Implementation of new fragmentation attack

[kandinsky]

Yeah of course!

It is a honour for me

If you can make a sidenote that I have used the stock Madwifi 28/11/2006 snapshot and didnt apply any injection patches at all.

Thanks

[jeroenimo]

I can confirm the fragmentation attack , it works fine on my BackTrack 2.0 with that 1.4.9 driver from ASPj and a linksys WUSB54G, althought I'm quite close neigbours network I cannot get more than 110 data packets per second out of it m as in daouid's video it show more than 500 datapackets per second, now is this normal ? He uses a Ralink chip too, does this have to do that I'm only using USB 1.1 or can there be another cause ? I have never seen higher rate' then 120 data packets per second .

[phenix]

Yeah works really great (madwifi - patched & ubuntu dapper drake)

Has anyone tested it on shared key networks yet? Does it work? (Havent had a look on how the afrag attack works in detail yet but it should work!?)
Anyone tested it already?

[Hirte]

i implemented the fragmentation attack in aireplay-ng as attack "-5" or "--fragment". you'll find the code in the svn. i tested it with the alfa usb adapter using a realtek chipset and the corresponding r8187 driver.

i'll upload the patch i wrote to use fragmentation attack with this driver tomorrow.

and phenix: a shared key authentication shouldn't interfere with the fragmentation attack...

EDIT: forgot the most important thing: thanks ASPj

[Mister_X]

Thanks, Hirte.

I'll find some time to update the man page this week-end.

[*dudux]

new video of   fragmentation attack with WIFISLAX 1.1 ( Seguridad Wireless)
http://www.megaupload.com/?d=IM7EUER0

the format is *.swf

[Mister_X]

can you upload it somewhere else (Megaupload is full, at least for belgium) so that I can put it in videos.aircrack-ng.org

[*dudux]

VIDEO OF FRAGMENTATION ATTACK WIFISLAX 1.1& rausb0 ( Seguridad Wireless)
*****************************************************[***************

http://mirror-wifislax.lost-away.org/videos/fragmentacion.htm


ok.....it´s good idea!!!

[Mister_X]

I'm uploading it, you can remove the link if you want (here I don't really care about the bandwidth used, I have 600Gb/mo). Thanks

[*dudux]

Say the link to me and we see it...

But in bluntmen.com this one also well

[Mister_X]

http://videos.aircrack-ng.org/

[*dudux]

i dont see the video......

somebody works with atheros in the fragmentation attack

[darkAudax]

Hello,

I have downloaded the SVN version of aircrack-ng to try the fragmentation attack.

I am using atheros chipset and madwifi-ng drivers.  Packet injection works on my system.

Here is what I run in monitor mode locked to AP channel:
./aireplay-ng -5 ath0 -b 00:14:6C:7E:40:80 -h 00:0F:B5:AB:CB:9D -l 192.168.55.117

 -b 00:14:6C:7E:40:80 Access Point
 -h 00:0F:B5:AB:CB:9D mac address of associated client
 -l 192.168.55.117 IP address of associated client

I get a continous stream of messages like this:

Trying to get 408 bytes of a keystream
No answer, repeating...
Still nothing, trying another packet...
Data packet found!
Sending fragmented packet
Got RELAYED packet!!
Thats our ARP packet!
Trying to get 408 bytes of a keystream
No answer, repeating...
Trying to get 408 bytes of a keystream
Trying a LLC NULL packet
No answer, repeating...
Trying to get 408 bytes of a keystream
No answer, repeating...
Trying to get 408 bytes of a keystream
Trying a LLC NULL packet
No answer, repeating...
Trying to get 408 bytes of a keystream
No answer, repeating...
Trying to get 408 bytes of a keystream
Trying a LLC NULL packet
No answer, repeating...
Trying to get 408 bytes of a keystream

I also tried the original code: http://homepages.tu-darmstadt.de/~p_larbig/wlan/afrag-0.1.tar.bz2 and I am also not successful.

My questions:
- Is the command I used properly formatted?
- Which IP are you supposed to use?  The client?  A client on the ethernet?  Etc.?
- On my access point when you use chopchop, it always has the warning "Warning: ICV checksum verification FAILED!".  The xor stream can always be used successfully.  Would this be a hint as to why the fragmentation attack does not work on my access point?
- Is there any debuging techiques I can use?

Thanks,
d.

[Mister_X]

Does the stable version produce the same error, darkAudax? One of the last change was related to madwifi-ng detection by aireplay-ng.

[*dudux]

I am using atheros chipset and madwifi-ng drivers

i think that good chipsets are:

rt2570 USB (Ralink ), rt2571 USB ( Ralink ),
rt25XX PCI ( Ralink ), rtl8187 USB ( Realtek )
atheros PCI ( Atheros) not always works!!

are you working with afrag? o with aircrack-ng -5??


For Mister.X :
why the link goes so slowly??
http://videos.aircrack-ng.org/

http://mirror-wifislax.lost-away.org/videos/fragmentacion.htm
http://foro.elhacker.net/index.php/topic,147959.0.html