After each step, a screenshot is given so you may compare your output to what should be happening.

In this example, we used an atheros card, and all the commands issued are given in quotes, with the result of the commands being listed in grey. Once sufficient IVs have beenĬollected, an attack on the recycled IVs can be performed and 64 or 128 bit WEP keys can be recovered By replaying a customized ARP request over and over, you can force the router to rapidly generate thousands and thousands of packets, which will disclose the recycled (weak) IVs. However, WEP encryption scheme has a weakness in which IVs used to encrypt the packets are occasionally recycled, and become statistically predictable. Each packet transmitted by the access point is supposed to be encrypted using a unique identifier, which makes it impossible to guess. The vulnerability in this process is the IV, or initialization vector. That request will then be force fed back to the access point and Turn, this process will give us a packet that we can use to construct aĬustom ARP request in the form of a replayable packet. When a computer becomes deauthenticated from the access point, it will reauthenticate itself back up to resume normal operation.

Deauthenticating any computers that may be connected to the access point is one way to do capture such a packet. The basic idea for key recovery is to capture a packet from the wireless access point that you can use to perform an attack. Both approaches are covered in this tutorial. Typically, a WEP key can be recovered using the 'chopchop' method or the 'fragment' method.

There are more ways than one to accomplish this. The goal of this tutorial is to see how quickly your own WEP key can beĬompromised. Using Aircrack-ng against WEP encryption (Tutorial)

Packet capture tool aircrack