Aircrack-ng

Please login or register.

Login with username, password and session length
Advanced search  

News:

Aircrack-ng 1.6 release

Pages: 1 2 [3] 4 5 ... 10
 21 
 on: June 30, 2020, 11:50:58 pm 
Started by Tarek - Last post by Tarek
1. You can't. You need cards on every single channel, as you never know when these happens.
2. I can't remember exactly but I'd say most likely association frames (or possibly data frames between them). Probes aren't used for that purpose, it's just a frame used to scan for AP. However, these probes are displayed at the end of each station line (probe column) to show what ESSID the station has looked for.
That makes much more sense thank you. But in first question, I noticed that airodump-ng is very fast at finding those frames even though the interval between channel hopping is 1 second and I'm still using 1 card. That's why I wanted to understand the concept behind it. I tried to read the source code, but I couldn't understand this part that much. Like it always detects if my station is connected or not every single time.

 22 
 on: June 30, 2020, 08:20:25 pm 
Started by Tarek - Last post by misterx
1. You can't. You need cards on every single channel, as you never know when these happens.
2. I can't remember exactly but I'd say most likely association frames (or possibly data frames between them). Probes aren't used for that purpose, it's just a frame used to scan for AP. However, these probes are displayed at the end of each station line (probe column) to show what ESSID the station has looked for.

 23 
 on: June 30, 2020, 04:55:49 pm 
Started by Tarek - Last post by Tarek
Hello all,

I have couple questions,

How do I make channel hopping fast enough to not miss any disassociation or deauthentication frames when hopping from channel to the next. Because those frames are not a lot, and I might miss the frame when hopping from one channel to the next. Let's say I'm hopping between 1,2,3,4,5,6,7,8,9,10,11 and if there is 1 second interval between them, then by the time I get to channel 11 some client sent something on channel 1. any ideas ?


Second question:

When you detect STATION that is associated or connected to AP, which frames do you use to know that ? Probe response ? Or association frame ? Because as far as I know, probe requests are sent from devices to check for pre-connected access points and doesn’t mean the client is connected to this access point.

 24 
 on: June 27, 2020, 05:08:16 pm 
Started by Willy_D - Last post by Lada.Capozzi
This PWR is between AP and Client? Or between me and Client of this AP?

 25 
 on: June 14, 2020, 12:29:49 pm 
Started by 765F - Last post by misterx
You selected source address. Go to the field that says BSSID, not any other.

 26 
 on: June 14, 2020, 07:02:01 am 
Started by 765F - Last post by 765F
Thank you for the response, and sorry for the late reply.

I've followed the steps in Wireshark. Not sure if I captured a handshake, here are some screenshots of the results.


 27 
 on: June 08, 2020, 01:52:30 pm 
Started by 765F - Last post by misterx
Open the pcap with wireshark, then search for the beacon for your network. From there, open the beacon, select the bssid, and apply it as a filter. That will limit to your network only.

If you just want to see the handshake, look for eapol frames. You can append " && eapol" to the existing display filter, which will search for both your bssid AND the handshakes on your network. Once you've located the handshake, select one of the frames, and remove the display filter (you may keep the wlan.bssid filter, along with the address). You should see association frames right before it. If you keep scrolling up, you'll see authentication, and also probes.

Check the WPA capture explained in the wiki: https://aircrack-ng.org/doku.php?id=wpa_capture.

 28 
 on: June 08, 2020, 11:27:15 am 
Started by 765F - Last post by 765F
Can you see the initial handshake or the frames prior to that (probe/auth/assoc)? Note that devices sometimes randomize mac, so it may not look like the original MAC

Thank you again for the reply @mistrex

I can't really see handshakes prior to the (probe/auth/assoc). Reason being because there is too many networks in the area and I don't know how to scroll down in the terminal to see the current active handshakes.

Usually, when I start airmong-ng, I do see a glimpse of the handshakes before all the networks load. But none are from my network.

 29 
 on: June 07, 2020, 02:40:31 pm 
Started by 765F - Last post by misterx
Can you see the initial handshake or the frames prior to that (probe/auth/assoc)? Note that devices sometimes randomize mac, so it may not look like the original MAC

 30 
 on: June 07, 2020, 02:38:09 pm 
Started by sec_solutions - Last post by misterx
If airodump-ng isn't set on a static channel, then it will change. If you set it to a static channel and it changes, then there is something else interfering, likely a network manger (which should be killed prio to putting the interface in monitor mode).

Pages: 1 2 [3] 4 5 ... 10