直接搞定WPA和WPA2 无线密码P解工具

bamboossom

这么贵  还是买了

bamboossom

这么贵  还是英文的

bamboossom

这么贵  怎么不翻译下

bamboossom

这么贵  不懂 上当了

bamboossom

coWPAtty for Windows MAIN:; S; m, t( [/ `. e, Z# r! I3 T) S

"coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright.
# C7 }/ h9 R: N0 H
8 W/ O: l/ \6 f2 P4 G/ B. g6 \# H' R8 y
$ a( W8 Q+ ]* S& Y, VProject Homepage: http://www.willhackforsushi.com/Cowpatty.html
+ D% W+ A( g0 I4 k# o
7 d7 b& }6 g1 R. m0 r  P

1 L1 p: e& h! t% `% w2 f, i# @- u* B% {2 _1 v2 r- t
5 U7 {5 t8 z9 V. C8 JLocal Mirror: Cowpatty-4.0-win32.zip  MD5: aa9ead2aacfcc493da3684351425d4c6
8 p) r: }. z, H0 B

( A' I! E( W. S# W
% J0 V2 Y( \: i' b$ U! w( d) a, G4 S7 _* s
coWPAtty Dictionary Attack


: S$ ~$ T4 `: h& H
Precomputing WPA PMK to crack WPA PSK
- e. z) U" D5 V2 j# @% V9 v
  C8 R: t+ f7 `' ^& R

coWPAtty Precomputed WPA Attack
' V4 u. X$ b/ v# s/ Y- Z

( Z, x; R( v  ?" s1 h( q+ }& i, [0 H5 g: ~
coWPAtty Recomputed WPA2 Attack
( k1 Y% x7 V. ?6 I6 F2 ]2 q
( ~7 K/ u5 U# ]7 x3 u+ q" i
$ e% v7 W+ C' ?8 N( b% f9 l3 \
coWPAtty Tables
/ m4 D' G5 f: `% z$ {
: X/ ]3 g! I7 U
2 U+ K8 M6 b* H! W$ q! \% \coWPAtty Usage:7 b, W( \( k$ \! _
1 m+ V: T7 v5 p$ Z6 ?

4 B, t$ u$ t" i% D% I8 m5 g( P6 W- [( _( acoWPAtty Dictionary Attack:
) u) I5 n& `4 y* l" A
Toperform the coWPAtty dictionary attack we need to supply the tool witha capture file that includes the TKIP four-way handshake, a dictionaryfile of passphrases to guess with and the SSID for the network.

7 }" F6 I% c9 w) l
' d+ h9 j4 |+ h9 p* ]* u
9 }' |2 c" H9 E; i+ [In orderto collect the four-way handshake you can either wait until a clientjoins the network or preferably you can force it to rejoin the networkusing tools like void11 or aireplay and capture the handshakes usingsomething like kismet, ethereal or airodump.


, Y0 ~" g5 o  p. I+ T6 ]& l& }+ Y
cowpatty -f dict -r wpapsk-linksys.dump  -s linksys
1 F! n5 w2 u- q8 x2 ]2 H

; s! t7 r7 z2 ]! a: T4 q
! m, ^0 l1 @$ i/ [- g5 c7 X; R: ], M  W' K
6 d" q# v9 S  ^: `! u8 ^  O4 P- \! q  v- O" s, I
# o) f+ k& t8 P1 j' q5 C8 R, \8 r8 x; G9 ^" ^
- Y( a5 o+ d! _4 J+ q2 ^
As youcan see this simple dictionary attack took 51 seconds, we can speed upthis process by precomputing the WPA-PMK to crack the WPA-PSK (seebelow).
  I6 g1 U* @0 F& z! V. d! G' M9 O6 i
% i% \2 ?0 |2 x/ I4 f- e. D. V
$ k$ Z6 G  f; t# e* H; P( J: j. a% W, @
wpapsk-linksys.dump is the capture containing the four-way handshake

5 k7 P% [7 V0 ^4 o+ P1 }6 ^

, V: m6 W; D7 f. T" Z% x- [dict is the password file

$ J) z. {; K0 K( e2 L; X6 V
( ?3 m3 `# m* \* z0 V
linksys is the network SSID
) {0 U( k9 h( t

4 d4 G) s5 t& G* H7 r! N, T$ Y+ ?9 i& l
Precomputing WPA PMK to crack WPA PSK:
9 q7 u" }+ G; X0 N7 E8 v6 M" O' }" Y
genpmkis used to precompute the hash files in a similar way to Rainbow tablesis used to pre-hash passwords in Windows LANMan attacks.  There is aslight difference however in WPA in that the SSID of the network isused as well as the WPA-PSK to "salt" the hash.  This means that weneed a different set of hashes for each and every unique SSID i.e. aset for "linksys" a set for "tsunami" etc.
/ e/ a8 P% z' ^! x

7 v& s; ?9 t' Q* R0 Q3 a% ?% z  F0 A( K; g+ `+ P& e! U5 F. a! {* B2 U: |
, P' y& i+ N1 W$ J$ N  g
So to generate some hash files for a network using the SSID cuckoo we use:
7 D, G  l) Q; H2 V" `6 y2 p* ?
- i# w4 I) c$ B8 k
& t$ @3 T3 @. i7 t/ r# i4 K3 L, |+ p& s/ D% g

8 y1 b8 }: v7 Dgenpmk  -f  dict  -d linksys.hashfile  -s linksys  

3 r( c% ?) b6 C# R0 X
0 _' _* `; ^% _4 z) N, S/ N* t

, C$ i# \/ v/ `6 C- P. U9 S


& J  S3 V. I$ U3 {9 m% r6 Q9 R/ n. X4 \  N+ l, ?8 P

( ~; W% x% c; ldict is the password file


5 S& D- f+ P% e# N9 s9 T& F" C9 X! z. V% l
linksys.hashfile is our output file
: g* [' c) U3 o5 B& S
4 q0 j( m  H2 X  k7 _! H7 w
2 U6 w8 H, h$ t) S0 p: o
% q) Q, j2 D+ w5 U/ Mlinksys is the network ESSID

( i% j3 C( `# i+ E- p8 r2 P# E# k+ t' ^9 C

8 o7 s4 s! Y( t& _7 _8 W- b- m+ Y& Z9 J' a7 HcoWPAtty Precomputed WPA Attack:
" I2 p' x7 _: N" Q8 [/ o# h- o% ^4 R
Now wehave created our hash file we can use it against any WPA-PSK networkthat is utilising a network SSID of cuckoo.  Remember the capture(wpa-test-01.cap) must contain the four-way handshake to be successful.
% Z0 c' B% j! U- l* b2 ~
. K/ S1 {- f& g7 u' S
9 }, I; S, H- t6 u( c8 W, U8 h' j; e) R# Q8 ?- t
- o: q- X2 Y- ?9 u3 c. o
cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys  


0 E3 W7 n# ~+ ]1 m0 V0 Z+ Y$ [6 d0 G" c, ^6 P" c
7 U$ e, I- H5 m- h/ a0 \9 E8 S
8 W+ i$ G; p( |1 B- ~

0 U! Q! M7 ^& @8 l% j8 C9 \2 D! P3 Q. m2 n0 X1 P
) t  x0 e! n, K" w% I, q& f; w
wpa-test-01.cap is the capture containing the four-way handshake

7 v' p( l$ P; ?' g
, u1 o2 T" v1 W* R3 b' X, ?6 D0 }/ I+ k9 q$ _; a
linksys.hashfile are our precomputed hashes
$ W) G$ z4 R9 J* v  q
7 _$ r3 J( ]1 H3 N( n
; {* c- X3 S1 z. E, u3 k5 W) S7 J1 M) O  W, e- W) L! A6 {" C! c
linksys is the network ESSID
1 j( t' l/ Z0 h( G
2 z3 D' ~% Q9 e& m; I6 d
" F: b, k6 a% }) z( a0 X( u) O* ?% ~( Y( `) I
! ^5 Z  @  M% N* `4 j. t# V
% w9 i2 Q& p  M5 jNotice that cracking the WPA-PSK took 0.04 seconds with the pre-computed attacked as opposed to 200 secondswith standard dictionary attack mode, albeit you do need to pre-computethe hash files prior to the attack.  However, precomputing large hashfiles for common SSIDS (e.g. linksys, tsunami) would be a sensible movefor most penetration testers.
6 w( e, f% B1 r

9 M: h5 N6 E" Q# l* K# Z( F! H4 x2 Z. h/ v9 I' b! |- p& A/ I; X3 C) \& ~) [
coWPAtty Precomputed WPA2 Attack:
$ U3 j2 Q% _7 x5 P9 N* q$ [# x! P- V$ E' z* M# \" I
/ ?7 R( i1 D2 J$ i9 P9 gcoWPAtty4.0 is also capable of attacking WPA2 captures.  Note: The same hashfile as was used with the WPA capture was also used with the WPA2capture.

; D0 Y" q/ C: P+ I/ O9 x
9 [. Y: b  U* F  q2 a! I% d
cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys

" ^+ _- b6 t5 x( @# x7 }


* s0 g: i$ g- ^$ E
: n$ B, s$ d& u! _! L" F7 E
/ j! o# B* A4 N5 X; D
( e) x6 a  c" K) o0 `) i3 Z
wpa2psk-linksys.dump is the capture containing the four-way handshake

1 n: _9 z$ @9 E% B1 V  H0 d
. X( _8 v3 U, B+ i" p
8 }6 n/ B& j/ x* u5 Mdict is the password file
: p+ D* x: p* Z% r( Q8 |7 k: L/ D
. S3 K' F$ D* L- _" U. v( p0 P- s& ?. R3 V1 k! [# B0 b
6 T; Q# w) H; O( J. h+ l* Z# l3 {
! M/ U% T  D2 E$ ~' A: ?! ilinksys is the network SSID
0 v* W8 w( I2 J# C0 [
! w5 k3 Z$ K- V1 ~! g& _

: M( v! d) W+ o' H: ]5 L/ v- h( F. x5 [coWPAtty Tables: ) ^4 o  }: \& d" u& k
$ Z* I$ |. g; l0 |The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file.  The resultant table are approximately 7 Gigabytes in size and can be downloaded via Torrent:
5 v) t# g: [  Q$ O4 R  }2 z" C' `- u6 g# T& I* k6 q  v% Q9 o0 G* m
9 p7 P. v0 Q* {. Uhttp://torrents.lostboxen.net/co ... atty-4.0_2006-10-19$ x- v6 z* \, R2 Z
8 y3 ]: n% a% \# y- m4 S" o
( ^, M: N. R# R0 {# }$ g/ V1 g( @2 _  H% I, BA 33 Gigabyte set of tables are also available: http://umbra.shmoo.com:6969/5 J  G# p0 f8 p4 `$ g8 L1 H
4 Y& z! F7 U5 i
. m, J" m, Q1 A1 a) W) R/ a/ @6 z% R! @; `) {5 [Or you can buy them via DVD, direct from Renderman (initiator of the project): http://www.renderlab.net/projects/WPA-tables/
6 S/ x, G5 d- Y/ N' Y# b1 P# k$ B

yelow

楼主这是在抢钱啊

zhuguo75

hahoahaoahoahao

secowu

机器要跑好几个光年

simplezhe

有这东西???????????????????????????????????????

zonly

骗人的，好像，还是不买了。楼主不厚道

bingy

这还叫分享吗/

shenxli

是不是真的啊 买的人来回帖一下啊