Scribd Logo
Upload

Welcome to Scribd!

  • 74 views

    Cowtwifi

    Uploaded by

    Miguel Férreras Light
    coWPAtty is a tool for auditing the pre-shared key selection for WPA networks using the TKIP protocol. It can perform dictionary attacks by cracking captured four-way handshakes against wordlists. Precomputing the hashes with genpmk first speeds up the cracking process significantly. Large precomputed tables against common SSIDs and wordlists have also been generated by other parties to allow extremely fast cracking of WPA handshakes.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd

    Cowtwifi

    Uploaded by

    Miguel Férreras Light
    74 views4 pages
    coWPAtty is a tool for auditing the pre-shared key selection for WPA networks using the TKIP protocol. It can perform dictionary attacks by cracking captured four-way handshakes against wordlists. Precomputing the hashes with genpmk first speeds up the cracking process significantly. Large precomputed tables against common SSIDs and wordlists have also been generated by other parties to allow extremely fast cracking of WPA handshakes.

    Original Title

    cowtwifi

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    coWPAtty is a tool for auditing the pre-shared key selection for WPA networks using the TKIP protocol. It can perform dictionary attacks by cracking captured four-way handshakes against wordlists. Precomputing the hashes with genpmk first speeds up the cracking process significantly. Large precomputed tables against common SSIDs and wordlists have also been generated by other parties to allow extremely fast cracking of WPA handshakes.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    74 views4 pages

    Cowtwifi

    Uploaded by

    Miguel Férreras Light
    coWPAtty is a tool for auditing the pre-shared key selection for WPA networks using the TKIP protocol. It can perform dictionary attacks by cracking captured four-way handshakes against wordlists. Precomputing the hashes with genpmk first speeds up the cracking process significantly. Large precomputed tables against common SSIDs and wordlists have also been generated by other parties to allow extremely fast cracking of WPA handshakes.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 4

     

    coWPAtty MAIN:
     
    "coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks
    based on the TKIP protocol." - Joshua Wright.
     
     
    Project Homepage: http://www.willhackforsushi.com/Cowpatty.html
     
     
    also see: http://www.renderlab.net/projects/WPA-tables/
     
     
    Local Mirror: cowpatty-4.6.tgz  MD5: b90fd36ad987c99e7cc1d2a05a565cbd
     
     
    Installing coWPAtty
     
    coWPAtty Dictionary Attack
     
    Precomputing WPA PMK to crack WPA PSK
     
    coWPAtty Precomputed WPA Attack
     
    coWPAtty Tables
     
     
    NOTE: coWPAtty 4.0 and above also include WPA2 attack capabilities (usage
    remains the same).
     
     

    Installing coWPAtty:
     
    Download the latest coWPAtty (currently coWPAtty-4.2) to /tools/wifi
     
    tar zxvf cowpatty-4.2.tgz
     
    cd cowpatty-4.2
     
    make
     
     

    coWPAtty Dictionary Attack:


     
    To perform the coWPAtty dictionary attack we need to supply the tool with a capture
    file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess
    with and the SSID for the network.
     
    In order to collect the four-way handshake you can either wait until a client joins the
    network or preferably you can force it to rejoin the network using tools like void11 or
    aireplay and capture the handshakes using something like kismet, ethereal or airodump.
     
    ./cowpatty -r  wpa-test-01.cap -f dict -s cuckoo
     
     

     
     
    As you can see this dictionary attack took in excess of 3 minutes, we can speed up this
    process by precomputing the WPA-PMK to crack the WPA-PSK (see below).
     
    wpa-test-01.cap is the capture containing the four-way handshake
     
    dict is the password file
     
    cuckoo is the network SSID
     
     

    Precomputing WPA PMK to crack WPA


    PSK:
     
    genpmk is used to precompute the hash files in a similar way to Rainbow tables is used
    to pre-hash passwords in Windows LANMan attacks.  There is a slight difference
    however in WPA in that the SSID of the network is used as well as the WPA-PSK to
    "salt" the hash.  This means that we need a different set of hashes for each and every
    unique SSID i.e. a set for "linksys" a set for "tsunami" etc..
     
     
    So to generate some hash files for a network using the SSID cuckoo we use:
     
     
    ./genpmk  -f  dict  -d hashfile  -s cuckoo 
     

     
    dict is the password file
     
    hashfile is our output file
     
    cuckoo is the network SSID
     
     

    coWPAtty Precomputed WPA Attack:


     
    Now we have created our hash file we can use it against any WPA-PSK network that is
    utilising a network SSID of cuckoo.  Remember the capture (wpa-test-01.cap) must
    contain the four-way handshake to be successful.
     
     
    ./cowpatty  -r  wpa-test-01.cap  -d  hashfile  -s cuckoo 
     
     
     
     
    wpa-test-01.cap is the capture containing the four-way handshake
     
    hashfile is our precomputed hashes
     
    cuckoo is the network SSID
     
     
    Notice that cracking the WPA-PSK took 0.21 seconds with the pre-computed attacked
    as opposed to 200 seconds with standard dictionary attack mode, albeit you do need to
    pre-compute the hash files prior to the attack.  However, precomputing large hash files
    for common SSIDS (e.g. linksys, tsunami) would be a sensible move for most
    penetration testers.
     
     

    coWPAtty Tables:
     
    The Church of Wifi have produced some lookup tables for 1000 SSID's computed
    against a 170,000 word password file. 
     
    The resultant table are approximately 7 Gigabytes [LINK NO LONGER
    AVAILABLE]
     
     
    A second set of 33 Gigabytes tables were later produced and are available via:
    http://umbra.shmoo.com:6969/
     
    Or you can buy them via DVD, direct from Renderman (initiator of the project):
    http://www.renderlab.net/projects/WPA-tables/

    You might also like