#Macspoof in monitor mode how to
#Macspoof in monitor mode 64 Bit
#Macspoof in monitor mode password

Disable monitor mode on the wireless interfaceįirst we need to find a client to impersonate.

This involves listening to a network to find the MAC address of a connected client and then setting their MAC address as our own. However it is pretty trivial to change the MAC address of our wireless interface and access the network as an imposter.

#Macspoof in monitor mode password

Now we have the WEP key in plaintext and can use it to connect to the network or decrypt network traffic.įor added security a router can add MAC filtering which only allows devices with set MAC addresses access even once the password is known. This script handles all of the steps described above without us needing to remember all of the commands, and if you are interested in what is doing in each step you can view the source.Īttack the target using wifite (automatically & recommended) or via aircrack-ng For simplicity I will be using the wifite python script.

Deauthenticate connected clients to increase capture rateįor a complete guide to running these attacks please refer to the aircrack-ng simple wep cracking guide.Identify the network we are looking to attack.

Enable monitor mode on the wifi interface.

Now letâ€™s have a go at this on our demo network: This assumes weâ€™ve got a device setup as discussed in the previous article. Using the IVâ€™s we can guess each letter of the key sequentially rather than having to bruteforce the complete key (see here. Unfortunately 24 bits is not enough randomness for a busy network and there is still a 50% probability of a duplicate key after 5000 packets.īecause the first few bytes of a header of a packet are known or predictable ( similar to how enigma was cracked) then it is possible to work out the key once we capture enough packets.

#Macspoof in monitor mode 64 Bit

The IV makes up 24 bits of the seed with the key making up the rest (either 36 bits or 100 bits depending on if we are using 64 bit or 128 bit WEP). To combat this shortfall an Initialisation Vector (IV) is transmitted from the router to the client to add to the key so that it is not a constant value. Otherwise the key can be calculated by gathering enough data. Because the keystream is not truly random it means the same key cannot be used twice to seed. Wired Equivalent Privacy (WEP) is a RC4 stream cipher, which means a key is used to seed a pseudo-random keystream which is used for encoding (similar to a one-time pad). It is your sole responsibility to act in compliance with all relevant legislation and regulations. Penetration testing networks other than your own may be illegal in your country. We will also look at how we can bypass MAC filtering.ĭisclaimer: the author and contributors to this document will accept no responsibility for the consequences of the actions of individuals concerning wireless networks. Now it is somewhat of a rarity to see WEP networks in existence these days, however for the sake of completeness this guide will look at how we can attack these networks.

#Macspoof in monitor mode how to

In the previous posts we looked at how to use a modified Nexus 7 to gain access to a WPA secured network by cracking the WPA handshake or by exploiting WPS.