直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
1 o& y3 M5 u4 M! @, w* A7 A4 o0 ~
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
1 h. s' i) P6 ^$ W
& ~. d, Y2 \$ |& lProject Homepage: http://www.willhackforsushi.com/Cowpatty.html

7 d7 b& }6 g1 R. m0 r  P

, q, F7 ~2 a+ X$ ]& q9 L4 D' W, i# @- u* B% {2 _1 v2 r- t
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
. }& R; g5 A! m+ \9 J. v
) W) _4 y$ |& J6 |' Q
( A' I! E( W. S# W
9 z4 P! x3 B/ z+ S5 B  f" E" n$ U! w( d) a, G4 S7 _* s
' P9 B. x7 }$ p& ?$ m- O" ^coWPAtty Dictionary Attack


: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK

  C8 R: t+ f7 `' ^& R

coWPAtty Precomputed WPA Attack
0 j" g0 j  s$ m+ w5 `
3 c: P$ P5 a$ F6 I+ w3 O
8 H6 h" O% E3 f2 a( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack

( ~7 K/ u5 U# ]7 x3 u+ q" i

) A8 ^0 k, L9 d9 W, F3 ycoWPAtty Tables
( N# P8 u1 K2 @
: X/ ]3 g! I7 U
coWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?

7 g: I# r, b0 Y; }, b% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) `' z7 Y7 R7 i5 K3 s1 M/ b( m" X) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

8 B, n9 r$ l. r3 }! C7 }" F6 I% c9 w) l
9 E( ^( U* `9 ]' r% \6 U
! i6 u1 ]  }/ k- g& fIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.

6 [6 f0 r9 j% y' i
, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
/ q" ?7 U/ d( t' F. w/ mcowpatty -f dict -r wpapsk-linksys.dump  -s linksys
3 b, O: M# K4 r& m: ?- e" _9 h

0 O. v; y4 N3 ~" f; s! t7 r7 z2 ]! a: T4 q
, }- U0 b& I0 k/ m3 q/ f! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
& E% F' W( h5 k1 E; k4 P4 P- \! q  v- O" s, I
, \8 r8 x; G9 ^" ^
0 o# B; l1 q0 X
As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
1 Q3 g" V+ C4 L$ ^- M$ N

1 G1 ?/ D, B( G' H2 g" ^1 _8 B; P( J: j. a% W, @
wpapsk-linksys.dump is the capture containing the four-way handshake
9 S  A& g8 N$ H- F( z% h
5 k7 P% [7 V0 ^4 o+ P1 }6 ^

6 K+ b8 ~5 |4 Z* f) f  Cdict is the password file
( `( G0 X- c9 f6 V" S5 b( G( k

8 X0 }& Q+ g0 b  `( T7 G( ?3 m3 `# m* \* z0 V
linksys is the network SSID

' Z  ^  Z; R, z! A- u& B. A
8 R0 H# x) E# A4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
/ ?6 ^/ \# C8 w' ^. }* c1 xPrecomputing WPA PMK to crack WPA PSK:
" {0 P" T- ~! }4 z9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
: n7 H) U; |' H: c0 ugenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
( G* p0 |0 p' ^

0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |

% j3 u3 k/ f6 w. c; z8 mSo to generate some hash files for a network using the SSID cuckoo we use:

; I1 R' p" X7 X( U3 {1 x, e
; n# F0 ?) W/ J8 }# S: g. _, {! g5 r& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

0 G' n- d7 y. ^* {( cgenpmk  -f  dict  -d linksys.hashfile  -s linksys  

; j) c% A! k: z$ w3 r( c% ?) b6 C# R0 X
/ q1 t' I# A$ y! t0 _' _* `; ^% _4 z) N, S/ N* t



/ f7 W, @5 P" d* }2 q# h
& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P
& w$ g* a6 u7 }8 o$ Q$ c
3 |/ v3 ?% u7 j* ~7 B" Rdict is the password file
& f5 E/ A% x, ^6 E7 G/ h( Y

9 s9 T& F" C9 X! z. V% l
; ]  W% x3 c, U% l' Jlinksys.hashfile is our output file


2 U6 w8 H, h$ t) S0 p: o
  N- p; z0 s! C' c! b& {2 ]5 G4 ?5 Elinksys is the network ESSID
, K  h9 w. L& B/ ~
# E# k+ t' ^9 C

- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
2 d# J* k6 @7 F) `3 B3 ]  }+ RNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
! r" T/ @( p9 G; `

( c8 W, U8 h' j; e) R# Q8 ?- t
& N0 O7 Q/ b! m9 A- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  
+ K, f; h7 C6 w9 J  m3 X& [( k
$ V* E: X+ c4 `* R
+ Y$ [6 d0 G" c, ^6 P" c

4 `3 G: D& b0 g$ w( B8 k& m
7 Q/ `0 m+ D- x2 \# X+ W
! k/ d$ Y1 O2 ]9 x: N! G' `7 X* J0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P

wpa-test-01.cap is the capture containing the four-way handshake
" `; {* a( A; O% Z

, ?6 D0 }/ I+ k9 q$ _; a
8 b% \. k: j% i' l4 p* Q+ P! l# flinksys.hashfile are our precomputed hashes
% p+ a3 m% u6 E* J0 N  |* H
0 N( U6 A0 w, ]) f: Q4 A( Y
) O  W, e- W) L! A6 {" C! c
$ r& P9 m6 t6 ?( llinksys is the network ESSID

3 r/ {8 L! T- T7 i: [) w) I+ F2 z3 D' ~% Q9 e& m; I6 d
3 K2 E0 L2 e3 V- Z( a0 X( u) O* ?% ~( Y( `) I

7 ^+ \4 h# V. p5 LNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
. {  d% ]7 `7 t2 d% K
0 n6 r8 _8 L- c. X
) X* d3 m6 ^; C( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
coWPAtty Precomputed WPA2 Attack:
0 O# v, V5 f5 `( a$ [# x! P- V$ E' z* M# \" I
2 z- T! |$ n* ]6 QcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
6 V# {8 k& w. Y% J9 s3 Y7 F1 E

9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

" ^+ _- b6 t5 x( @# x7 }

' x% l) J' S- m4 F$ j0 G" M

6 n* u- L; p5 C" K
/ j! o# B* A4 N5 X; D
3 A/ C; t- \+ n7 F1 P( e) x6 a  c" K) o0 `) i3 Z
wpa2psk-linksys.dump is the capture containing the four-way handshake
6 z* N0 V4 D0 K1 H

8 y) y$ E% V, V. s! o0 |9 E. X( _8 v3 U, B+ i" p
dict is the password file

1 z. w# y! h3 A- m) A. v( p0 P- s& ?. R3 V1 k! [# B0 b

linksys is the network SSID
9 Y% {8 _( T2 o$ m
! w5 k3 Z$ K- V1 ~! g& _

' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
: a. b' h( i2 \7 b; R3 LThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
$ @" G6 W0 `( N0 M" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
4 Q* P+ X, R. L% D7 \( a5 [http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z

# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
) _7 F7 e9 L1 f2 e& c- |2 A
, M  u+ g6 f5 y* b5 c7 A; Q8 M# F6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
( \% Y; i& Z$ W9 E  ]# q4 e6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊