Results - 117kk/Aircrack-Project GitHub Wiki
Results
Setup
The setup process included gathering necessary hardware and devices to begin the experiment.
A Cisco Linksys E1000 wireless device was used as the access point to be exploited. I used an Alpha AWUS036NEH wireless adapter to monitor and send wireless traffic from my Kali laptop. I Connected two windows 10 laptops to the Cisco access point using the password "Password1!".
After they had successfully connected to the access point, I headed over to my Kali machine. The Alpha wifi adapter was started in promiscuous mode using airmon-ng and was then ready to start the process.
images/Screenshot from 2018-02-17 11-38-23.png
Capturing Traffic
After everything was setup, I started the airodump-ng capture to find the BSSID of my Cisco access point.
images/Screenshot from 2018-02-17 11-41-34.png
I then recorded the BSSID of the access point as well as a MAC address of one of my personal windows 10 devices. Knowing this information, I was able to use aireplay-ng to send out some de-authorization packets to the windows 10 device.
images/Screenshot from 2018-02-17 11-42-48.png
The windows 10 device was disconnected from the access point as expected, and began to attempt to reconnect. All the traffic that was sent to/from the windows 10 device was captured by the airodump-ng scan and then was outputted to a file for later.
images/Screenshot from 2018-02-17 11-45-09.png
Decrypting the Password
Now that I had the WPA2 handshake traffic captured and outputted to a file, I ran aircrack-ng to decrypt the password.
images/Screenshot from 2018-02-17 11-48-03.png
The dictionary I used the in the first attempt was a massive 1.2Gb file of common passwords called 'BIG-WPA-LIST-1'. This file proved to be too massive for the hardware I was running Kali on, and would take way too long to work.
images/Screenshot from 2018-02-17 11-48-10.png
So I went ahead and created my own dictionary file that was much smaller and included the password I set on the access point in it. This was a measure taken to avoid the length of time that would of been required if I continued to use the massive dictionary.
images/Screenshot from 2018-02-17 11-51-18.png
This proved to be quite effective as the tool was able to successfully match the captured WPA2 encrypted key with the passphrase I included in the dictionary file. By utilizing this method I was able to save time while still being able to test the tools and obtain a successful proof-of-concept.
