Aircrack Ng File To Crack Specified
Aircrack No File To Crack Specified Key

by hash3liZer . 09 September 2019

WPA/WPA2 cracking has been a focus point in the community since many years. And we have tools to aim that focus like aircrack and hashcat. Some new advancements have been made to aid that focus in the past couple of years.

So, Cracking WPA/WPA2 has been quite a topic now. In this tutorial, we are going to cover one of the infamous tools 'hashcat' for cracking WPA/WPA2.

Hashcat which is primarily built for brute forcing different kind of hashes using different kind of attack vectors, supports cracking for two of badly known WPA/WPA2 attacks. Well, for the list of available hashes, you can check the hash modes section in the manual:

In previous, you might have seen or even worked with aircrack to crack WPA/WPA2 by capturing a 4-way handshake. But that was not anywhere close to how perfect could this tool be for the purpose. Besides, hashcat is a GPU + CPU maintained tool which makes it a lot more faster.

Aircrack-ng: Fixed ignoring -p when specified after -S. Airmon-ng: fixes for openwrt busybox ps/grep issues which do not seem present in other versions of busybox. Use last used directory when selecting another file to crack. GUI (windows): Allow.pcap files too (next to.cap, ). No file to crack specified. 'aircrack-ng -help' for help. I see 'No file to crack specified'. « Last Edit: May 06, 2018, 04:24:23 pm by exupand » Logged misterx.

In short, if you own a GPU, always go for hashcat or else you could use an online service or buy out some GPU based server on Internet.

We will cover up with two famous WPA/WPA attacks, precisely the cracking of MIC (4-way handshake) and PMKID (1st packet/handshake). So, let's begin.

Installation

Hashcat is built to work on Windows, Linux and as well as on Mac. You can go to hashcat.net and download the binaries and follow the instruction for your operating system. What we are going to do here is clone a fresh copy of hashcat from github and manually install it on a debain based linux.

Preferably, you should use Kali Or Parrot but a similar distro like Ubuntu will work as well.

Update Your Repo's and install the following dependencies:

Clone hashcat from github and move to directory:

Finally, compile the binaries and we are all set with hashcat.

You may try printing the help manual for hashcat to check whether you have it installed perfectly or not.

Hcxtools:

Now, let's clone and compile hcxtools from github. It is basically a set of various files to convert and generate another version of the supplied input. We will use it to convert the captured traffic into a format understandable by hashcat.

First, clone the repo and move the hcxtools directory:

And finally, run the make command to compile binaries and make necessary changes in path.

After having the requirements installed, we move to the cracking part. Below this, i am dividing the tutorial into two parts, first we will crack the WPA/WPA2 using MIC aka 4-way handshake. While in second, i'll do cracking using PMKID.

PART A

Let's clear how the MIC cracking actually works. So, in this case, we need a valid 4-way handshake. The handshake consists of many keys that are interchanged during the authentication between the client and access point.

These independent keys are used to generate a common key named 'Message Integrity Code (MIC)'. This generated MIC is used to validate the given password by cracker.

The algorithm to compute MIC is quite long and tricky and i've have covered that up in another tutorial here. So, let the cracking begin.

STEP 1

Conversion to hccapx format

Supposing you already have a captured 4-way handshake using some tool like airodump, but you still need the proper format to supply it to hashcat. To convert it to a proper format (hccapx), you need another tool.

There are already some online services that you may use: https://hashcat.net/cap2hccapx/

But still in case you are wondering to do it locally, clone the hashcat-utils repo from github:

Finally, compile the binaries. After compiling, you will have the binaries under same directory. The binary file that we need is cap2hccapx.bin. To make sure, you have it correctly compiled, try to execute the file, it will throw you back the syntax:

So, after having it installed, use the below given syntax to convert the .cap file to .hccapx hashcat capture format.

So, this will generate a file by the name 'hashfile.hccapx', which is what we are going to use with hashcat. Now, you may move to whatever directory you want, since will be cracking the final format now.

STEP 2

Cracking WPA/WPA2 (handshake) with hashcat

With hashcat, there is a possibily of various attack vectors. We could do a straight dictionary attack, brute-force attack, combinator attack or even masks attack, i.e. making rules to find various possibilities of trying different characters at different positions.

Anyhow, let's study the actual cracking of WPA/WPA2 handshake with hashcat.

Dictionary Attack:

As named, you need a wordlist for it to work. Considering you have solid list of possible wifi passphrases, or if not, you can download the famous ones: https://www.wirelesshack.org/wpa-wpa2-word-list-dictionaries.html

Launch the following command for dictionary attack:

-a: specifies cracking mode. In our case it's dictionary mode and '/path/to/dict.txt' is complete path to the wordlist.
-m: hash mode. Specifies what type of hash we are dealing with.

In Case You Receive issues regarding Intel CPU or 'No devices found/left', use --force argument to force the usage of your device.

Brute-Force Attack:

The Brute-force is different than the dictionary attack. Here, we try to replace every character at every possible position in a specified length from a given charset. For example, in a string of length 8, we can try every character from A-Z at every postion in this string.

That's how brute-forcing works and hence very time-consuming. Launch the following command to start your first attempt for brute-forcing:

-a: specifies the cracking mode and here the value 3 indicates, we are running a brute-force attack.
?d?d?d?d?d?d?d?d: is the brute-forcing rule here. It specifies what kind of values to check, where to replace and also assumes how much time could it take to crack the key.

The above mask i.e. '?d?d?d?d?d?d?d?d' states to check a string of length 8 with a digit at every position. You can study about mask attack here: Hashcat Mask Attack.

PART B

Part A was about the handshake cracking. Whilst now, we are going to crack PMKID with hashcat. The PMKID is located in the 1st packet of 4-way handshake and hence it's kind of more useful because we don't need a complete handshake.

The algorithm to compute PMKID is given which is quite easier than that of MIC.

Let the cracking begin for PMKID.

STEP 1

Getting the PMKID hash

The first thing to proceed with PMKID cracking is the pmkid hash. To generate it we need the first packet of the 4-way handshake. Considering you already have that, we will extract the hash from the captured file.

If you are not aware of how to capture the first packet of 4-way handshake, follow this tutorial.

Let's do the conversion. Execute the below command

This will generate a file by the name pmkid.hash that we will use with hashcat to do the cracking.

STEP 2

Cracking WPA/WPA2 (PMKID) with hashcat

Just like previous part, we will apply the same rules here except for the hash mode argument. The hash mode value for PMKID cracking is 16800.

Dictionary Attack:

As per syntax we have back in the PART A section for dictionary attack, we will use that very same syntax except for the -m argument which defines what kind of hash we want to

Aircrack No File To Crack Specified