For the most part, aircrack-ng is ubiquitous for wifi and network hacking. But in this article, we will dive in in another tool – Hashcat, is the self-proclaimed world’s fastest password recovery tool. It had a proprietary code base until 2015, but is now released as free software and also open source. Versions are available for Linux, OS X, and Windows and can come in CPU-based or GPU-based variants.
What is different between aircrack-ng and hashcat?
Basically, Hashcat is a technique that uses the graphics card to brute force a password hash instead of using your CPU, it is fast and extremely flexible- to writer made it in such a way that allows distributed cracking. aircrack-ng can only work with a dictionary, which severely limits its functionality, while oclHashcat also has a rule-based engine.
Before we go through I just want to mention that you in some cases you need to use a wordlist, which is a text file containing a collection of words for use in a dictionary attack. And, also you need to install or update your GPU driver on your machine before move on.
Setup environment
Suppose this process is being proceeded in Windows. First, to perform a GPU based brute force on a windows machine you’ll need:
Jul 24, 2019 Wifi Hacker, a New Wifi Hacking tool and method discovered to hack wifi password WPA/WPA2 enabled WiFi networks that allow WiFi Hackers to gain PSK. Using the above method now WiFi Hackers can hack the WiFi Password with the help of Wifi hackers app and other hacking apps that primarily used by hackers to attack wifi networks and hack the wifi connected devices. This video shows how to manually create an evil twin network to steal WiFi password / key of a target network.The same method can be used to start a normal f. How i can hack 'WPA - CCMP,WPA- TKIP' using windows. I try alot to use commview for wifi but it dosn't work with me. If there are tricks and its work please post here. ThanksQuote:Why do you have to use Windows? Use Aircrack-ng in Linux, much easier in my opinion, though I've never tried cracking WPA, WEP, etc in Windows. Feb 14, 2019 The new WiFi hack, discovered by the lead developer of the popular Hashcat password cracking tool, Jens’ Atom’ Steube, explicitly works against WPA / WPA2 wireless network protocols with enabled roaming features based on the Pairwise Master Key Identifier (PMKID). Mar 19, 2018 Design flaws in many routers can allow hackers to steal Wi-Fi credentials, even if WPA or WPA2 encryption is used with a strong password. While this tactic used to take up to 8 hours, the newer WPS Pixie-Dust attack can crack networks in seconds. To do this, a modern wireless attack framework called Airgeddon is used to find vulnerable networks, and then Bully is used to crack them.
Then:
- You need to go to the home page of Hashcat to download it at: https://hashcat.net/hashcat/
- Then, navigate the location where you downloaded it. Then unzip it, on Windows or Linux machine you can use 7Zip, for OS X you should use Unarchiever.
- Open up your Command Prompt/Terminal and navigate your location to the folder that you unzipped. If you haven’t familiar with command prompt yet, check out this article.
- Run the executable file by typing
hashcat32.exeorhashcat64.exewhich depends on whether your computer is 32 or 64 bit (typemakeif you are using macOS).
WPA2 dictionary attack using Hashcat
Open cmd and direct it to Hashcat directory, copy .hccapx file and wordlists and simply type in cmd
Here I have NVidia’s graphics card so I use CudaHashcat command followed by 64, as I am using Windows 10 64-bit version. yours will depend on graphics card you are using and Windows version(32/64).
cudaHashcat64.exe – The program, In the same folder theres a cudaHashcat32.exe for 32 bit OS and cudaHashcat32.bin / cudaHashcat64.bin for Linux. oclHashcat*.exe for AMD graphics card.
-m 2500 = The specific hashtype. 2500 means WPA/WPA2.
In case you forget the WPA2 code for Hashcat.
Windows CMD: cudaHashcat64.exe –help | find “WPA”
Linux Terminal: cudaHashcat64.bin –help | grep “WPA”
It will show you the line containing “WPA” and corresponding code.
Handshake-01.hccap = The converted *.cap file.
wordlist.txt wordlist2.txt= The wordlists, you can add as many wordlists as you want. To simplify it a bit, every wordlist you make should be saved in the CudaHashcat folder.
After executing the command you should see a similar output:
Wait for Hashcat to finish the task. You can pass multiple wordlists at once so that Hashcat will keep on testing next wordlist until the password is matched.
WPA2 Mask attack using Hashcat
As told earlier, Mask attack is a replacement of the traditional Brute-force attack in Hashcat for better and faster results.
let’s have a look at what Mask attack really is.
In Terminal/cmd type:
cudaHashcat64.exe -m 2500 <rootsh3ll-01.hccapx> -a 3 ?d?l?u?d?d?d?u?d?s?a
-a 3 is the Attack mode, custom-character set (Mask attack)
?d?l?u?d?d?d?u?d?s?a is the character-set we passed to Hashcat. Let’s understand it in a bit of detail that
- What is a character set in Hashcat ?
- Why it is useful ?
Hack Wpa Wifi
What is a character set in Hashcat ?
?d ?l ?u ?d ?d ?d ?u ?d ?s ?a = 10 letters and digits long WPA key. Can be 8-63 char long.
The above text string is called the “Mask”. Every pair we used in the above examples will translate into the corresponding character that can be an Alphabet/Digit/Special character.
For remembering, just see the character used to describe the charset
?d: For digits
?s: For Special characters
?u: For Uppercase alphabets
?l: For Lowercase alphabets
?a: all of the above.
Simple! isn’t it ?
Here is the actual character set which tells exactly about what characters are included in the list:
Here are a few examples of how the PSK would look like when passed a specific Mask.
PSK = ?d?l?u?d?d?d?u?d?s?a
0aC575G2/@
9zG432H0*K
8sA111W1$4
3wD001Q5+z
So now you should have a good understanding of the mask attack, right ?
Let’s dig a bit deeper now.
Mixing Mask attack with Custom characters.
Let’s say, we somehow came to know a part of the password. So, it would be better if we put that part in the attack and randomize the remaining part in Hashcat, isn’t it ?
Sure! it is very simple. Just put the desired characters in the place and rest with the Mask.
Hack Wpa2 Wifi Passwords Apk
Here?d ?l 123 ?d ?d ?u ?d C is the custom Mask attack we have used. Here assuming that I know the first 2 characters of the original password then setting the 2nd and third character as digit and lowercase letter followed by “123” and then “?d ?d ?u ?d” and finally ending with “C” as I knew already.
What we have actually done is that we have simply placed the characters in the exact position we knew and Masked the unknown characters, hence leaving it on to Hashcat to test further.
Here is one more example for the same:
Let’s say password is “Hi123World” and I just know the “Hi123” part of the password, and remaining are lowercase letters. Assuming length of password to be 10.
So I would simply use the command below
Where ?u will be replaced by uppercase letters, one by one till the password is matched or the possibilities are exhausted.
Moving on even further with Mask attack i.r the Hybrid attack.
In hybrid attack what we actually do is we don’t pass any specific string to hashcat manually, but automate it by passing a wordlist to Hashcat.
Hashcat picks up words one by one and test them to the every password possible by the Mask defined.
Example:
Hack Wpa2 Wireless Network
cudaHashcat64.exe -m 2500 handshake.hccapx -a 1 password.txt ?d?l?d?l
-a 1 : The hybrid attack
password.txt : wordlist
?d?l?d?l = Mask (4 letters and numbers)
The wordlist contains 4 words.
Now it will use the words and combine it with the defined Mask and output should be this:
carlos2e1c
bigfoot0h1d
guest5p4a
onion1h1h
It is cool that you can even reverse the order of the mask, means you can simply put the mask before the text file. Hashcat will bruteforce the passwords like this:
7a2ecarlos
8j3abigfoot
0t3wguest
6a5jonion
You getting the idea now, right ?
Using so many dictionary at one, using long Masks or Hybrid+Masks takes a long time for the task to complete. It is not possible for everyone every time to keep the system on and not use for personal work and the Hashcat developers understands this problem very well. So, they came up with a brilliant solution which no other password recovery tool offers built-in at this moment. That is the Pause/Resume feature
WPA2 Cracking Pause/resume in Hashcat (One of the best features)
This feature can be used anywhere in Hashcat. It isn’t just limited to WPA2 cracking. Even if you are cracking md5, SHA1, OSX, wordpress hashes. As soon as the process is in running state you can pause/resume the process at any moment.
Just press [p] to pause the execution and continue your work.
To resume press [r]. All the commands are just at the end of the output while task execution. See image below
You might sometimes feel this feature as a limitation as you still have to keep the system awake, so that the process doesn’t gets cleared away from the memory.
And we have a solution for that too. Create session!
WPA2 Cracking save Sessions and Restore.
Creating and restoring sessions with hashcat is Extremely Easy.
Just add –session at the end of the command you want to run followed by the session name.
Example:
Here I named the session “blabla”. You can see in the image below that Hashcat has saved the session with the same name i.e blabla and running.
Now you can simply press [q] close cmd, ShutDown System, comeback after a holiday and turn on the system and resume the session. That easy!
NOTE: Once execution is completed session will be deleted.
How to restore ?
Above command – “–restore”. Here it goes:
Hashcat will now check in its working directory for any session previously created and simply resume the Cracking process.
Simple enough ? Yes it is.
This is all for Hashcat. Hope you understand it well and performed it along. No need to be sad if you don’t have enough money to purchase those expensive Graphics cards for this purpose you can still try cracking the passwords at high speeds using the clouds. You just have to pay accordingly.
To specify device use the -d argument and the number of your GPU.
The command should look like this in end:
Example:
Where Handshake.hccapx is my handshake file, and eithdigit.txt is my wordlist, you need to convert cap file to hccapx using https://hashcat.net/cap2hccapx/
This article is referred from rootsh3ll.com.
If you are unable to Hack WPA / WPA2 WiFi network using WPS Feature, then you have to crack actual WPA / WPA2 encryption. In this hacking process, handshake packets are the only packets which helps in cracking the network. They contain data that can be used to check that WiFi password / key is valid or not. Handshake packets are the 4 packets, which are communicated between the client and the router, when the client connects to the network. These handshake packets can be used to crack WPA / WPA2 key.
Steps to Hack WPA / WPA2 WiFi Network using Word List Attack
Enable Monitor Mode of Wireless Interface Card.
Capture handshake packets using airodump-ng in Kali Linuxagainst your target network and store the data in a file called hack_wpa_handshake.
Now wait for the handshake packets to be captured. Handshake packets will only be sent when a new client is connected to the network. So, wait until new client is connected to the network.
OR
Alternatively you can use De-authentication Attack, where existing client is disconnected from the network and that client will automatically try to connect to the network again. Once that client is re-connected, handshake packets will be send in the air and then we can capture those handshake packets.
Once the new client is connected to the network or the existing client is disconnected and reconnected to the network, we will receive WPA handshake which is stored in a file called hack_wpa_handshake
Create a word list that contains the large number of passwords / keys
.
Once we have a handshake packet, we will create a word list document that contains password. This document is created usingcrunchtool.Go through the passwords in word list document one by one and use them with the handshake to check that whether password in the document is valid or not.
Use handshake packets to crack WPA/WPA2 password
For cracking WPA/WPA2 password, we will use tool named aircrack-ng. Aircrack-ng will unpack the handshake packet and will match the wordlist passwords one by one with the handshake packet.
There are multiple ways to crack WPA/WPA2 passwords using wordlist attack. Some save the cracking progress and some does not save the cracking progress.
Use aircrack-ng to run wordlist attack to crack WPA/WPA2 passwords without saving cracking progress
In the above command:
- aircrack-ngis the name of the program
- hack_wpa_handshake-01.capis the handshake file which we captured before
- -w PasswordList.txtis the name of my word list document, which contains large number of passwords
aircrack-ng tool runs through the word list document, match each word in the word list with the handshake packet one by one. And at the end, we are able to find the key “abc12345” which is our WiFi network key
For big word list documents, it may takes many hours / days to try all the possible passwords. There could be much bigger dictionaries, that can take many many days to crack the passwords. If we quit aircrack-ng during the process and run the command again, it will lose the session and will start the cracking session from scratch.Save cracking progress while cracking WPA/WPA2 passwords using John the Ripper
In this attack, we will save the cracking session while running aircrack-ng command. So, if we quit aircrack-ng and come back after some time then our session will still be there and we can start the session from where we left. We can save our cracking session usingpassword cracking tool named john the ripper
Here
- johnis the name of the password cracking tool
- –wordlist=PasswordList.txtis the name of the wordlist, which is stored in our current working directory
- –stdoutdisplay this wordlist on the terminal screen
- –session=hackrouter will store the session of john the ripper. Session name is hackrouter
- |using this pipe character (vertical bar), we will redirect the wordlist output and use it as an input to aircrack-ng
- -w – , in this -w attribute, we normally gives the wordlist document name but this time we will use the output generated by john command. And this can be done by using just the – (dash) instead of the wordlist document name
- -b 62:23:6A:96:69:73is the MAC address of my target network
- hack_wpa_handshake-01.capis the name of the handshake file
When john the rippercommand run, it will read all the passwords from a file PasswordList.txt, it will pipe them into aircrack-ng . Aircrack-ng will read these passwords and start cracking. Then when we exit at the middle, john the ripper will store this session in a file named hackrouter.
Now next step is to resume the session using this command
In the above command, we are telling john the ripper to restore the session from where it left last time. And this is stored in a session named hackrouter. This method allows you to stop the attack and start the attack whenever you want.