Today’s post will explain how to crack WiFi or wireless passwords in just 10 to 15 minutes. Previous articles have described the different wireless scanning tools and scanning wireless networks using NetStumbler. Today I will explain how to hack or crack wifi passwords. The hack will be based on cracking the WEP encryption password. I have also included a video at the bottom of the post.
STEPS TO HACK WIFI OR WIRELESS PASSWORD
1. Get the Backtrack-Linux CD. Backtrack Linux Live CD (the best Linux available for hackers, with more than 2000 hacking tools inbuilt).
Download Backtrack Linux Live CD from here: CLICK HERE
2. SCAN TO GET THE VICTIM
Identify your victim
Enter the Backtrack Linux CD into your CD drive and start it. Once it starts, click on the black box in the lower left corner to load up a “KONSOLE.” Then start your Wifi card. To do it so type
airmon-ng
You will see the name of your wireless card (mine is named “ath0” – from here on out, replace “ath0” with the name of your card). Now type
airmon-ng stop ath0
then type:
ifconfig wifi0 down
then type:
macchanger –mac 00:11:22:33:44:55 wifi0
then type:
airmon-ng start wifi0
These steps spoof our MAC address, to avoid being traced.
Now type:
airodump-ng ath0
All the above steps in one screen shot:
Now you will see a list of wireless networks in the Konsole. Pick the one with the best signal strength. Using a poor signal will increase the time it takes to crack or hack the password, or may prevent you from hacking it at all.
Once you see the networks list, select the one you want to hack. To freeze the airodump screen HOLD the CNTRL key and Press C.
Now you will see something like this:
Now you will see something like this:
3. SELECTING NETWORK FOR HACKING
Find the network you want to crack and MAKE SURE that it says the encryption for that network is WEP. If it says WPA or any variation of WPA then move on. You can still crack WPA with backtrack or other tools, but it’s a completely different level and you need to master WEP first.
Once you’ve decided on a network, take note of its channel number and bssid. The bssid will look something like this —
00:23:69:bb:2d:of
The Channel number will be under a heading that says “CH”.
As shown in this figure:
Now in the same KONSOLE window type:
airodump-ng -c (channel) -w (file name) –bssid (bssid) ath0
The file name can be whatever you want. This file is the place where airodump is going to store the packets of info that you receive to later crack. It doesn’t need to be complicated and doesn’t require an extension.I usually make mine “Ben” because I love Ben 10 and I always remember it.
Note: If you want to crack more than one network in the same session, you must have different file names for each one.
Once you type in that last command, the screen of airodump will change and start to show your computer gathering packets. You will also see a heading marked “IV” with a number underneath it. This stands for “Initialization Vector” but in general terms all this means is “packets of info that contain characters of the password.” Once you gain a minimum of 5,000 of these IV’s, you can try to crack the password. I’ve cracked some right at 5,000 and others have taken over 60,000. It just depends on how long and difficult they made their password. The more difficult the password, the more packets you will need to crack it.
4. Cracking the WEP password
Leave this Konsole window up and running and open up a 2nd Konsole window.
In this window type:
aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:55 ath0
This will send some commands to the router that basically associates your computer, even though you are not officially connected with the password. If this command is successful, you should see about 4 lines of text print out with the last one saying something similar to “Association Successful.”
If this happens, then good! You are almost there.
Now type:
aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:55 ath0
This will generate a large quantity of text and then you will see a line where your computer is gathering a several packets and waiting on ARP and ACK. Don’t worry about what these mean, just know this is a good sign. Sit and wait. Once your computer finally gathers an ARP request, it will send it back to the router and begin to generate hundreds of ARP and ACK per second. Sometimes this starts to happen within seconds, sometimes you have to wait up to a few minutes. Just be patient. When it finally does happen, switch back to your first Konsole window and you should see the number underneath the IV starting to rise rapidly. This is great! It means you are almost finished! When this number reaches AT LEAST 5,000 then you can start your password crack. It will probably take more than this but I always start my password cracking at 5,000 just in case they have a really weak password.
Now you need to open up a 3rd and final Konsole window. This will be where we actually crack the password.
Type:
aircrack-ng -b (bssid) (filename)-01.cap
Remember the file name you made up earlier? Mine was “Ben.” Don’t put a space in between it and -01.cap here. Type it as you see it. So for me, I would type “wepkey-01.cap”
Once you have done this you will see aircrack fire up and begin to crack the password. You typically need to wait for 10,000 to 20,000 IV’s before it will crack. If this is the case, aircrack will test what you’ve got so far and then it will say something like “not enough IV’s. Retry at 10,000.”
Once you have done this you will see aircrack fire up and begin to crack the password. You typically need to wait for 10,000 to 20,000 IV’s before it will crack. If this is the case, aircrack will test what you’ve got so far and then it will say something like “not enough IV’s. Retry at 10,000.”
DON’T DO ANYTHING! It will continue running, it is just letting you know that it is on pause until more IV’s are gathered. Once you pass the 10,000 mark it will automatically fire up again and try to crack it. If this fails it will say “not enough IV’s. Retry at 15,000” and so on until it finally gets it.
If you did everything correctly up to this point, before too long you will have the password! Don’t worry if it looks a little strange, some passwords are saved in ASCII format, in which case, aircrack will show you exactly what characters they typed in. Sometimes the password is saved in HEX format in which case the computer will show you the HEX encryption of the password. You can type in either one and it will connect you to the network.
Take note, though, that the password will always be displayed in aircrack with a colon after every 2 characters. So for instance if the password was “secret”, it would be displayed as:
se:cr:et
This would obviously be the ASCII format. If it was a HEX encrypted password that was something like “0FKW9427VF” then it would still display as:
0F:KW:94:27:VF
Just omit the colons from the password, boot back into whatever operating system you use, try to connect to the network and type in the password without the colons and presto! You are in!
It may seem like a lot to deal with if you have never done it, but after a few successful attempts, you will be very adept. If I am near a WEP encrypted router with a good signal, I can often crack the password in just a couple of minutes.
I am not responsible for what you do with this information. Any malicious/illegal activity falls completely on you because, technically, this is just for you to test the security of your own network.
I hope you all liked it. If you have any queries ask in the comments.
Ravi says
Bro How To crack WPA , WPA2 Pass ….
?
i don’t have a Wordlist dictionary list…
spy Man says
Can you create a software on this so that it id done automatically. I need an easy way to get credit cards
DEV says
Hello sir, can I put email address in tenda router
So that I receive password when it changed by owner.
Anonymous says
is there any easier method (i mean which is simple to execute and there is no such complication)
Anonymous says
Thanx, i’ll try …. Sid
Anonymous says
Don’t u think mentioning MONITOR mode would be helpful? I mean it is necessary for this to work! Forget all this if you do not have a wifi card that is capable of monitor mode and utilizing the correct drivers. Use the LIVE DISK version of backtrack dont install it. AND TO THE GUY ABOVE SINCE WHEN DOES MEMORY = HARD DRIVE SPACE?? Go back to basic computers 101.
Anonymous says
Cd not insatlling properly bro…
Anonymous says
yes :(
sid says
Lokesh, buddy whenever i tried installing Backtrack3 CD it shows this error on cmd :
‘warning: not enough free memory’ while i have almost 40 gb free space on hard disk