Determining an IP address for the fragmentation attack

[darkAudax]

Greetings,

In order to use the aireplay-ng fragmentation attack, you must know the network address space used for the access point.  There is no direct way to determine this.

Some indirect ways are:
1) Based on the wireless access point, a good guess is the default address range for the make/model.
2) Try commonly used networks such 192.168.0.0, 192.168.1.0, 10.10.10.0, etc. (Has anyone seen a analysis or study of the most common network addresses?  If yes, where?)
3) See if internal IPs leak via web servers/pages, e-mail headers, etc.
4) Social engineering.

None of these provide an easy or sure method of determining the network address space in use by an access point.  I have been experimenting with a variety of arp type packets as a means to ferret out the actual network address space in use.  All with no success.

So here is the question.  What ideas do people have for an automated way of determining the network address space of the access point?

d.

Edit January 14/2007: aireplay now has improvements whereby it defaults to a source and destination IP of 255.255.255.255.  This works with most access points.  So it minimizes/eliminates the need to know the IPs.

[sorbo]

Why is the IP address necessary?  I guess you want it in order to send a "valid" ARP request that will generate a response.  This is not necessary.  The basic algorithm for recovering a keystream via frag attack is as follows:
1) Obtain the first ~8 bytes of keystream with the usual plain-text XOR cipher-text trick.
2) Send a packet using ~8 byte frags and capture relayed version from AP.  XOR the cipher-text [relayed from AP] and clear-text [whatever you sent].

In order to do #2, you can send any packet that is a broadcast.  The AP must, and will, relay any broadcast packets.  Indeed, the packet need not be ARP.  It can be a packet full of zeros.  In that case, the relayed version will simply contain the keystream [it even saves you from having to XOR ].  Thus, it is not necessary to send a "valid" ARP request---any broadcast packet will do.

In short, I do not think that knowing the net's IP range is a requirement for the frag attack [for recovering a keystream, which is what it seems you are doing].

[daouid]

Hi Sorbo,

just wanted to say :

nice first post !

i'm hoping to see more from you in the future.

the aircrack-ng wiki and trac can greatly be enhanced by this type of explainations