直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S

- t& F- m( U: z"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
) r" B; w/ _" y' M+ ^
Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

7 d7 b& }6 g1 R. m0 r  P

, i# @- u* B% {2 _1 v2 r- t
- W! {; z: m3 |6 r7 xLocal Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
. r; @/ Y+ c) J, h; z2 _2 E

( A' I! E( W. S# W
+ Q5 m: X5 }7 x' M$ U! w( d) a, G4 S7 _* s
/ R* V% p* s1 S( m8 L) ncoWPAtty Dictionary Attack
7 @  E: o8 M0 F* S+ {! v, a$ V3 Z
! d' o7 o; E4 H8 K& Z
: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK

4 Y' j$ T3 v7 {# @$ Q2 J( s- m3 e  C8 R: t+ f7 `' ^& R

coWPAtty Precomputed WPA Attack
7 ?' V8 y; ^; X, @1 |5 x2 G) `
- M9 B  T- ?' x+ D2 p
( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack

( ~7 K/ u5 U# ]7 x3 u+ q" i

: }# a! `# H- e. C4 u' Y  e- ucoWPAtty Tables

. `# n! o% W! r: X/ ]3 g! I7 U
8 g% p0 \% p0 W7 ]% t5 B) P* E) scoWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?

0 s& a( d8 m/ {4 c* h% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
4 i9 G& ~1 q9 e6 w& Y; K) u) I5 n& `4 y* l" A
3 [2 }7 b5 ^- a3 l, R$ U7 RToperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
& Q4 _  W/ s0 n8 `
7 }" F6 I% c9 w) l

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
* h/ x& e0 G! i& T. _/ W2 d  X5 H: C

: h1 Q$ b5 U) }0 i4 ]: y8 d, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys


; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
4 P- \! q  v- O" s, I
1 r$ _* }+ |% J% Q. z, \8 r8 x; G9 ^" ^

* T) M  S9 T- w7 F/ s7 B, u" _% pAs youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).

8 q( C$ |" V' g# v$ `# g! u
) P+ b$ @# z' Y3 E' D0 h  ?* V- Q; P( J: j. a% W, @
' [. R9 v* o2 e( dwpapsk-linksys.dump is the capture containing the four-way handshake

# m: Y# ?% u# \1 w% v6 g$ k* f5 ~0 R5 k7 P% [7 V0 ^4 o+ P1 }6 ^

dict is the password file


6 e- E- {" F" y! `+ l5 Y6 R' {( ?3 m3 `# m* \* z0 V
' Y  G$ n* i5 t- f# u; Dlinksys is the network SSID
! A1 ~# e% h' m7 O5 e4 K

4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
* b% q& u+ m2 r  L" Y/ }8 x% agenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
( X& L, a9 s& ^1 X
6 L1 N* F( `" K( Z. U* o. R4 Z
0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
' @( X: @- l+ L7 M3 {( v7 O9 C
# H% z! C* Y7 B/ `- \/ rSo to generate some hash files for a network using the SSID cuckoo we use:
6 z! n: k7 S7 h
, r3 a7 m% S1 |) [( ~
& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g
. A7 R2 V. e2 k# g- U3 L
genpmk  -f  dict  -d linksys.hashfile  -s linksys  

6 q. Z+ L  N" y. {3 r( c% ?) b6 C# R0 X
* U9 U8 M) _" I& H/ B# B0 _' _* `; ^% _4 z) N, S/ N* t
; y% f' {5 ?) [! q6 r; W, m
! Y8 S4 E* y5 D

% m" [7 m9 Y, n
& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

% ?" [7 v/ S4 I2 T: b* Idict is the password file

) Q3 D# ~" g" U3 A9 D
: C/ i2 `+ F$ ^* @  M9 s9 T& F" C9 X! z. V% l
$ s7 z6 e$ `) rlinksys.hashfile is our output file
6 u/ j# W$ k3 K! Z
7 f' c+ R8 t- s) }
2 U6 w8 H, h$ t) S0 p: o
linksys is the network ESSID

# E# k+ t' ^9 C
! B" P4 a+ a, v5 M( e- a+ z" \2 a
- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
) n  y1 _4 i$ F9 n2 nNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.

4 Q# t& N  r. s8 }. \
( c8 W, U8 h' j; e) R# Q8 ?- t
" n1 h2 X. i& U7 K) I0 W- o: q- X2 Y- ?9 u3 c. o
' {3 `2 O) M$ O2 n( f2 Wcowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


- Q% r+ B/ @' d$ c+ Y$ [6 d0 G" c, ^6 P" c


: o6 [, y" Y) x0 j6 L8 R- l
0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P
+ Q3 h( o* Z0 q7 O( ?; a
wpa-test-01.cap is the capture containing the four-way handshake
0 y  g/ B' f. r
9 G0 |) h; J+ h+ X0 `
, ?6 D0 }/ I+ k9 q$ _; a
linksys.hashfile are our precomputed hashes
% ^/ J( E3 w3 P. L
; E+ {( R3 V6 K- C) u& b( ~
: Y% O0 A' `0 }0 k) h, B: _7 [" W) O  W, e- W) L! A6 {" C! c
! }; ?% K1 B* q: B- ]linksys is the network ESSID

+ M5 V/ k( e6 @. w9 i' l  E2 z3 D' ~% Q9 e& m; I6 d
* K$ B; V6 c% y+ x& |0 x+ t9 S( a0 X( u) O* ?% ~( Y( `) I
% Z3 _/ x" x' o) V6 P
5 B6 z4 }/ a  J4 d4 f% _Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
$ s  ^3 s: k; j/ G* l
% w1 }8 P, U& t
8 B9 D9 |4 V+ s% \% u4 V& _: E/ m( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
- W1 @; }+ n, s7 l( q/ YcoWPAtty Precomputed WPA2 Attack:
$ [# x! P- V$ E' z* M# \" I
3 B1 P% n0 U6 v5 n+ q6 v; ucoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
1 [2 @2 R" K3 g* s1 |7 }

9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

4 d0 B* q+ [- y5 L) {" ^+ _- b6 t5 x( @# x7 }


: m. s# V' R9 W( H+ C6 Z& Z

/ j! o# B* A4 N5 X; D
9 l; v8 r+ ^/ G6 x, O6 V( e) x6 a  c" K) o0 `) i3 Z
% _4 z( P$ Q8 v7 t; b" K" J9 ^  R  Hwpa2psk-linksys.dump is the capture containing the four-way handshake

! n9 Z% o$ O4 R; {' G7 J
. X( _8 v3 U, B+ i" p
) M/ Q3 U- S, ^* s+ Adict is the password file
5 J% m+ n- z6 X! p9 T6 K8 \; q* h
  |- H  r% A; [- ?+ k. v( p0 P- s& ?. R3 V1 k! [# B0 b
$ b7 t5 @7 |8 z  ?6 O5 y! G/ q
linksys is the network SSID
* Z# Z  p; g+ ]$ Y8 \. l
! w5 k3 Z$ K- V1 ~! g& _
9 I0 u6 b1 f$ n5 I2 _" j% W
8 z( y4 b+ m' I" G$ _1 h- g5 X/ ^' n' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
/ Z$ E$ a5 M0 u7 d: b* lThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
; ]; g- z3 l( G" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
4 p3 E4 H; Z0 r7 W5 C) k
# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
5 h. S; Q0 J- R7 w- t" L/ A
6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊