直接搞定WPA和WPA2 无线密码P解工具

ghc00259

5金币就给你一堆英文的，你看懂了吗

bamboossom

这么贵  不买

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S
+ d6 s4 q4 z6 [  |) T
3 ?8 Q7 _  W0 X: \"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H

Project Homepage: http://www.willhackforsushi.com/Cowpatty.html

7 d7 b& }6 g1 R. m0 r  P
4 d$ r3 x, K2 c& }9 C4 @4 W3 k# V
1 k4 f( x0 T; @; A1 a& H, i# @- u* B% {2 _1 v2 r- t
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
. c2 p2 N$ M5 |1 w$ x9 x1 O

( A' I! E( W. S# W
$ U! w( d) a, G4 S7 _* s
- E1 l1 T- N+ s8 _coWPAtty Dictionary Attack

. T* l1 t7 B8 s, N, M' d2 J
! ^+ w; ]2 p  \  E/ Z: e; N/ \: S$ ~$ T4 `: h& H
+ w9 m  ~! Q) ~) I. D' y5 OPrecomputing WPA PMK to crack WPA PSK

  C8 R: t+ f7 `' ^& R
5 f5 K0 o5 W. [  [! M
coWPAtty Precomputed WPA Attack
6 D& ?( d( @3 M- z1 K
" E5 x" S/ ~0 y' ^4 s" J
. ?4 M0 x1 G0 U* D% Z3 j8 e: N( q+ }& i, [0 H5 g: ~
4 R( |% m9 t+ [6 \: ]6 n& pcoWPAtty Recomputed WPA2 Attack
2 v, v2 ^6 \& a$ f3 _  r0 k( N) v9 Z
2 a' X/ Y! V! X/ Z5 g( ~7 K/ u5 U# ]7 x3 u+ q" i

coWPAtty Tables
, y1 |3 s& g# ~0 ~' K% a
4 Z5 `3 W: ?( a) E' p: X/ ]3 g! I7 U
" P  v# i* p* G8 ScoWPAtty Usage:7 b, W( \( k$ \! _
7 N+ B( ~4 d  i, A( r' }1 m+ V: T7 v5 p$ Z6 ?
8 y, g* h# y- }$ f
% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
& B6 ]8 [/ x1 X; g1 \) u) I5 n& `4 y* l" A
0 E# _. b7 Y& W& XToperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
/ r7 v& W5 S. ~: x
7 }" F6 I% c9 w) l

In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
7 s8 v5 U7 n) Z# T, e7 C# H- t

, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
) _' B, E4 l9 vcowpatty -f dict -r wpapsk-linksys.dump  -s linksys


6 M- E! |3 G! i1 W3 f; s! t7 r7 z2 ]! a: T4 q
. B$ s' Q! g0 J% |/ ?) n5 a! M! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
/ ]6 c; a8 e! U5 F4 P- \! q  v- O" s, I
, \8 r8 x; G9 ^" ^

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
$ u1 C, {# F7 O7 i( L/ N8 j
/ J( x) W3 d+ e" l' B+ G
; P( J: j. a% W, @
& H; z' G7 u# j* ?3 [wpapsk-linksys.dump is the capture containing the four-way handshake

5 k7 P% [7 V0 ^4 o+ P1 }6 ^

dict is the password file

! O0 O6 K6 G. C
( ?3 m3 `# m* \* z0 V
linksys is the network SSID


9 F) t% K" b, ~: p4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
# ~  V% E" H3 K; Z! A3 D' hgenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
' z6 w' _5 O. G' p3 [6 R5 s$ W! c' u

0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
/ X# O+ e5 L: Z/ r( c. H4 f6 Q
So to generate some hash files for a network using the SSID cuckoo we use:
  q" I* }+ [4 u: m9 o3 B
* y/ S- A. m2 O2 o
6 v( T, h9 h& e3 K" a& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

* W. E: b! o" B0 ~& Hgenpmk  -f  dict  -d linksys.hashfile  -s linksys  

3 r( c% ?) b6 C# R0 X
' Y$ g4 }) k+ u( L( ^0 _' _* `; ^% _4 z) N, S/ N* t
3 C1 |! t6 i( h( v+ D, [
9 }! c; M, A* T' F/ g; L7 o
7 W2 h  {" V; v0 R: ]# Y

: P  L/ C5 q: z: O4 O& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P
: p9 `8 q9 ?/ E- |5 y/ k- p
0 x; e6 o& ~0 @) m4 Gdict is the password file

: Y& v0 C2 R0 V: Q3 z" ~
9 s9 T& F" C9 X! z. V% l
( v' \+ y  n3 H1 E7 J2 Plinksys.hashfile is our output file

) ?7 G; n" B4 D' z; R% _1 ?
8 O+ G: k- w; U1 K2 U6 w8 H, h$ t) S0 p: o
linksys is the network ESSID

# E# k+ t' ^9 C

- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
4 A6 I+ m7 T7 ?$ z4 s8 W& F/ }' nNow wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
2 x' U* T( m* a' S
; |' m5 f- U8 y" @5 J
# @/ U( w; U" J) B5 }( c8 W, U8 h' j; e) R# Q8 ?- t
- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


: Z. j1 J, i6 W8 f2 {* W+ Y$ [6 d0 G" c, ^6 P" c

5 K: F" B/ B+ z

0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P

wpa-test-01.cap is the capture containing the four-way handshake
$ B3 U' d6 Q* K3 }1 x4 e' t
6 b& t7 U, h" V" T6 Z
# N& B/ g2 Y. u, z, ?6 D0 }/ I+ k9 q$ _; a
; y, x9 D, s( Z6 W9 f( `linksys.hashfile are our precomputed hashes


! o) G2 P" d: R$ \! O5 s% W9 K" L) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID

5 x; O3 ]7 E1 x# n2 z3 D' ~% Q9 e& m; I6 d
, ~/ J% X/ q8 b' `( a0 X( u) O* ?% ~( Y( `) I

Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.

. |, J, V  l& F: ]
1 L6 I$ `. G: p" r( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
: _/ o8 G0 Y$ bcoWPAtty Precomputed WPA2 Attack:
3 a* ~9 a2 g$ r+ Z( v$ [# x! P- V$ E' z* M# \" I
coWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.


9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys
% D4 {2 @1 {& U$ m( s2 D7 P6 m1 T2 ~
6 R; s2 K% `. U2 Q3 j" ^+ _- b6 t5 x( @# x7 }
7 J5 z1 m" a% c- b3 r2 y* S, k/ ?
, Z! }3 T3 ?0 _
7 g5 U* t$ K! f! j: T$ y! R  V1 `: W
" ]9 [' ]9 o, |" T
) |. N# [0 C% {6 v/ j! o# B* A4 N5 X; D
8 Q4 |" m0 Q: y6 t- t( e) x6 a  c" K) o0 `) i3 Z
" [" K7 G$ P- Q! F; j& hwpa2psk-linksys.dump is the capture containing the four-way handshake

2 l9 }$ f' k" ]+ h7 V& i/ g9 H
. X( _8 v3 U, B+ i" p
" L1 j/ @. P# H: M; s% Edict is the password file

. v( p0 P- s& ?. R3 V1 k! [# B0 b
( B2 I$ s/ c# ]
linksys is the network SSID
( @8 K0 e! A- Q: R. ]/ w& C
! w5 k3 Z$ K- V1 ~! g& _

' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
1 v) S7 z& Y9 iThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
. l" D; I* \& ihttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
- U1 A$ G. s" D# X4 W, H' k( x
# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H

6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道