by hash3liZer . 09 September 2019
WPA/WPA2 cracking has been a focus point in the community since many years. And we have tools to aim that focus like aircrack and hashcat. Some new advancements have been made to aid that focus in the past couple of years.
Engine) for WPA cracking and evaluate whether the WPA encryption is strong enough and o ers enough security. Therefore it is tried to crack WPA by using brute force password cracking method, because it is the only known way to crack WPA 23 (WPA cracking is investigated in next chapter). A brute force password cracking is generally. Aircrack: Fast and effective WEP/WPA cracking tool Aircrack is a combination different tools used for Wifi, WEP and WPA passwords cracking. With the help of these tools you can crack WEP/WPA passwords easily and effectively Brute force, FMS attack, and dictionary attacks techniques can be used to crack WEP/WPA passwords. Jul 12, 2018 In order to use the GPU, you need to get its id using the following command; hashcat64.exe -I. Then you need to use the hash type which is 2500 for WPA, I do recommend using. Hashcat64.exe -help. To get familiar with the tool. To specify device use the -d argument and the number of your GPU. The command should look like this in end. WPA Cracking in the Cloud. The mechanism used involves captured network traffic, which is uploaded to the WPA Cracker service and subjected to an intensive brute force cracking effort. As advertised on the site, what would be a five-day task on a dual-core PC is reduced to a job of about twenty minutes on average.
4 thoughts on “Cracking WPA Passwords With a GeForce Graphics Card” Pingback: Geeks3D Test Cracking MD5 Passwords with a GeForce Graphics Card The Geeks Of 3D. Dan 2008/11/23 at 18:14. Thats amazing, i hope we could do this on the radeon’s jus reading this, cracking WPA pw with the nvidia’s makes me wanna buy it.
So, Cracking WPA/WPA2 has been quite a topic now. In this tutorial, we are going to cover one of the infamous tools 'hashcat' for cracking WPA/WPA2.
Hashcat which is primarily built for brute forcing different kind of hashes using different kind of attack vectors, supports cracking for two of badly known WPA/WPA2 attacks. Well, for the list of available hashes, you can check the hash modes section in the manual:
In previous, you might have seen or even worked with aircrack to crack WPA/WPA2 by capturing a 4-way handshake. But that was not anywhere close to how perfect could this tool be for the purpose. Besides, hashcat is a GPU + CPU maintained tool which makes it a lot more faster.
In short, if you own a GPU, always go for hashcat or else you could use an online service or buy out some GPU based server on Internet.
We will cover up with two famous WPA/WPA attacks, precisely the cracking of MIC (4-way handshake) and PMKID (1st packet/handshake). So, let's begin.
Best Gpu For Wpa Cracking Free Download
Installation
Hashcat is built to work on Windows, Linux and as well as on Mac. You can go to hashcat.net and download the binaries and follow the instruction for your operating system. What we are going to do here is clone a fresh copy of hashcat from github and manually install it on a debain based linux.
Preferably, you should use Kali Or Parrot but a similar distro like Ubuntu will work as well.
Update Your Repo's and install the following dependencies:
Clone hashcat from github and move to directory:
Finally, compile the binaries and we are all set with hashcat.
You may try printing the help manual for hashcat to check whether you have it installed perfectly or not.
Hcxtools:
Now, let's clone and compile hcxtools from github. It is basically a set of various files to convert and generate another version of the supplied input. We will use it to convert the captured traffic into a format understandable by hashcat.
First, clone the repo and move the hcxtools directory:
And finally, run the make command to compile binaries and make necessary changes in path.
After having the requirements installed, we move to the cracking part. Below this, i am dividing the tutorial into two parts, first we will crack the WPA/WPA2 using MIC aka 4-way handshake. While in second, i'll do cracking using PMKID.
PART A
Let's clear how the MIC cracking actually works. So, in this case, we need a valid 4-way handshake. The handshake consists of many keys that are interchanged during the authentication between the client and access point.
These independent keys are used to generate a common key named 'Message Integrity Code (MIC)'. This generated MIC is used to validate the given password by cracker.
The algorithm to compute MIC is quite long and tricky and i've have covered that up in another tutorial here. So, let the cracking begin.
STEP 1
Conversion to hccapx format
Supposing you already have a captured 4-way handshake using some tool like airodump, but you still need the proper format to supply it to hashcat. To convert it to a proper format (hccapx), you need another tool.
There are already some online services that you may use: https://hashcat.net/cap2hccapx/
But still in case you are wondering to do it locally, clone the hashcat-utils repo from github:
Finally, compile the binaries. After compiling, you will have the binaries under same directory. The binary file that we need is cap2hccapx.bin. To make sure, you have it correctly compiled, try to execute the file, it will throw you back the syntax:
So, after having it installed, use the below given syntax to convert the .cap file to .hccapx hashcat capture format.
So, this will generate a file by the name 'hashfile.hccapx', which is what we are going to use with hashcat. Now, you may move to whatever directory you want, since will be cracking the final format now.
STEP 2
Cracking WPA/WPA2 (handshake) with hashcat
With hashcat, there is a possibily of various attack vectors. We could do a straight dictionary attack, brute-force attack, combinator attack or even masks attack, i.e. making rules to find various possibilities of trying different characters at different positions.
Anyhow, let's study the actual cracking of WPA/WPA2 handshake with hashcat.
Dictionary Attack:
As named, you need a wordlist for it to work. Considering you have solid list of possible wifi passphrases, or if not, you can download the famous ones: https://www.wirelesshack.org/wpa-wpa2-word-list-dictionaries.html
Launch the following command for dictionary attack:
- -a: specifies cracking mode. In our case it's dictionary mode and '/path/to/dict.txt' is complete path to the wordlist.
- -m: hash mode. Specifies what type of hash we are dealing with.
In Case You Receive issues regarding Intel CPU or 'No devices found/left', use --force argument to force the usage of your device.
Brute-Force Attack:
Wpa Cracking Software
The Brute-force is different than the dictionary attack. Here, we try to replace every character at every possible position in a specified length from a given charset. For example, in a string of length 8, we can try every character from A-Z at every postion in this string.
That's how brute-forcing works and hence very time-consuming. Launch the following command to start your first attempt for brute-forcing:
- -a: specifies the cracking mode and here the value 3 indicates, we are running a brute-force attack.
- ?d?d?d?d?d?d?d?d: is the brute-forcing rule here. It specifies what kind of values to check, where to replace and also assumes how much time could it take to crack the key.
The above mask i.e. '?d?d?d?d?d?d?d?d' states to check a string of length 8 with a digit at every position. You can study about mask attack here: Hashcat Mask Attack.
PART B
Part A was about the handshake cracking. Whilst now, we are going to crack PMKID with hashcat. The PMKID is located in the 1st packet of 4-way handshake and hence it's kind of more useful because we don't need a complete handshake.
The algorithm to compute PMKID is given which is quite easier than that of MIC.
Let the cracking begin for PMKID.
STEP 1
Getting the PMKID hash
The first thing to proceed with PMKID cracking is the pmkid hash. To generate it we need the first packet of the 4-way handshake. Considering you already have that, we will extract the hash from the captured file.
If you are not aware of how to capture the first packet of 4-way handshake, follow this tutorial.
Let's do the conversion. Execute the below command
This will generate a file by the name pmkid.hash that we will use with hashcat to do the cracking.
STEP 2
Cracking WPA/WPA2 (PMKID) with hashcat
Just like previous part, we will apply the same rules here except for the hash mode argument. The hash mode value for PMKID cracking is 16800.
Dictionary Attack:
As per syntax we have back in the PART A section for dictionary attack, we will use that very same syntax except for the -m argument which defines what kind of hash we want to crack. We will be cracking pmkid (16800) this time.
While this would crack the key by looping through each line given in the wordlist.
Brute-Force Attack:
We will do same here as last section i.e. providing a mask to crack the hash. This time, just to show how powerful these masks could be, i'll use a different one. So, execute the command for brute-force attack:
The above mask will create combinations of string of length 8 with every alphabet at every possible position. And this sounds like a huge combination that may take a lot of time to complete. To make the attack more faster, we can use the GPU.
CPU/GPU
Now, getting into CPU/GPU thing, we just need to know that GPU is a lot more faster than CPU and hashcat have the ability to do cracking on your GPU. Hashcat has following three device modes which can be changed via -d argument:
- 1: CPU which is by default, selected.
- 2: GPU
- 3: DSP, Co-processor.
You can use one of these devices according to what's more suitable for you. For example,
To accomplish PMKID attack on GPU. That's it, i.e. cracking WPA/WPA2 via hashcat.
Best Gpu For Wpa Cracking Freeware
Conclusion
The conclusion that can be drawn out of all above is that hashcat is not just limited for a number of hashes, infact it's applicable to a wide range of hashes and other possibilities including mixes and concatenated strings. We learned to crack WPA/WPA2 using hashcat.
Besides, hashcat is known of it's power, stability and speed by operating on GPU. It also gives us the possibility of mask attack which let us play with possibilities of testing thousand of thousands strings against the hash.
For Any Questions, Queries, mistakes, you can comment down.
We all know we can use aircrack-ng to run a wordlist attack to crack WPA/WPA2, in this article I’m going to show you how to do the same using a tool called HashCat, and compare its speed with aircrack-ng.
The advantage of using HashCat is unlike aircrack-ng which uses the CPU to crack the key, HashCat uses the GPU, this makes the cracking process MUCH faster (results below).
Installing & using Hashcat
- First you need to download Hashcat from https://hashcat.net/hashcat/
- Navigate to the location where you downloaded it, and unzip it, personally I like to use 7zip.
- Open the Command Prompt (go to windows search and type cmd).
- Navigate to your Hashcat folder where it’s unzipped.
- Type hashcat32.exe or hashcat64.exe depending on the architecture of your CPU.
- In order to use the GPU, you need to get its id using the following command
mine is #3. Then you need to use the hash type which is 2500 for WPA, I do recommend using
to get familiar with the tool.
To specify device use the -d argument and the number of your GPU.
The command should look like this in end
Example:
Where Handshake.hccapx is my handshake file, and eithdigit.txt is my wordlist, you need to convert cap file to hccapx using https://hashcat.net/cap2hccapx/
Results:
Test1: Using HashCat, with Asus GTX 1080 OC edition which has GPU Boost Clock with 1936 MHz, total GB ram of 8 Gigabytes, and Cuda cores 2560.
CUDA = Computing performance Boost Clock = Increases the Clock speed.
Hashcat took 4 mins, 45secs to reach the end of the wordlist and crack the handshake with a wordlist of 100,000,000 passwords.
Test 2:Using Aircrack-ng on Kali installed as main operating system with is i7-7700k CPU – base clock of 4.20, turbo clock 4.50Ghz with 4 cores and 8 threads, it would take 4 hours 22 minutes 14 seconds try all the passwords in the wordlist.
Best Gpu For Wpa Cracking Free Download
Test 3: Kali installed as a virtual machine, in this case it would take 11 hours, 31 minutes and 40 seconds to try all passwords in the wordlist!