直接搞定WPA和WPA2 无线密码P解工具

ghc00259

5金币就给你一堆英文的，你看懂了吗

bamboossom

这么贵  不买

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
& X7 u8 n0 G! E( E: C' E
"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
& L' b8 t7 a' p/ ~" K
! ]$ S5 U- r# H- r) n# CProject Homepage: http://www.willhackforsushi.com/Cowpatty.html
* k7 d$ ~7 N" B# X; J& d$ B
# Q( d9 T$ Z. w6 X: [7 d7 b& }6 g1 R. m0 r  P

. o" P: M8 n: ~& Q8 M7 |, i# @- u* B% {2 _1 v2 r- t
9 m! D9 _0 b# a: sLocal Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6


* E7 A' O% ]+ l- z8 S$ }' ?+ N$ L( A' I! E( W. S# W
$ U! w( d) a, G4 S7 _* s
7 b1 l5 n* v4 R  N  R. j0 j% K2 l. ~/ mcoWPAtty Dictionary Attack


# X, c7 O' O7 D+ }: S$ ~$ T4 `: h& H
5 C/ j/ o! A, H; z6 OPrecomputing WPA PMK to crack WPA PSK

  C8 R: t+ f7 `' ^& R
! I+ D( E2 _4 Y- k$ G1 _6 j& ~1 h0 k8 N
coWPAtty Precomputed WPA Attack
' s3 b6 j3 J# B8 L- [# m

+ M1 X& k6 o, C( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack
8 U# S5 F7 A. j" H6 Y7 b* ~9 V/ W* P
! n% E, \0 f8 Q7 ~) p$ G! F( ~7 K/ u5 U# ]7 x3 u+ q" i
; W' {: p, |( i" n9 a6 u
coWPAtty Tables
. H( j, ]3 b# A6 n% \# ?9 l
3 P! _5 H8 o% x0 _& O1 F( J* V: X/ ]3 g! I7 U
coWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?
! k8 i7 E: T! [& Q+ n% w7 A
% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

9 Y+ M: [: Q  o- G+ l7 }" F6 I% c9 w) l
, n" a1 h; c  X. g8 a
In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.


, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
) k  u8 T( x% d2 ^- T# L# acowpatty -f dict -r wpapsk-linksys.dump  -s linksys
( m5 A7 q# V( n# h1 z8 ^- h* W

/ o1 n1 x/ J0 X  \4 r' Q; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
5 R& l* U# |5 ?; [( n7 b* L4 P- \! q  v- O" s, I
! N. S/ y- y  I0 n, \8 r8 x; G9 ^" ^

& v7 q/ L0 O, X% @) yAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).


; P( J: j. a% W, @
& D' k9 C1 ^- A8 n% wwpapsk-linksys.dump is the capture containing the four-way handshake
# H3 w$ q3 k, p0 X& L' A; I6 k
5 k7 P% [7 V0 ^4 o+ P1 }6 ^
  p- U* B( L$ b# q0 z. D1 L3 X
  i+ v, u1 W- I8 P+ `: Kdict is the password file
8 I! w1 O3 l2 }. }2 v

1 X. g! W6 }" J" h( ?3 m3 `# m* \* z0 V
( \( q+ ^" t/ Nlinksys is the network SSID
1 P4 V2 s0 E# H, m: l

4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
" O3 e5 v/ W& n5 @; t/ oPrecomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
! @; `5 E/ @8 n5 t1 _0 B* w

0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
7 T- l) ]8 i( k) t
- i, {5 n. S: o; U1 tSo to generate some hash files for a network using the SSID cuckoo we use:

' N" G/ [5 h1 l* `3 q; V
& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g
, i3 M5 i# ^: {0 D& h( ?" r) ~4 E
( @  Z# ?. y9 f* k) L4 h' O4 Z. _genpmk  -f  dict  -d linksys.hashfile  -s linksys  

3 r( c% ?) b6 C# R0 X
* L# w- E; O. Z0 _' _* `; ^% _4 z) N, S/ N* t

$ [$ I+ s) h6 e$ P8 C- G
+ m6 d7 G/ n: S
. s& O  l+ \1 @
, |* @! J/ |6 d& R( {, x  A& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P
8 C5 U4 u% g9 n+ S5 v8 J. B$ I3 _
3 R6 O: B$ q& ~0 o" Ldict is the password file
/ E. D# S+ c& x

) U# R  ~7 l0 z3 N6 v' t9 s9 T& F" C9 X! z. V% l
  l, }% z, s6 x  V. y: `1 }linksys.hashfile is our output file
& x8 L1 V8 |9 [

2 U6 w8 H, h$ t) S0 p: o
1 r5 F6 M( Y# ~% i3 L* ?5 Z% Clinksys is the network ESSID
. r' B6 |  ~1 N
6 Z) L9 e! t) A- l- ~# E# k+ t' ^9 C
& v3 v  h' A7 S6 _( v2 {3 a1 R
- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
/ q3 Q5 ?8 _+ @1 i2 C2 p! A3 K" Q8 [/ o# h- o% ^4 R
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

$ D( f5 x4 A& S( m
' Q2 n5 ~$ _& z8 R$ S) h( c8 W, U8 h' j; e) R# Q8 ?- t
- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  

5 t! y- v* L1 ]$ r8 Z
+ Y$ [6 d0 G" c, ^6 P" c

, V$ D- p& K' X0 g

0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P
1 i# i; I$ ~! E; R
wpa-test-01.cap is the capture containing the four-way handshake
. T, U  z: q  |
/ }: @, s+ L7 @' R/ Y$ p# T
, ?6 D0 }/ I+ k9 q$ _; a
linksys.hashfile are our precomputed hashes

& \, Y, _: m7 H5 o; h  _# a
1 w2 f( G' @9 P0 m7 v8 ~" Q! a6 q3 R) O  W, e- W) L! A6 {" C! c
' b8 m0 k9 e8 b7 p  Q6 Qlinksys is the network ESSID
8 i/ j; I9 I3 d) k2 u7 |/ w- E! }
( W) _# E* A& |" {8 O) a) _/ c, _1 O/ t2 z3 D' ~% Q9 e& m; I6 d
0 R3 a2 N) b7 j+ X, |1 \( a0 X( u) O* ?% ~( Y( `) I

% P5 ^# a- [  P6 M& {2 o' M) _, j) bNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.


( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
coWPAtty Precomputed WPA2 Attack:
/ n' ~8 G$ c- e6 |& q! g* j$ [# x! P- V$ E' z* M# \" I
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
- ~2 w4 N/ ]' n/ N* m( h/ W

9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

1 ^3 k( E. {0 ?) n2 t" ^+ _- b6 t5 x( @# x7 }
! k. @0 g! d2 I, E
, I. ^6 h; b* J4 b( A. U
9 U2 B1 B: a5 t& S+ i+ v
* S; X2 @5 ~5 R7 K% q  z8 E
/ j! o# B* A4 N5 X; D
+ U$ y  Y; G" v5 K# i' l' t/ o( e) x6 a  c" K) o0 `) i3 Z
wpa2psk-linksys.dump is the capture containing the four-way handshake
* h4 l6 g. _* ]- M* G9 Y

. X( _8 v3 U, B+ i" p
dict is the password file

. v( p0 P- s& ?. R3 V1 k! [# B0 b
& O/ k$ T9 p' Z2 c0 H
linksys is the network SSID
; ]+ S! C& K3 A6 {2 f9 f* j( I
! w5 k3 Z$ K- V1 ~! g& _
. Z6 `4 f* p$ Y! X( }
( y2 G, h  m; E' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
& q8 Y" N' L. i( XThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
$ c3 J* J! t% A- D0 B. k  qhttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z

9 `7 C+ E" }4 l# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H

0 Q; f+ o- S% l& D6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道