ }linksys is the network SSID
% n) [9 S+ e6 r" I2 ~0 G: N

2 n$ j) S# k' c% k  ~# Y' V& W2 D; {# f7 H  Z. m% @4 y6 r- `( c* R* e( I
& c$ o- f7 U6 t2 R. B  uPrecomputing WPA PMK to crack WPA PSK:
" P1 {4 l$ Q4 p. e9 G- z* {$ i, N. ^% z1 ^) f3 h/ M: {" Q
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

% w) Q( z: w2 X+ B) T: z
" `! n) Y, |, q" `( n( s+ X# o5 Y  I0 x* \4 |1 f! b3 g! F) ?& X# n2 M  _
) Z8 t& `& B! v( }1 i
% A& q/ k6 _5 t2 _& Y' MSo to generate some hash files for a network using the SSID cuckoo we use:
/ a, C! |; v4 l. K" ^/ ?7 t, h+ A
. {2 I  j' Q0 Z6 e, W; l' Y
# |- g  y" k% ^2 |+ i
1 C* q% L; ^$ L5 r1 S& \! W8 t; J: I( l% B6 C
genpmk  -f  dict  -d linksys.hashfile  -s linksys  

8 M4 z7 x0 S( b3 I- F. P# |( F
0 {  M( C& M# s* V& _
: n- U3 E; W* O) S- ?2 i8 E  ]3 Y. R4 Q0 N3 |6 ?0 Z
/ `5 W* S1 J  R' p( W! ?8 T


5 m" k/ ?7 H) f& S
1 F( c$ E, W  ?* s6 Y
dict is the password file

1 v! Q. v1 \4 H/ j# W% ^1 y) G
; X3 t, L/ s/ N. K: s
linksys.hashfile is our output file

9 C1 `0 I$ m; E; |

% k  t+ v( y; E2 Z3 Plinksys is the network ESSID


' B& T8 I7 H+ i2 z6 v6 {7 b0 b5 H' {* S; ^4 B
1 W, s. N  b3 N" W6 B" v3 z/ `& N( P8 a% S% `0 r5 r( XcoWPAtty Precomputed WPA Attack:# ?/ x) d2 _& C+ W/ i
5 \* f! X: D3 f7 R% {
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
  U4 M& @3 y- s; I7 r
, O) j9 m4 ]# u$ N8 ?! ^! v3 m" r/ l3 a2 G; @+ I# A1 Q
0 K; o" p/ Z+ I5 u+ @! H

* Q9 D. o' ?! a2 Q3 `, b* Ycowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
+ t$ n8 i; {# t2 }# t1 x
+ {# d  \& b( s, m, N



& R1 V1 X  u4 A# O
* y: c0 a, `! {" v9 R, C
0 d9 j( @" t% h* C% I/ M# }( e$ }9 ?( M' |! ]9 l
wpa-test-01.cap is the capture containing the four-way handshake
& K# r7 e5 Y$ e" k+ n$ q- r; U
6 v6 ?. u6 D! ~. `& N. a2 V# J. T. {  e2 R  w8 A3 n% x7 S% K

' j' I0 i+ s0 l) o5 K. u% j  e2 @linksys.hashfile are our precomputed hashes


; e- M" y* t# g+ i
+ _) S' F2 s! I# o/ ~8 Z+ d7 \linksys is the network ESSID
1 q$ w. I" c, `3 m
+ H! o  [1 |3 a8 E8 y0 l& e
' G1 O0 A# U* M- u' @  F7 ^! I
" z% a& [; E) T' a) H6 a: h" u# w) ?( }2 j( u# n9 x
/ K2 e3 d+ `* o+ `% r; vNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

( U& A5 l6 q( @' Y) W: w" k& a: p/ u. L4 |* C0 e
1 z4 O: }- l$ l- F$ O* _$ C3 _
6 Y7 G* h, q% U* Z! b, p- e1 HcoWPAtty Precomputed WPA2 Attack:
0 P$ y5 O0 Z3 d
" k* A; h+ g" G0 D! `( Z; l" TcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
4 [# W2 S2 A( _6 m1 K
/ r% e( ?: m; }# T- W9 m7 }. Z' Q! B1 S
" r0 _. i3 |$ k) X
" S2 G. I  A# H: K, d  w- scowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys
1 g" v+ c- \2 O) e5 e/ Y! |. D

; G* X9 x' b# N3 J$ o* S
# p$ g3 T! V6 Z2 Z

# h: S0 |6 {$ p$ h6 _3 }8 ?/ U4 W
% g6 _# a! f  X( K1 ?

8 V0 e- a3 [. j/ }wpa2psk-linksys.dump is the capture containing the four-way handshake
, w8 ~( h5 a. M, }$ y2 b: G. E& b
9 {. k  U, d8 ]1 y$ |+ c# u6 O8 l6 N, C/ w, B5 E7 f8 R
# B6 D- l  K$ ^' v9 W0 s0 V
5 d# c+ z/ b0 vdict is the password file
! l' s6 ?7 ?  z/ e% G
6 E% `/ y: Y# I2 b

6 @" |0 |8 z* X; Olinksys is the network SSID

+ S! m& n4 m! a6 a# |; u8 }
+ \* q  o5 t* [% n% E4 W  _! m, M' b9 {9 @, A8 {
2 ^6 r- R  q, E( t  \( g+ @. scoWPAtty Tables:
2 I; ], f: ~. u& `4 t, P8 gThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
0 I' I1 ^4 W/ x* h2 W+ u  ~( W) a2 a, \1 J8 N  b9 v  e! c+ W0 y6 }0 e. M7 k* j
8 e9 {' ]' z% }& ?* O. K' X% vhttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19
, c3 @6 ~) I: P( _+ F4 M3 K9 d5 d
6 I$ l) ~& b0 a, a" U: s4 l% Y- E. {3 Z5 w9 B$ PA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/1 P" V6 G( J9 W
6 J3 t- q, E; ^0 A0 Z
- s+ H7 s- a( P" z3 gOr you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/. J% }2 r' B; I6 C+ ~; `