直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S

1 n6 x/ b) P$ N"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
) Q& P+ r* l, D! h& I2 E
8 J) Y' h# p# m, r; zProject Homepage: http://www.willhackforsushi.com/Cowpatty.html

9 t$ F( g9 J4 Q% d$ X. s7 d7 b& }6 g1 R. m0 r  P
9 w( v2 K; b/ o5 |/ ]" P
, i# @- u* B% {2 _1 v2 r- t
Local Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6


( A' I! E( W. S# W
$ U! w( d) a, G4 S7 _* s
0 h! N, y2 X4 L# h! D( ]2 dcoWPAtty Dictionary Attack

# e( G) j+ n- W8 c( T8 I5 t6 Y
- Y/ {1 k3 W0 z5 ~! x/ M( f: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK

. ^7 Z# P8 X& D3 a  C8 R: t+ f7 `' ^& R

% J; G" O' q2 l3 L: r: c+ B5 HcoWPAtty Precomputed WPA Attack
7 t' K8 Q+ Y, m9 p) Z- A1 w

( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack
3 g1 t, t" L- s- A  s. P6 d
( ~7 K/ u5 U# ]7 x3 u+ q" i
4 b, e. X+ s" h' b3 A
coWPAtty Tables

: X/ ]3 g! I7 U
coWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?
+ @( o4 J* I  q( |" X" _2 w& E
% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.
' [* P/ _$ k* X
* @2 h/ T( }# h- Q% [5 ~7 }" F6 I% c9 w) l
, q4 y% y$ k. |. T  g4 A: A
" \3 F$ ^8 d, eIn orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.
* d8 `' A, `% |

, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys


; h) n' A2 M. B! w, b( e( H! Z+ g5 t' r; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
) ]" L) q8 ?6 B" n' ^* L0 N4 P- \! q  v- O" s, I
, \8 r8 x; G9 ^" ^

As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
9 w- R$ H6 i# E% M6 L0 y" Z
; E: V1 M$ i& l% q1 J2 t0 M/ H
* H$ r# X9 M0 q1 W8 c6 e; P( J: j. a% W, @
wpapsk-linksys.dump is the capture containing the four-way handshake

$ \1 g" ]5 t5 e( B8 ~9 }6 H! N5 k7 P% [7 V0 ^4 o+ P1 }6 ^
6 Z$ F$ i0 ?2 a% D
dict is the password file
9 @+ `6 u, x6 p6 Z% k) K0 m
0 s" a2 [3 U  S9 T5 q
1 _6 {! ?/ e: f( ?3 m3 `# m* \* z0 V
linksys is the network SSID


0 ~' D* v( H; ^* U2 e" O4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
" W! r8 a6 }4 @4 i8 e9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
4 i- i) A  g3 z5 E$ w0 Pgenpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.

% o2 Y3 E: D$ c: `( s7 k; h
0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
8 @: p7 g' t/ a  o6 w$ E3 }: |
3 Y; o( x+ x; K0 C, _8 PSo to generate some hash files for a network using the SSID cuckoo we use:
0 @2 t7 z1 D, r$ C$ x
7 x8 y6 _4 t  q
' m# A7 [# y4 D! K" w0 e& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

4 b, R( [( H% B& W; Vgenpmk  -f  dict  -d linksys.hashfile  -s linksys  

/ @" \% D4 w9 c# c6 f  w3 r( c% ?) b6 C# R0 X
0 _' _* `; ^% _4 z) N, S/ N* t
0 e2 y' |' h4 {! c" w& q
% I- n- A4 F7 t" {/ h0 y
3 e$ [( C+ U' _* \2 c1 U, e% w

9 D2 g, M4 A9 k" |& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P
4 A; x- Q' `8 k) a3 H% d. _7 z+ i
dict is the password file
) b8 h# x7 O, t3 b& X

9 s9 T& F" C9 X! z. V% l
; ^4 U# n( p* b$ d: llinksys.hashfile is our output file
- I- j7 M: D' C, h2 r5 r5 e; ?9 l

2 U6 w8 H, h$ t) S0 p: o
; h  O" i) s3 p4 B( nlinksys is the network ESSID

# E# k+ t' ^9 C

, Q1 O" i( J3 d1 U# c, n- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" Q8 [/ o# h- o% ^4 R
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
( f7 S& Z# X7 @0 [
5 }9 W; T; L2 s
2 c$ X: K9 W! X& O/ q, m) E. J5 c" B( c8 W, U8 h' j; e) R# Q8 ?- t
- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


9 D$ o+ H% c" k8 y+ Y$ [6 d0 G" c, ^6 P" c
% ~9 X0 s! ~" F1 }( Q% A1 S5 k
. m( x( y$ z8 `$ H

7 L. ?; m8 ~! k  R' C- r. K0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P

: P0 O0 l  Q2 ?3 |( I' @+ X) [wpa-test-01.cap is the capture containing the four-way handshake

( m# W% U: @2 `; B: t! s' S
6 d7 b0 ]: G% t7 x6 _; m. l, ?6 D0 }/ I+ k9 q$ _; a
$ E5 [8 O) x& v2 N! c! j) Hlinksys.hashfile are our precomputed hashes
0 ~/ _  O5 u! J0 x1 B

) O  W, e- W) L! A6 {" C! c
6 [: x/ u3 l  s, M* O: G0 ^: qlinksys is the network ESSID

! O8 x/ z) n3 P. x, n, N2 z3 D' ~% Q9 e& m; I6 d
1 P" E2 L( [3 l4 K, g( a0 X( u) O* ?% ~( Y( `) I
6 |6 \$ E; k, C
Notice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
/ b) F- d* k  W  T# v1 b; r

8 V4 B$ e8 e  ]5 w( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
coWPAtty Precomputed WPA2 Attack:
$ [# x! P- V$ E' z* M# \" I
- P: T% G, [. TcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.
! c7 V6 X! ?2 q! q- ^! O+ y( ^1 S

9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys
0 V/ C& `- K! U+ e, r5 q  Z
" ^+ _- b6 t5 x( @# x7 }

1 V$ p5 t3 e; H; o% q

2 C0 U, o. o: c
/ j! o# B* A4 N5 X; D
( e) x6 a  c" K) o0 `) i3 Z
# i( i+ A- K- S9 E/ X$ M. cwpa2psk-linksys.dump is the capture containing the four-way handshake

3 Y# B3 n  }" z7 U6 ]5 ], x; z
. X( _8 v3 U, B+ i" p
dict is the password file

" S4 S+ p4 R& b! S! [. v( p0 P- s& ?. R3 V1 k! [# B0 b
# A3 X; {9 C4 n/ d
7 T8 G: V& y# o! w9 `6 d% nlinksys is the network SSID

! w5 k3 Z$ K- V1 ~! g& _

' D) V$ x' J9 p2 e2 g* P' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
! }* y  v: C6 |1 q# BThe Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
http://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
7 ]) Y. Y0 m0 ~6 d. |
$ u- G9 _4 T, Q, C# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H

! U7 S" E* t8 h! a0 U1 X4 s  t8 o6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
5 Y) Q- _6 I# I2 G; q6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊