{"id":75917,"date":"2020-03-29T13:42:35","date_gmt":"2020-03-29T11:42:35","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov"},"modified":"2020-03-29T13:42:35","modified_gmt":"2020-03-29T11:42:35","slug":"rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov","title":{"rendered":"Aircrack-ng guide for beginners in Linux","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Hello everyone. With the course about to start <noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/2T7g\/\">Practical Course on Kali Linux<\/a><\/noindex> we have prepared a translation of an interesting article for you.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"Aircrack-ng guide for beginners in Linux\" src=\"\/wp-content\/uploads\/2020\/03\/f794182b2398b8742e8b706f279a857c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nToday's guide will introduce you to the basics for getting started with the <i>aircrack-ng<\/i>. Of course, it's impossible to provide all the necessary information and cover every scenario. So be prepared to do your homework and conduct research on your own. There are <noindex><a rel=\"nofollow\" href=\"https:\/\/forum.aircrack-ng.org\/\">forumet<\/a><\/noindex> og i <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=main\">Wiki<\/a><\/noindex> many additional tutorials and other useful information available.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Although it doesn't cover every step from start to finish, the guide <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=simple_wep_crack\">Simple WEP Crack<\/a><\/noindex> provides more details on working with <i>aircrack-ng<\/i>.<\/p>\n<h3>Hardware setup, installing Aircrack-ng<\/h3>\n<p>\n The first step to ensure proper operation <i>aircrack-ng<\/i> in your Linux system is patching and installing the appropriate driver for your network card. Many cards work with several drivers, some of which provide the necessary functionality for using <i>aircrack-ng<\/i>, while others do not. <\/p>\n<p>I think it's needless to say that you need a network card that's compatible with the package <i>aircrack-ng<\/i>. That is, hardware that is fully compatible and can perform packet injection. With a compatible network card, you can hack a wireless access point in less than an hour.<\/p>\n<p>To determine what category your card falls into, check the <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=compatibility_drivers\">hardware compatibility list<\/a><\/noindex>. Read the <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=compatible_cards\">Tutorial: Is My Wireless Card Compatible?<\/a><\/noindex>, if you\u2019re unsure how to read the table. However, this will not prevent you from reading the guide, which will help you learn something new and verify the characteristics of your card.<\/p>\n<p>To get started, you need to know what chipset your network card uses and what driver you need for it. You need to determine this using information from the above paragraph. In the <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=install_drivers\">drivers<\/a><\/noindex> section, you will find out which drivers you need.<\/p>\n<h3>Installing aircrack-ng<\/h3>\n<p>\n You can get the latest version of aircrack-ng by <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=main\">downloading it from the main page<\/a><\/noindex>, or you can use a distribution for penetration testing, such as Kali Linux or Pentoo, where the latest version is included. <i>aircrack-ng<\/i>.<\/p>\n<p>To install aircrack-ng, refer to the <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=install_aircrack\">installation documentation on the page<\/a><\/noindex>.<\/p>\n<h3>Basics of IEEE 802.11<\/h3>\n<p>\n Bra, n\u00e5 som alt er klart, er det p\u00e5 tide \u00e5 ta en pause f\u00f8r vi begynner \u00e5 handle og l\u00e6re noe om hvordan tr\u00e5dl\u00f8se nettverk fungerer. <\/p>\n<p>Den neste delen er viktig \u00e5 forst\u00e5 for \u00e5 kunne h\u00e5ndtere hvis noe ikke fungerer som forventet. \u00c5 forst\u00e5 hvordan alt dette fungerer vil hjelpe deg med \u00e5 finne problemet, eller i det minste beskrive det korrekt slik at noen andre kan hjelpe deg. Dette er litt komplisert, og du vil kanskje hoppe over denne delen. Men for \u00e5 hacke tr\u00e5dl\u00f8se nettverk trenger du litt kunnskap, s\u00e5 hacking er litt mer enn bare \u00e5 skrive inn en kommando og la aircrack gj\u00f8re alt for deg.<\/p>\n<h3>Hvordan finne et tr\u00e5dl\u00f8st nettverk<\/h3>\n<p>\n Denne delen er en kort innf\u00f8ring i styrte nettverk som arbeider med tilgangspunkter (Access Point, AP). Hver tilgangspunkt sender omtrent 10 s\u00e5kalte beacon-rammer per sekund. Disse pakkene inneholder f\u00f8lgende informasjon:<\/p>\n<ul>\n<li>Nettverksnavn (ESSID);<\/li>\n<li>Om kryptering brukes (og hvilken kryptering som brukes, men merk at denne informasjonen kanskje ikke er sannferdig, bare fordi tilgangspunktet rapporterer det);<\/li>\n<li>Hvilke datahastigheter som st\u00f8ttes (i MBit);<\/li>\n<li>Hvilket kanal nettverket ligger p\u00e5.<\/li>\n<\/ul>\n<p>Det er akkurat denne informasjonen som vises i verkt\u00f8yet som spesifikt kobles til dette nettverket. Den vises n\u00e5r du lar kortet skanne nettverk med <code><code>iwlist &lt;<\/code>interface&gt; scan<\/code> og n\u00e5r du utf\u00f8rer <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=airodump-ng\">airodump-ng<\/a><\/noindex>.<\/p>\n<p>Hver tilgangspunkt har en unik MAC-adresse (48 biter, 6 par heksadesimale tall). Den ser omtrent slik ut: 00:01:23:4A:BC:DE. Hvert nettverksenhet har en slik adresse, og nettverksenheter kommuniserer med hverandre via disse. S\u00e5 det er noe som ligner p\u00e5 et unikt navn. MAC-adresser er unike, og det finnes ikke to enheter med samme MAC-adresse.<\/p>\n<h3>Tilkobling til nettverket<\/h3>\n<p>\nDet finnes flere alternativer for \u00e5 koble seg til et tr\u00e5dl\u00f8st nettverk. I de fleste tilfeller brukes \u00e5pen systemautentisering. (Valgfritt: hvis du vil l\u00e6re mer om autentisering, <noindex><a rel=\"nofollow\" href=\"http:\/\/documentation.netgear.com\/reference\/fra\/wireless\/WirelessNetworkingBasics-3-06.html\">les dette<\/a><\/noindex>.)<\/p>\n<p>\u00c5pen systemautentisering:<\/p>\n<ol>\n<li>Ber om autentisering fra tilgangspunktet;<\/li>\n<li>Tilgangspunktet svarer: OK, du er autentisert.<\/li>\n<li>Ber om tilknytning til tilgangspunktet;<\/li>\n<li>Tilgangspunktet svarer: OK, du er tilkoblet.<\/li>\n<\/ol>\n<p>Dette er den enkleste situasjonen, men problemer oppst\u00e5r n\u00e5r du ikke har tilgangsrettigheter, fordi:<\/p>\n<ul>\n<li>WPA\/WPA2 brukes, og du trenger APOL-autentisering. Tilgangspunktet vil svare med avvisning p\u00e5 det andre trinnet.<\/li>\n<li>Tilgangspunktet har en liste over tillatte klienter (MAC-adresser) og vil ikke la noen andre koble til. Dette kalles MAC-filtrering.<\/li>\n<li>Tilgangspunktet bruker Shared Key Autentisering, noe som betyr at du m\u00e5 oppgi riktig WEP-n\u00f8kkel for \u00e5 kunne koble til. (Se avsnittet <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=shared_key\">\u00abHvordan utf\u00f8re falsk autentisering med delt n\u00f8kkel?\u00bb<\/a><\/noindex> for mer informasjon om dette)<\/li>\n<\/ul>\n<h3>Enkel sniffing og hacking <\/h3>\n<p><\/p>\n<h4>Oppdagelse av nettverk<\/h4>\n<p>\nDet f\u00f8rste du m\u00e5 gj\u00f8re er \u00e5 finne et potensielt m\u00e5l. I aircrack-ng-pakken er det <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=airodump-ng\">airodump-ng<\/a><\/noindex>, men du kan ogs\u00e5 bruke andre programmer som for eksempel <noindex><a rel=\"nofollow\" href=\"https:\/\/kismetwireless.net\/\">Kismet<\/a><\/noindex>.<\/p>\n<p>F\u00f8r du leter etter nettverk, m\u00e5 du sette nettverkskortet ditt i det s\u00e5kalte \u00abmonitormodus\u00bb. Monitormodus er en spesiell modus som lar datamaskinen din lytte til datapakker. Denne modusen lar deg ogs\u00e5 injisere pakker. Om injiseringer vil vi snakke senere.<\/p>\n<p>For \u00e5 sette nettverkskortet i monitormodus, bruk <i><noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=airmon-ng\">airmon-ng<\/a><\/noindex><\/i>:<\/p>\n<pre><code class=\"bash\">airmon-ng start wlan0<\/code><\/pre>\n<p>Slik vil du opprette et nytt grensesnitt og legge til <i>\u00abmon\u00bb<\/i>. S\u00e5, <i>wlan0<\/i> vil bli <i>wlan0mon<\/i>. For \u00e5 kontrollere om nettverkskortet faktisk er i monitormodus, kj\u00f8r <code>iwconfig<\/code> og sjekk det selv. <\/p>\n<p>Deretter, kj\u00f8r <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=airodump-ng\">airodump-ng<\/a><\/noindex> for \u00e5 s\u00f8ke etter nettverk:<\/p>\n<pre><code class=\"bash\">airodump-ng wlan0mon<\/code><\/pre>\n<p>Hvis <i>airodump-ng<\/i> kan ikke koble til WLAN-enheten, vil du se noe slikt:<\/p>\n<p><img decoding=\"async\" alt=\"Aircrack-ng guide for beginners in Linux\" src=\"\/wp-content\/uploads\/2020\/03\/c554cbdf6f062b0aa7029cc257ac350a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=airodump-ng\">airodump-ng<\/a><\/noindex> hopper fra kanal til kanal og viser alle tilgangspunktene som den mottar beacon-signal fra. Kanaler fra 1 til 14 brukes for standardene 802.11 b og g (i USA er det kun tillatt \u00e5 bruke fra 1 til 11; i Europa fra 1 til 13 med noen unntak; i Japan fra 1 til 14). 802.11a opererer i 5 GHz-b\u00e5ndet, og tilgjengeligheten varierer mer i forskjellige land enn i 2,4 GHz-b\u00e5ndet. Generelt begynner kjente kanaler med 36 (32 i noen land) til 64 (68 i noen land) og fra 96 til 165. P\u00e5 Wikipedia kan du finne mer detaljert informasjon om tilgjengeligheten til kanalene. I Linux h\u00e5ndterer <noindex><a rel=\"nofollow\" href=\"https:\/\/wireless.wiki.kernel.org\/en\/developers\/Regulatory\/CRDA\">Central Regulatory Domain Agent<\/a><\/noindex>; men det m\u00e5 konfigureres riktig.<\/p>\n<p>Den n\u00e5v\u00e6rende kanalen vises i \u00f8verste venstre hj\u00f8rne.<br \/>\nEtter en stund vil tilgangspunktene vises, og (forh\u00e5pentligvis) noen tilknyttede klienter.<br \/>\nDen \u00f8verste blokken viser oppdagede tilgangspunkter:<\/p>\n<p>bssid<br \/>\nMAC-adressen til tilgangspunktet<\/p>\n<p>pwr<br \/>\nsignalstyrke n\u00e5r kanalen er valgt <\/p>\n<p>pwr<br \/>\nsignalstyrke. noen drivere rapporterer ikke dette.<\/p>\n<p>beacons<br \/>\nantall mottatte beacons. Hvis du ikke har en signalstyrke, kan du m\u00e5le det i beacons: jo flere beacons, jo bedre signal.<\/p>\n<p>data<br \/>\nantall mottatte datarammer<\/p>\n<p>ch<br \/>\nkanalen som tilgangspunktet kj\u00f8rer p\u00e5<\/p>\n<p>mb<br \/>\nhastighet eller modus for tilgangspunktet. 11 er ren 802.11b, 54 er ren 802.11g. verdier mellom disse to er en blanding.<\/p>\n<p>enc<br \/>\nkryptering: opn: ingen kryptering, wep: wep-kryptering, wpa: wpa eller wpa2, wep?: wep eller wpa (uklar forel\u00f8pig)<\/p>\n<p>essid<br \/>\nnettverksnavn, noen ganger skjult<\/p>\n<p>Den nederste blokken viser oppdagede klienter:<\/p>\n<p>bssid<br \/>\nMAC-adressen som klienten er assosiert med dette tilgangspunktet<\/p>\n<p>station<br \/>\nMAC-adressen til selve klienten<\/p>\n<p>pwr<br \/>\nsignalstyrke. noen drivere rapporterer ikke dette.<\/p>\n<p>packets<br \/>\nantall mottatte datarammer<\/p>\n<p>probes<br \/>\nnettverksnavn (essid) som denne klienten allerede har fors\u00f8kt<\/p>\n<p>N\u00e5 m\u00e5 du overv\u00e5ke det m\u00e5lrettede nettverket. Det m\u00e5 v\u00e6re koblet til minst \u00e9n klient, siden hacking av nettverk uten klienter er et mer komplisert tema (se seksjonen <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=how_to_crack_wep_with_no_clients\">Hvordan hacke WEP uten klienter<\/a><\/noindex>). Det b\u00f8r bruke WEP-kryptering og ha et godt signal. Kanskje kan du flytte antennen for \u00e5 forbedre signalmottaket. Noen ganger kan f\u00e5 centimeter v\u00e6re avgj\u00f8rende for signalstyrken.<\/p>\n<p>I eksempelet ovenfor er det et nettverk 00:01:02:03:04:05. Det viste seg \u00e5 v\u00e6re det eneste mulige m\u00e5let, siden det bare er koblet til \u00e9n klient. Og det har ogs\u00e5 et godt signal, s\u00e5 det er et passende m\u00e5l for praksis.<\/p>\n<h3>Sniffing av Initialiseringsvektorer<\/h3>\n<p>\n P\u00e5 grunn av hopp mellom kanaler vil du ikke fange alle pakker fra det m\u00e5lrettede nettverket. Derfor \u00f8nsker vi \u00e5 lytte p\u00e5 bare \u00e9n kanal og i tillegg lagre all data p\u00e5 disk, slik at vi senere kan bruke dem til hacking:<\/p>\n<pre><code class=\"bash\">airodump-ng -c 11 --bssid 00:01:02:03:04:05 -w dump wlan0mon<\/code><\/pre>\n<p> Med parameteren <code>-c<\/code> velger du kanalen, og parameteren etter <code>-w<\/code> er prefikset for nettverksdumpene som er lagret p\u00e5 disk. Flagget <code>--bssid<\/code> sammen med MAC-adressen til tilgangspunktet begrenser pakkeinnsamlingen til ett tilgangspunkt. Flagget <code>--bssid<\/code> er bare tilgjengelig i nyere versjoner <i>airodump-ng<\/i>.<\/p>\n<p>F\u00f8r du kan bryte WEP, trenger du mellom 40.000 og 85.000 forskjellige initieringsvektorer (Initialization Vector, IV). Hver datapakke inneholder en initieringsvektor. Disse kan gjenbrukes, s\u00e5 antallet vektorer er vanligvis litt lavere enn antall overv\u00e5kede pakker. <br \/>\n Dermed m\u00e5 du vente p\u00e5 \u00e5 overv\u00e5ke mellom 40k og 85k datapakker (med IV). Hvis nettverket ikke er opptatt, vil dette ta mye tid. Du kan fremskynde denne prosessen ved \u00e5 bruke en aktiv angrep (eller replay-angrep). Dette vil vi diskutere i neste del.<\/p>\n<h3>Bryting<\/h3>\n<p>\n Hvis du allerede har samlede initieringsvektorer lagret i en eller flere filer, kan du fors\u00f8ke \u00e5 bryte WEP-n\u00f8kkelen:<\/p>\n<pre><code class=\"bash\">aircrack-ng -b 00:01:02:03:04:05 dump-01.cap<\/code><\/pre>\n<p> MAC-adressen etter flagget <code>-b<\/code> \u2013 dette er m\u00e5l-BSSID, og <code>dump-01.cap<\/code> \u2013 dette er filen som inneholder de overv\u00e5kede pakkene. Du kan bruke flere filer, bare legg til alle navn i kommandoen eller bruk et jokertegn, for eksempel <code>dump*.cap<\/code>.<\/p>\n<p>Mer informasjon om parametere <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=aircrack-ng\">aircrack-ng<\/a><\/noindex>, utdata og bruk kan du finne fra <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=aircrack-ng\">for distribusjon p\u00e5 Kubernetes- og Red Hat OpenShift-plattformer. Dessuten genererer Quarkus automatisk Dockerfile.jvm (JVM-pakking) og Dockerfile.native (native bin\u00e6r pakking) filer som er n\u00f8dvendige for \u00e5 lage containere.<\/a><\/noindex>. <\/p>\n<p>Antallet initieringsvektorer som kreves for \u00e5 bryte n\u00f8kkelen er ikke begrenset. Dette skjer fordi noen vektorer er svakere og mister mer informasjon om n\u00f8kkelen enn andre. Vanligvis blandes disse initieringsvektorene med sterkere. S\u00e5 hvis du er heldig, kan du bryte n\u00f8kkelen med s\u00e5 lite som 20.000 initieringsvektorer. Imidlertid er det ofte ikke nok, <i>aircrack-ng<\/i> kan ta lang tid (en uke eller mer i tilfelle h\u00f8y feilmargin), og deretter fortelle deg at n\u00f8kkelen ikke kan brytes. Jo flere initieringsvektorer du har, desto raskere kan brytingen skje, og vanligvis tar det bare noen minutter eller til og med sekunder. Erfaring viser at 40.000 \u2013 85.000 vektorer er tilstrekkelig for \u00e5 bryte.<\/p>\n<p> Det finnes mer avanserte tilgangspunkter som bruker spesielle algoritmer for \u00e5 filtrere ut svake initieringsvektorer. Som resultat kan du ikke f\u00e5 mer enn N vektorer fra tilgangspunktet, eller du trenger millioner av vektorer (for eksempel 5-7 millioner) for \u00e5 bryte n\u00f8kkelen. Du kan <noindex><a rel=\"nofollow\" href=\"https:\/\/forum.aircrack-ng.org\/\">lese p\u00e5 forumet<\/a><\/noindex>, hva du b\u00f8r gj\u00f8re i slike tilfeller.<\/p>\n<p>Aktive angrep<br \/>\n De fleste enheter st\u00f8tter ikke injeksjoner, i det minste ikke uten patched drivere. Noen st\u00f8tter bare visse angrep. Kontakt <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=compatibility_drivers\">kompatibilitetssiden<\/a><\/noindex> og se i kolonnen <i>aireplay<\/i>. Noen ganger gir ikke denne tabellen oppdatert informasjon, s\u00e5 hvis du ser ordet <i>\u201cNEI\u201d<\/i> ved siden av driveren din, ikke bli frustrert, men sjekk heller hjemmesiden til driveren, i driverens nyhetsbrev p\u00e5 <noindex><a rel=\"nofollow\" href=\"https:\/\/forum.aircrack-ng.org\/\">forumet v\u00e5rt<\/a><\/noindex>. Hvis du har klart \u00e5 gjenskape med en driver som ikke var oppf\u00f8rt blant de st\u00f8ttede, ikke n\u00f8l med \u00e5 foresl\u00e5 endringer p\u00e5 siden med kompatibilitetstabellen og legge ved en lenke til en kort guide. (For dette m\u00e5 du be om en wiki-konto p\u00e5 IRC.)<\/p>\n<p>F\u00f8rst m\u00e5 du sikre at pakkeinjeksjon faktisk fungerer med nettverkskortet og driveren din. Den enkleste m\u00e5ten \u00e5 teste dette p\u00e5 er \u00e5 utf\u00f8re et testinjeksjonsangrep. F\u00f8r du fortsetter, s\u00f8rg for \u00e5 ha gjennomf\u00f8rt denne testen. Kortet ditt m\u00e5 v\u00e6re i stand til \u00e5 injisere for at du skal kunne utf\u00f8re de f\u00f8lgende trinnene.<\/p>\n<p>Du trenger BSSID (MAC-adressen til tilgangspunktet) og ESSID (nettverksnavn) for tilgangspunktet, som ikke filtrerer etter MAC-adresser (for eksempel ditt eget), og som ligger innen rekkevidde.<\/p>\n<p>Pr\u00f8v \u00e5 koble deg til tilgangspunktet med <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=aireplay-ng\">aireplay-ng<\/a><\/noindex>:<\/p>\n<pre><code class=\"bash\">aireplay-ng --fakeauth 0 -e \"ditt nettverk ESSID\" -a 00:01:02:03:04:05 wlan0mon<\/code><\/pre>\n<p> Verdien etter <code>-a<\/code> vil v\u00e6re BSSID for tilgangspunktet ditt.<br \/>\n Injeksjonen var vellykket hvis du ser noe som dette:<\/p>\n<pre><code class=\"bash\">12:14:06  Sender autentiseringsforesp\u00f8rsel\n12:14:06  Autentisering vellykket\n12:14:06  Sender tilknytningsforesp\u00f8rsel\n12:14:07  Tilknytning vellykket :-)<\/code><\/pre>\n<p> Hvis ikke:<\/p>\n<ul>\n<li>Dobbeltsjekk at ESSID og BSSID er korrekte;<\/li>\n<li>S\u00f8rg for at MAC-adressfilteringen p\u00e5 tilgangspunktet ditt er deaktivert;<\/li>\n<li>Pr\u00f8v det samme p\u00e5 et annet tilgangspunkt;<\/li>\n<li>S\u00f8rg for at driveren din er riktig konfigurert og st\u00f8ttes;<\/li>\n<li>I stedet for \u00ab0\u00bb kan du pr\u00f8ve \u00ab6000 -o 1 -q 10\u00bb.<\/li>\n<\/ul>\n<h3>ARP-replay <\/h3>\n<p>\nN\u00e5 som vi vet at pakkeinjeksjon fungerer, kan vi gj\u00f8re noe som betydelig vil akselerere fangst av initieringsvektorer: injeksjonsangrep <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=arp-request_reinjection\">ARP-foresp\u00f8rselen<\/a><\/noindex>.<\/p>\n<h3>Grunnleggende id\u00e9<\/h3>\n<p>\nFor simplicity, ARP works by sending a broadcast request to an IP address, and the device with that IP address sends back a response. Since WEP does not protect against replay attacks, you can sniff a packet and send it over and over again while it's valid. Thus, you only need to intercept and replay the ARP request sent to the access point to generate traffic (and obtain initialization vectors).<\/p>\n<h3>Lazy method<\/h3>\n<p>\nFirst, open the window with <i>airodump-ng<\/i>, which sniffs the traffic (see above). <i>Aireplay-ng<\/i> og <i>airodump-ng<\/i> can work simultaneously. Wait for a client to appear on the target network and start the attack:<\/p>\n<pre><code class=\"bash\">aireplay-ng --arpreplay -b 00:01:02:03:04:05 -h 00:04:05:06:07:08 wlan0mon<\/code><\/pre>\n<p><code>-b<\/code> points to the target BSSID, <code>-h<\/code> to the MAC address of the connected client.<\/p>\n<p>Now you need to wait for the ARP packet to be received. Usually, you have to wait a few minutes (or read further into the article). <br \/>\nIf you're lucky, you will see something like this:<\/p>\n<pre><code class=\"bash\">Saving ARP requests in replay_arp-0627-121526.cap\nYou must also start airodump to capture replies.\nRead 2493 packets (got 1 ARP requests), sent 1305 packets...<\/code><\/pre>\n<p>If you need to stop the replay, you don't have to wait for the next ARP packet; you can simply use the previously intercepted packets with the parameter <code>-r<\/code> <code><code>&lt;<\/code>filename&gt;<\/code>.<br \/>\nWhen using ARP injections, you can use the PTW method to crack the WEP key. It significantly reduces the number of required packets, and thus the time needed to breach. You need to capture a full packet with <i>airodump-ng<\/i>, meaning not to use the option <code>\u201c--ivs\u201d<\/code> when executing the command. For <i>aircrack-ng<\/i> use <code><code>\u201caircrack -z &lt;<\/code>file name&gt;\u201d<\/code>. (PTW \u2013 default attack type)<\/p>\n<p>If the number of data packets received <i>airodump-ng<\/i> stops increasing, you may need to reduce the replay speed. Do this with the parameter <code>-x<\/code> <code><code>&lt;<\/code>packets per second&gt;.<\/code>I usually start with 50 and decrease until the packets begin to be received continuously again. Additionally, adjusting the position of the antenna may help. <\/p>\n<h3>Aggressive method<\/h3>\n<p>\n Most operating systems clear the ARP cache upon disconnecting. If you need to send the next packet after reconnecting (or simply use DHCP), they send an ARP request. As a side effect, you can sniff the ESSID and possibly the keystream during reconnection. This is convenient if your target's ESSID is hidden or it uses shared-key authentication.<br \/>\n La oss <i>airodump-ng<\/i> og <i>aireplay-ng<\/i> n\u00e5r de kj\u00f8rer. \u00c5pne et nytt vindu og start <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=deauthentication\">deautentisering angrep<\/a><\/noindex>:<\/p>\n<p> Her <code>-a<\/code> \u2013 dette er BSSID for tilgangspunktet, <code>-c<\/code> MAC-adressen til den valgte klienten.<br \/>\n Vent et par sekunder, s\u00e5 vil ARP replay fungere.<br \/>\n De fleste klientene pr\u00f8ver \u00e5 gjenskape forbindelsen automatisk. Men risikoen for at noen vil oppdage dette angrepet, eller i det minste legge merke til hva som skjer p\u00e5 WLAN, er h\u00f8yere enn ved andre angrep.<\/p>\n<p>Flere verkt\u00f8y og informasjon om dem finner du <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aircrack-ng.org\/doku.php?id=tutorial\">her<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/otus.pw\/2T7g\/\">L\u00e6r mer om kurset<\/a><\/noindex><br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/otus\/blog\/494356\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442. \u0412 \u043f\u0440\u0435\u0434\u0434\u0432\u0435\u0440\u0438\u0438 \u0441\u0442\u0430\u0440\u0442\u0430 \u043a\u0443\u0440\u0441\u0430 \u00ab\u041f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u043c \u043f\u043e Kali Linux\u00bb \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0434\u043b\u044f \u0432\u0430\u0441 \u043f\u0435\u0440\u0435\u0432\u043e\u0434 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438. \u0421\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0435 \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u0442 \u0432\u0430\u0441 \u0441 \u043e\u0441\u043d\u043e\u0432\u0430\u043c\u0438 \u0434\u043b\u044f \u043d\u0430\u0447\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0442\u044b \u0441 \u043f\u0430\u043a\u0435\u0442\u043e\u043c aircrack-ng. \u041a\u043e\u043d\u0435\u0447\u043d\u043e, \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432\u0441\u044e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438 \u043e\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u043a\u0430\u0436\u0434\u044b\u0439 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0439. \u0422\u0430\u043a \u0447\u0442\u043e \u0431\u0443\u0434\u044c\u0442\u0435 \u0433\u043e\u0442\u043e\u0432\u044b \u0434\u0435\u043b\u0430\u0442\u044c \u0434\u043e\u043c\u0430\u0448\u043d\u0438\u0435 \u0437\u0430\u0434\u0430\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442\u044c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e. \u041d\u0430 \u0444\u043e\u0440\u0443\u043c\u0435 \u0438 \u0432 Wiki \u0435\u0441\u0442\u044c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":75918,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-75917","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"nn_NO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e Aircrack-ng \u0432 Linux \u0434\u043b\u044f \u043d\u043e\u0432\u0438\u0447\u043a\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-03-29T11:42:35+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-03-29T11:42:35+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Guide til Aircrack-ng i Linux for nybegynnere | ProHoster","description":"Hei alle sammen.","canonical_url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"nn_NO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e Aircrack-ng \u0432 Linux \u0434\u043b\u044f \u043d\u043e\u0432\u0438\u0447\u043a\u043e\u0432 | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442.","og:url":"https:\/\/prohoster.info\/no\/blog\/administrirovanie\/rukovodstvo-po-aircrack-ng-v-linux-dlya-novichkov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-03-29T11:42:35+00:00","article:modified_time":"2020-03-29T11:42:35+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"75917","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:46:23","updated":"2022-09-28 19:00:03","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/75917","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/comments?post=75917"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/posts\/75917\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media\/75918"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/media?parent=75917"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/categories?post=75917"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/no\/wp-json\/wp\/v2\/tags?post=75917"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}