coWPAtty用法

1、防范Cowpatty for Windows的主要： "coWPAtty is designed to audit the pre-shared key (PSK) selection for WPA networks based on the TKIP protocol." - Joshua Wright. “防范Cowpatty設(shè)計(jì)審核預(yù)共享密鑰（PSK）網(wǎng)絡(luò)選擇WPA協(xié)議基于TKIP的?！?-約書(shū)亞賴(lài)特。 Project Homepage: Local Mirror: Cowpatty-4.0-win32.zip MD5: aa9ead2aacfcc493da3684

2、351425d4c6本地鏡像： 防范Cowpatty - 4.0 - win32.zip 的MD5：aa9ead2aacfcc493da3684351425d4c6 coWPAtty Dictionary Attack 防范Cowpatty字典攻擊 Precomputing WPA PMK to crack WPA PSK 預(yù)計(jì)算的WPA破解的WPA的PSK胡椒基甲基酮 coWPAtty Precomputed WPA Attack 防范Cowpatty預(yù)計(jì)算WPA的攻擊 coWPAtty Recomputed WPA2 Attack 防范Cowpatty重新計(jì)算WPA2的攻擊 coWPAtt

3、y Tables 防范Cowpatty表 c oWPAtty Usage: ç oWPAtty用法： coWPAtty Dictionary Attack: 防范Cowpatty字典攻擊： To perform the coWPAtty dictionary attack we need to supply the tool with a capture file that includes the TKIP four-way handshake, a dictionary file of passphrases to guess with and the SSID for the

4、network.要執(zhí)行防范Cowpatty字典攻擊，我們需要提供網(wǎng)絡(luò)的工具捕獲文件，其中包括TKIP的四向握手字典文件，一個(gè)口令猜測(cè)與和的SSID。 In order to collect the four-way handshake you can either wait until a client joins the network or preferably you can force it to rejoin the network using tools like void11 or aireplay and capture the handshakes using somethi

5、ng like kismet, ethereal or airodump.為了收集的4次握手你可以等待，直到客戶(hù)端加入網(wǎng)絡(luò)或最好你能迫使它重新加入網(wǎng)絡(luò)使用aireplay void11或工具，如握手，并捕獲使用克斯梅特是像這樣的空靈或airodump中。 cowpatty -f dict -r wpapsk-linksys.dump  -s linksys 防范Cowpatty - F座的dict - R的wpapsk - linksys.dump - S的Linksys公司 As you can see this simple dictionary attack took

6、 51 seconds, we can speed up this process by precomputing the WPA-PMK to crack the WPA-PSK (see below).正如你可以看到這個(gè)簡(jiǎn)單的字典攻擊了51秒，我們可以加快這一進(jìn)程，預(yù)計(jì)算的PSK的WPA -胡椒基甲基酮破解WPA的（見(jiàn)下文）。 wpapsk-linksys.dump is the capture containing the four-way handshake wpapsk - linksys.dump是捕獲包含4路握手 dict is the password file dict的是密

7、碼文件 linksys is the network SSID Linksys公司是網(wǎng)絡(luò)的SSID Precomputing WPA PMK to crack WPA PSK: 預(yù)計(jì)算的WPA破解的WPA的PSK胡椒基甲基酮： genpmk is used to precompute the hash files in a similar way to Rainbow tables is used to pre-hash passwords in Windows LANMan attacks.  There is a slight difference however in WPA

8、in that the SSID of the network is used as well as the WPA-PSK to "salt" the hash.  This means that we need a different set of hashes for each and every unique SSID ie a set for "linksys" a set for "tsunami" etc. genpmk用于預(yù)先計(jì)算哈希表文件以類(lèi)似的方式，以彩虹是用來(lái)在Windows蘭曼襲擊前的哈希密碼。有一個(gè)

9、略有不同的WPA但是在該網(wǎng)絡(luò)的SSID的使用以及WPA的云芝多糖為“鹽”的哈希。這意味著，我們需要“等”海嘯一套不同的哈希每一個(gè)獨(dú)特的SSID即設(shè)置“為”Linksys的一集 So to generate some hash files for a network using the SSID cuckoo we use:因此，要產(chǎn)生一些哈希文件1使用網(wǎng)絡(luò)使用的SSID杜鵑，我們： genpmk  -f dict  -d linksys.hashfile  -s linksys genpmk - F座dict的三維linksys.hashfile - S

10、的Linksys公司 dict is the password file dict的是密碼文件 linksys.hashfile is our output file linksys.hashfile是我們的輸出文件 linksys is the network ESSID Linksys公司是網(wǎng)絡(luò)的ESSID coWPAtty Precomputed WPA Attack: 防范Cowpatty預(yù)計(jì)算WPA的攻擊： Now we have created our hash file we can use it against any WPA-PSK network that is utili

11、sing a network SSID of cuckoo.  Remember the capture (wpa-test-01.cap) must contain the four-way handshake to be successful.現(xiàn)在，我們已經(jīng)創(chuàng)造了哈希文件，我們可以使用它杜鵑對(duì)任何WPA - PSK和網(wǎng)絡(luò)，這是一個(gè)利用網(wǎng)絡(luò)的SSID。記住捕獲（WPA的試驗(yàn)01.cap）必須包含4次握手是成功的。 cowpatty  -d linksys.hashfile -r wpapsk-linksys.dump  -s linksys 防范Cowpatty

12、三維linksys.hashfile - R的wpapsk - linksys.dump - S的Linksys公司 wpa-test-01.cap is the capture containing the four-way handshake WPA的試驗(yàn)01.cap是捕獲包含4路握手 linksys.hashfile are our precomputed hashes linksys.hashfile是我們預(yù)先計(jì)算哈希 linksys is the network ESSID Linksys公司是網(wǎng)絡(luò)的ESSID Notice that cracking the WPA-PSK too

13、k 0.04 seconds with the pre-computed attacked as opposed to 200 seconds with standard dictionary attack mode, albeit you do need to pre-compute the hash files prior to the attack.  However, precomputing large hash files for common SSIDS (eg linksys, tsunami) would be a sensible move for most pe

14、netration testers.請(qǐng)注意，破解WPA - PSK和采取0.04秒與預(yù)先計(jì)算的攻擊，而不是字典攻擊模式，以200秒的標(biāo)準(zhǔn)，盡管你需要預(yù)先計(jì)算哈希文件之前攻擊。然而，預(yù)計(jì)算大文件哈希常見(jiàn)的SSID（例如Linksys公司，海嘯）將是一個(gè)滲透測(cè)試的最明智的舉措。 coWPAtty Precomputed WPA2 Attack: 防范Cowpatty預(yù)計(jì)算WPA2的攻擊： coWPAtty 4.0 is also capable of attacking WPA2 captures.  Note: The same hash file as was used with t

15、he WPA capture was also used with the WPA2 capture.防范Cowpatty 4.0也能夠捕獲攻擊的WPA2。注：同哈希文件作為被捕捉用于捕獲的WPA也使用與WPA2。 cowpatty  -d linksys.hashfile -r wpa2psk-linksys.dump  -s linksys 防范Cowpatty三維linksys.hashfile - R的wpa2psk - linksys.dump - S的Linksys公司 wpa2psk-linksys.dump is the capture containing

16、 the four-way handshake wpa2psk - linksys.dump是捕獲包含4路握手 dict is the password file dict的是密碼文件 linksys is the network SSID Linksys公司是網(wǎng)絡(luò)的SSID coWPAtty Tables: 防范Cowpatty表： The Church of Wifi have produced some lookup tables for 1000 SSID's computed against a 170,000 word password file .  The resultant table are approximately 7 Gigabytes in size and