How can I break into secured Wireless networks?

The first thing to know about a wireless network is what encryption is used to secure them. Modern wireless computer hardware works with several different protocols that all supports different encryption methods of protecting the information being sent through the air. Today the most common used encryptions for securing WLAN is WEP, WPA and WPA2. To connect to a secured WLAN you will need a “key”. Various methods to obtain the key will be answered below.

Second, to connect to a WLAN you need to find it’s AP (access point), more specifically the SSID of the AP in question. This is usually a dedicated device that receives and transmit signals to and from the clients, but it can also be a normal computer doing the same function. There are various tools/software to scan for AP’s, such as NetStumbler, WIFI-radar, Kismet and Kismac; they will tell you if there is any AP withing range, how strong the signal is and what encryption (if any) is being used. If the WLAN doesn’t use any encryption to protect the wireless transmissions then you can connect to the network without having to use a key. There might still be issues connecting surround MAC filtering but we’ll get to that later.

Aquiring the Key

Now if the network is secured by encryption you will need to get a key to be able to connect. Getting a hold of this key varies in difficulty with the encryption method in use on the network. The basic method behind every software mentioned is to sniff for certain packets being sent by the AP and it’s clients and use a program can calculate/crack the key based on those packets.

WEP

WEP encryption is fairly old and can be cracked with a number of different applications, such as aircrack, airsnort, KisMac, Wepcrack, Auditor security collection liveCD and many others, google is good for finding an application that works on your platform. What these applications do is collect the most relevant frames and with enough frames the program can break the encryption and calculate the key. Some of these applications use injection methods to produce more traffic from the AP’s which results in more packets being sent and more frames being collected. This lowers the time it takes for the software to find the key. Injection simply refers to the act of sending out packets from your machine to the AP in order to incite the AP to reply and thus, send more packets flying through the air.

WPA

WPA is a more advanced form of encryption and can’t be cracked in the same way as WEP encryption. WPA uses instead a Pre-Shared Key that is sent when a client connects to the network. Applications such as coWPATTY, Aircrack and KisMAC can collect the encrypted key and use offline dictionary/bruteforce attacks to try and break the encryption. This is different then how WEP is crack in that WEP has obvious flaws in it’s implementation that are used to find the key. With the WPA methods described, the key is attacked with traditional encryption breaking techniques, not a flaw in the implementation.

WPA2

We are currently looking for any information regarding WPA2 cracking.[/b]

Rfmon/Promiscuous Mode

These softwares mentioned requires that your Wireless Network Interface Card (WNIC) supports promiscuous/passive/rfmon mode, which allows your WNIC to collect all network packets that is being sent and not only the ones addressed to your machine. Finding the right NIC can be tricky, so here is a short, non-definite list of commonly used chipsets that support rfmon:

• Atheros
• Prism2
• Orinoco
• Aironet

The list will be updated as more people contribute known-good chipsets.

It should also be noted that while some chipsets support rfmon mode, they don’t allow for packet injection, which is a real bummer if you’re planning on doing a lot of WEP cracking on low-activity APs.

Non-Encryption Based Security

There are other ways a network can be secure than just using encryption. MAC filtering is the act setting the router/AP to only allow certain MAC addresses to connect to the network. This can be overcome by using a sniffer to find a currently connected client’s MAC address. Then you can spoof the known-good MAC address on your WNIC so that the router thinks you are one of the allowed clients. This will cause unpredictable network behavior if the client who’s MAC you are spoofing is also connected at the same time as you are.