Category:

Wireless LAN (Wi-Fi)

A wireless LAN (WLAN) is a local area network (LAN) without wires. It allows a group of computers and associated devices that share a common communications line and typically share the resources of a single processor or server within a small geographic area (for example, within an office building). It is also referred as Wi-Fi or WiFi

Identify PCI Driver - lshw-gtk GTK Front-end for LSHW - blackMORE Ops - 5

Identify PCI Driver. Ubuntu, Debian, Mint, CentOS, Fedora & all Linux distro

by blackMOREOps August 20, 2014

written by blackMOREOps

This guide shows how you can identify PCI Driver Chipset Information on Linux. Often users troll different forums and blogs to find out they can identify which driver their PCI or USB device is using. This guide applies to all possible scenarios. After reading and following this guide you will be able to identify the followings:

Examples of PCI devices

CPU
Motherboards
Communication controllers
Network devices
High Definition Audio Controller
VGA or graphics cards
Memory (RAM)
Thermal Control Registers
Ethernet devices
DVD R/W devices
Blueray devices
CDROM devices

In short, any device drivers can be identified that is using plugged into a PCI slot.

This guide will work for any Linux distributions, namely –

As usual, I will start with basics first. next few paragraphs are slightly boring but if you really want to understand, you might as well read them, otherwise just skip to the technical bits. Table of contents above.

So let’s start with the basics .. what is a PCI device…

What is Peripheral Component Interconnect or PCI?

Conventional PCI, often shortened to PCI, is a local computer bus for attaching hardware devices in a computer. PCI is an initialism of Peripheral Component Interconnect and is part of the PCI Local Bus standard. The PCI bus supports the functions found on a processor bus but in a standardized format that is independent of any particular processor’s native bus. Devices connected to the PCI bus appear to a bus master to be connected directly to its own bus and are assigned addresses in the processor’s address space.It is a parallel bus, synchronous to a single bus clock.

Attached devices can take either the form of an integrated circuit fitted onto the motherboard itself (called a planar device in the PCI specification) or an expansion card that fits into a slot. The PCI Local Bus was first implemented in IBM PC compatibles, where it displaced the combination of several slow ISA slots and one fast VESA Local Bus slot as the bus configuration. It has subsequently been adopted for other computer types. Typical PCI cards used in PCs include: network cards, sound cards, modems, extra ports such as USB or serial, TV tuner cards and disk controllers. PCI video cards replaced ISA and VESA cards until growing bandwidth requirements outgrew the capabilities of PCI. The preferred interface for video cards then became AGP, itself a superset of conventional PCI, before giving way to PCI Express.

The first version of conventional PCI found in consumer desktop computers was a 32-bit bus using a 33 MHz bus clock and 5 V signalling, although the PCI 1.0 standard provided for a 64-bit variant as well. These have one locating notch in the card. Version 2.0 of the PCI standard introduced 3.3 V slots, physically distinguished by a flipped physical connector to preventing accidental insertion of 5 V cards. Universal cards, which can operate on either voltage, have two notches. Version 2.1 of the PCI standard introduced optional 66 MHz operation. A server-oriented variant of conventional PCI, called PCI-X (PCI Extended) operated at frequencies up to 133 MHz for PCI-X 1.0 and up to 533 MHz for PCI-X 2.0. An internal connector for laptop cards, called Mini PCI, was introduced in version 2.2 of the PCI specification. The PCI bus was also adopted for an external laptop connector standard—the CardBus. The first PCI specification was developed by Intel, but subsequent development of the standard became the responsibility of the PCI Special Interest Group (PCI-SIG).

Conventional PCI and PCI-X are sometimes called Parallel PCI in order to distinguish them technologically from their more recent successor PCI Express, which adopted a serial, lane-based architecture. Conventional PCI’s heyday in the desktop computer market was approximately the decade 1995-2005. PCI and PCI-X have become obsolete for most purposes, however, they are still common on modern desktops for the purposes of backwards compatibility and the low relative cost to produce. Many kinds of devices previously available on PCI expansion cards are now commonly integrated onto motherboards or available in universal serial bus and PCI Express versions. Source: Wikipedia

Question: How do I identify PCI driver for anything in Linux?

This is a million dollar question, just how often you see a similar post in forums and blogs with vague and unreliable answers? I will try my best to answer anything and everything in this post about all devices and their drivers in here. So, stay tuned as this is going to a long a** post.

Identify PCI Driver Chipset Information in Linux

lspci which is a standard command in all Linux distribution will show you the PCI devices on your system.

LS = List

PCI = Peripheral Component Interconnect devices

Step 1: List all PCI devices – Identify PCI driver

root@kali:~# lspci

This will give you a sample output like the following:

root@kali:~# lspci
(some output removed)
00:00.0 Host bridge: Intel Corporation Core Processor DMI (rev 11)
00:03.0 PCI bridge: Intel Corporation Core Processor PCI Express Root Port 1 (rev 11)
00:19.0 Ethernet controller: Intel Corporation 82578DM Gigabit Network Connection (rev 06)
00:1e.0 PCI bridge: Intel Corporation 82801 PCI Bridge (rev a6)
00:1f.0 ISA bridge: Intel Corporation 5 Series Chipset LPC Interface Controller (rev 06)
00:1f.3 SMBus: Intel Corporation 5 Series/3400 Series Chipset SMBus Controller (rev 06)
01:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce 210] (rev a2)
root@kali:~#

Now you can see the device names, types and some funky numbers at the front. (highlighted in bold-red).

Step 2: Get verbose output for selected device – Identify PCI driver

Let’s say we want to identify the driver used my Linux kernel for Ethernet controller (which is the wired port on my motherboard).

00:19.0 Ethernet controller: Intel Corporation 82578DM Gigabit Network Connection (rev 06)

Copy the number’s at the front i.e. 00:19.0 and use it with lspci command to find more info

root@kali:~# lspci -vv -s 00:19.0

This will give you an output like below:

root@kali:~# lspci -vv -s 00:19.0
00:19.0 Ethernet controller: Intel Corporation 82578DM Gigabit Network Connection (rev 06)
    Subsystem: Acer Incorporated [ALI] Device 8000
    Control: I/O+ Mem+ BusMaster+ SpecCycle- MemWINV- VGASnoop- ParErr- Stepping- SERR- FastB2B- DisINTx+
    Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort- <MAbort- >SERR- <PERR- INTx-
    Latency: 0
    Interrupt: pin A routed to IRQ 46
    Region 0: Memory at faec0000 (32-bit, non-prefetchable) [size=128K]
    Region 1: Memory at faefa000 (32-bit, non-prefetchable) [size=4K]
    Region 2: I/O ports at d000 [size=32]
    Capabilities: [c8] Power Management version 2
        Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA PME(D0+,D1-,D2-,D3hot+,D3cold+)
        Status: D0 NoSoftRst- PME-Enable- DSel=0 DScale=1 PME-
    Capabilities: [d0] MSI: Enable+ Count=1/1 Maskable- 64bit+
        Address: 00000000fee0f00c  Data: 4192
    Capabilities: [e0] PCI Advanced Features
        AFCap: TP+ FLR+
        AFCtrl: FLR-
        AFStatus: TP-
    Kernel driver in use: e1000e

So the Kernel is using a driver named e1000e.

Step 3: Get driver info for selected device – Identify PCI driver

Now to get the full details of the driver you issue the following command:

root@kali:~# modinfo e1000e

This will list everything and anything for that driver including the driver file.

root@kali:~# modinfo e1000e 
filename:       /lib/modules/3.14-kali1-amd64/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko
version:        2.3.2-k
license:        GPL
description:    Intel(R) PRO/1000 Network Driver
author:         Intel Corporation, <[email protected]>
srcversion:     875CF610ED4160DBA055BB2
alias:          pci:v00008086d000015A3sv*sd*bc*sc*i*
alias:          pci:v00008086d000015A2sv*sd*bc*sc*i*
alias:          pci:v00008086d000015A1sv*sd*bc*sc*i*
alias:          pci:v00008086d0000105Esv*sd*bc*sc*i*
depends:        ptp
intree:         Y
vermagic:       3.14-kali1-amd64 SMP mod_unload modversions 
parm:           debug:Debug level (0=none,...,16=all) (int)
parm:           copybreak:Maximum size of packet that is copied to a new buffer on receive (uint)
parm:           TxIntDelay:Transmit Interrupt Delay (array of int)
parm:           TxAbsIntDelay:Transmit Absolute Interrupt Delay (array of int)
parm:           RxIntDelay:Receive Interrupt Delay (array of int)
parm:           RxAbsIntDelay:Receive Absolute Interrupt Delay (array of int)
parm:           InterruptThrottleRate:Interrupt Throttling Rate (array of int)
parm:           IntMode:Interrupt Mode (array of int)
parm:           SmartPowerDownEnable:Enable PHY smart power down (array of int)
parm:           KumeranLockLoss:Enable Kumeran lock loss workaround (array of int)
parm:           WriteProtectNVM:Write-protect NVM [WARNING: disabling this can lead to corrupted NVM] (array of int)
parm:           CrcStripping:Enable CRC Stripping, disable if your BMC needs the CRC (array of int)

So the driver file used for this particular Network Controller is:

filename: /lib/modules/3.14-kali1-amd64/kernel/drivers/net/ethernet/intel/e1000e/e1000e.ko

So now you know the device name, details, driver used, vendor, publisher, dependencies, license and Author details for the selected PCI device.

Step 4: NVIDIA – Identify PCI driver dilemma

Interestingly, NVIDIA driver (I used Proprietary NVIDIA driver – NVIDIA Accelerated Linux Graphics Driver) and it seems I had some trouble getting the correct info. Here’s quick rundown:

root@kali:~# lspci | grep VGA*
01:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce 210] (rev a2)

root@kali:~# lspci -vv -s 01:00.0
(some output removed)

    Kernel driver in use: nvidia

So naturally I thought, O’yeah, it’s using nvidia driver. So modinfo should just list the driver file.

So when I tried that, I got NADA

root@kali:~# modinfo nvidia
ERROR: Module nvidia not found.

Bloody hell, this was annoying. Then I just pressed TAB key after the name nvidia and I had two options

nvidia-current and
nvidia-uvm

root@kali:~# modinfo nvidia-
nvidia-current  nvidia-uvm      
root@kali:~# modinfo nvidia-current 
filename:       /lib/modules/3.14-kali1-amd64/nvidia/nvidia-current.ko
alias:          char-major-195-*
version:        331.67
supported:      external
license:        NVIDIA
alias:          pci:v000010DEd00000E00sv*sd*bc04sc80i00*
alias:          pci:v000010DEd00000AA3sv*sd*bc0Bsc40i00*
alias:          pci:v000010DEd*sv*sd*bc03sc02i00*
alias:          pci:v000010DEd*sv*sd*bc03sc00i00*
depends:        i2c-core
vermagic:       3.14-kali1-amd64 SMP mod_unload modversions 
parm:           NVreg_Mobile:int
parm:           NVreg_ResmanDebugLevel:int
parm:           NVreg_RmLogonRC:int
parm:           NVreg_ModifyDeviceFiles:int
parm:           NVreg_DeviceFileUID:int
parm:           NVreg_DeviceFileGID:int
parm:           NVreg_DeviceFileMode:int
parm:           NVreg_RemapLimit:int
parm:           NVreg_UpdateMemoryTypes:int
parm:           NVreg_InitializeSystemMemoryAllocations:int
parm:           NVreg_RMEdgeIntrCheck:int
parm:           NVreg_UsePageAttributeTable:int
parm:           NVreg_MapRegistersEarly:int
parm:           NVreg_RegisterForACPIEvents:int
parm:           NVreg_CheckPCIConfigSpace:int
parm:           NVreg_EnablePCIeGen3:int
parm:           NVreg_EnableMSI:int
parm:           NVreg_MemoryPoolSize:int
parm:           NVreg_RegistryDwords:charp
parm:           NVreg_RmMsg:charp
parm:           NVreg_AssignGpus:charp
root@kali:~#

So looks like NVIDIA-Current is the driver that being used and it’s soft-linked to NVIDIA in MODINFO. Anyone would like to comment/enlighten on this discrepancy?

Step 5: More ways to Identify PCI driver details

Last but not the least, I saved the best three options for the last … this is a quicker way to identify PCI driver on Linux. (yeah, I know what you’re thinking .. what a jerk .. could’ve posted it first … but learning the hard way is better cause now you will NEVER forget this … EVER).. So anywho …

Step 5.1: Identify PCI driver using lspci -k command

Easy task .. just issue the following command that will list the name of the driver straightway…

root@kali:~# lspci -k

-k flag shows kernel drivers handling each device for all PCI devices.

root@kali:~# lspci -k 
(some outputs removed)
0000:00:19.0 Ethernet controller: Intel Corporation 82578DM Gigabit Network Connection (rev 06)
    Subsystem: Acer Incorporated [ALI] Device 8000
    Kernel driver in use: e1000e
01:00.0 VGA compatible controller: NVIDIA Corporation GT218 [GeForce 210] (rev a2)
    Kernel driver in use: nvidia
01:00.1 Audio device: NVIDIA Corporation High Definition Audio Controller (rev a1)
    Kernel driver in use: snd_hda_intel

In this way you can skip Step 1.2 all together (getting verbose output).

Step 5.2: Identify PCI driver using lshw command

lshw is another command that can be used to list hardware info.

ls = List

hw = Hardwares

First you need to install lshw in your Linux system. Easy job.. Install using the following command:

root@kali:~# apt-get install lshw

Now list all hardware and detailed info using the following command

root@kali:~# lshw

and you see a gazillion things. Go through the output and you will find all the things you will ever need for a particular device. This can be quite painful to browse through. There’s a easier way to do that.. we can narrow down each things according to it’s class.

For VGA/Display related output, you can use -C Display with lshw command.

root@kali:~# lshw -C Display

For Audio/Multimedia related output, you can use -C Multimedia with lshw command.

root@kali:~# lshw -C Multimedia

For Network related output, you can use -C Network with lshw command.

root@kali:~# lshw -C Network

and finally last but not the least, lshw also got a GUI version (lshw-gtk). Install that if you don’t want to use command line tools.

Step 5.3: Identify PCI driver using lshw-gtk tool

root@kali:~# apt-get install lshw-gtk

Launch GTK+ front-end for lshw using the following command on terminal

root@kali:~# lshw-gtk &

Refresh the window and you will see everything as per order. Double-click to expand each section.

Note: For all three option, (1.5.1, 1.5.2 and 1.5.3) you need to use modinfo as the final step. For example my ACPI Processor is using the following driver:

root@kali:~# modinfo acpi_cpufreq
filename:       /lib/modules/3.14-kali1-amd64/kernel/drivers/cpufreq/acpi-cpufreq.ko
alias:          acpi
license:        GPL
description:    ACPI Processor P-States Driver
author:         Paul Diefenbaugh, Dominik Brodowski
alias:          x86cpu:vendor:*:family:*:model:*:feature:*00E8*
alias:          x86cpu:vendor:*:family:*:model:*:feature:*0016*
alias:          acpi*:ACPI0007:*
alias:          acpi*:LNXCPU:*
depends:        processor
intree:         Y
vermagic:       3.14-kali1-amd64 SMP mod_unload modversions 
parm:           acpi_pstate_strict:value 0 or non-zero. non-zero -> strict ACPI checks are performed during frequency changes. (uint)
[1]+  Done                    lshw-gtk

Summary

I was planning to write a single Article on how to identify PCI and USB driver but it seems that would be very very long post. So I’ve decided to divide the post into Two parts,

Follow to the next post if you’re using a USB device and trying to identify USB driver used for it. Thanks for reading, please share.

August 20, 2014 1 comment

Hacking How to Kali Linux Linux Wireless LAN (Wi-Fi)

Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)

by blackMOREOps March 27, 2014

written by blackMOREOps

cudaHashcat or oclHashcat or Hashcat on Kali Linux got built-in capabilities to attack and decrypt or Cracking WPA2 WPA with Hashcat – handshake .cap files. Only constraint is, you need to convert a .cap file to a .hccap file format. This is rather easy.

Hashcat

Hashcat is the self-proclaimed world’s fastest CPU-based password recovery tool. It is available free of charge, although it has a proprietary codebase. Versions are available for Linux, OSX, and Windows and can come in CPU-based or GPU-based variants. Hashcat currently supports a large range of hashing algorithms, including: Microsoft LM Hashes, MD4, MD5, SHA-family, Unix Crypt formats, MySQL, Cisco PIX, and many others.

Hashcat has made its way into the news many times for the optimizations and flaws discovered by its creator, which become exploited in subsequent hashcat releases. (For example, the flaw in 1Password’s hashing scheme.)

Attack types

Hashcat offers multiple attack modes for obtaining effective and complex coverage over a hash’s keyspace. These modes are:

Brute-Force attack
Combinator attack
Dictionary attack
Fingerprint attack
Hybrid attack
Mask attack
Permutation attack
Rule-based attack
Table-Lookup attack
Toggle-Case attack

The traditional bruteforce attack is considered outdated, and the Hashcat core team recommends the Mask-Attack as a full replacement.

Variants

Hashcat comes in two main variants:

Hashcat – A CPU-based password recovery tool
oclHashcat – A GPU-accelerated tool

Many of the algorithms supported by Hashcat can be cracked in a shorter time by using the well-documented GPU-acceleration leveraged in oclHashcat (such as MD5, SHA1, and others). However, not all algorithms can be accelerated by leveraging GPUs. Bcrypt is a good example of this. Due to factors such as data dependant branching, serialization, and Memory (to name just a few), oclHashcat is not a catchall replacement for Hashcat.

Hashcat is available for Linux, OSX and Windows. oclHashcat is only available for Linux and Windows due to improper implementations in OpenCL on OSX

Important Note: Many users try to capture with network cards that are not supported. You should purchase a card that supports Kali Linux including injection and monitor mode etc. A list can be found in 802.11 Recommended USB Wireless Cards for Kali Linux. It is very important that you have a supported card, otherwise you’ll be just wasting time and effort on something that just won’t do the job.

My Setup

I have a NVIDIA GTX 210 Graphics card in my machine running Kali Linux 1.0.6 and will use rockyou dictionary for most of the exercise. In this post, I will show step on Cracking WPA2 WPA with Hashcat (handshake files) (.cap files) with cudaHashcat or oclHashcat or Hashcat on Kali Linux.

I will use cudahashcat command because I am using a NVIDIA GPU. If you’re using AMD GPU, then I guess you’ll be using oclHashcat. Let me know if this assumptions is incorrect.

To enable GPU Cracking, you need to install either CUDA for NVIDIA or AMDAPPSDK for AMD graphics cards. I’ve covered those in in my previous posts.

NVIDIA Users:

AMD Users:

Why use Hashcat for cracking WPA WPA2 handshake file?

Pyrit is the fastest when it comes to cracking WPA2 WPA handshake files. So why are we using Hashcat to crack WPA2 WPA handshake files?

Because we can?
Because Hashcat allows us to use customized attacks with predefined rules and Masks.

Now this doesn’t explain much and reading HASHCAT Wiki will take forever to explain on how to do it. I’ll just give some examples to clear it up.

Hashcat allows you to use the following built-in charsets to attack a WPA2 WPA handshake file.

Built-in charsets

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = !”#$%&'()*+,-./:;⇔?@[\]^_`{|}~

?a = ?l?u?d?s

Numbered passwords

So lets say you password is 12345678. You can use a custom MASK like ?d?d?d?d?d?d?d?d

What it means is that you’re trying to break a 8 digit number password like 12345678 or 23456789 or 01567891.. You get the idea.

Letter passwords – All uppercase

If your password is all letters in CAPS such as: ABCFEFGH or LKHJHIOP or ZBTGYHQS ..etc. then you can use the following MASK:

?u?u?u?u?u?u?u?u

It will crack all 8 Letter passwords in CAPS.

Letter passwords – All lowercase

If your password is all letters in lowercase such as: abcdefgh or dfghpoiu or bnmiopty..etc. then you can use the following MASK:

?l?l?l?l?l?l?l?l

It will crack all 8 Letter passwords in lowercase. I hope you now know where I am getting at.

Passwords – Lowercase letters and numbers

If you know your password is similar to this: a1b2c3d4 or p9o8i7u6 or n4j2k5l6 …etc. then you can use the following MASK:

?l?d?l?d?l?d?l?d

Passwords – Uppercase letters and numbers

If you know your password is similar to this: A1B2C3D4 or P9O8I7U6 or N4J2K5L6 …etc. then you can use the following MASK:

?u?d?u?d?u?d?u?d

Passwords – Mixed matched with uppercase, lowercase, number and special characters.

If you password is all random, then you can just use a MASK like the following:

?a?a?a?a?a?a?a?a

Note: ?a represents anything …. I hope you’re getting the idea.

If you are absolutely not sure, you can just use any of the predefined MASKs file and leave it running. But yeah, come back to check in a million years for a really long password …. Using a dictionary attack might have more success in that scenario.

Passwords – when you know a few characters

If you somehow know the few characters in the password, this will make things a lot faster. For every known letter, you save immense amount of computing time. MASK’s allows you to combine this. Let’s say your 8 character password starts with abc, doesn’t contain any special characters. Then you can create a MASK rule file to contain the following:

abc?l?l?l?l?l
abc?u?u?u?u?u
abc?d?d?d?d?d
abc?l?u??d??d?l
abc?d?d?l?u?l

There will be 125 combinations in this case. But it will surely break it in time. This is the true power of using cudaHashcat or oclHashcat or Hashcat on Kali Linux to break WPA2 WPA passwords.

You can even up your system if you know how a person combines a password. Some people always uses UPPERCASE as the first character in their passwords, few lowercase letters and finishes with numbers.

Example: Abcde123

Your mask will be:

?u?l?l?l?l?d?d?d

This will make cracking significantly faster. Social engineering is the key here.

That’s enough with MASK’s. Now let’s capture some WPA2 WPA handshake files. Following WiFite section was taken from a previous guide Cracking Wifi WPA2 WPA passwords using pyrit cowpatty in Kali Linux which was one of the best guides about cracking Wifi passwords out there.

March 27, 2014 36 comments

Hacking Kali Linux Linux Wireless LAN (Wi-Fi)

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux

by blackMOREOps March 10, 2014

written by blackMOREOps

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty– with cuda or calpp in Kali Linux

There are just too many guides on Cracking Wifi WPA/WPA2 passwords using different methods. Everyone has their own take on it. Personally, I think there’s no right or wrong way of cracking a Wireless Access Point. Following way is my way and I found it extremely efficient and fast during my tests for Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux where I attacked with Dictionary using either cuda or calpp (cal++) and at the same time I used WiFite to fast track a few things. This whole process was used in Kali Linux and it took me less than 10 minutes to crack a Wifi WPA/WPA2 password using pyrit cowpatty WiFite combination using my laptop running a AMD ATI 7500HD Graphics card.

You can make the following process faster like I did. If you have an AMD ATI Graphics card you’ll have to follow these guides below:

NVIDIA Users:

AMD Users:

Readers: Please find the most recent article that applies to your graphics card. It’s getting almost impossible to keep with with updates and changing links alone. Find the article with recent date.

Readers, those who would like to try alternate ways of cracking Wifi WPA WPA2 passwords, use HashCat or cudaHashcat or oclHashcat to crack your unknown Wifi WPA WPA2 passwords. The benefit of using Hashcat is, you can create your own rule to match a pattern and do a Brute-force attack. This is an alternative to using dictionary attack where dictionary can contain only certain amount of words but a brute-force attack will allow you to test every possible combinations of given charsets. Hashcat can crack Wifi WPA/WPA2 passwords and you can also use it to crack MD5, phpBB, MySQL and SHA1 passwords. Using Hashcat is an good option as if you can guess 1 or 2 characters in a password, it only takes few minutes. For example: if you know 3 characters in a password, it takes 12 minutes to crack it. If you know 4 characters in a password, it takes 3 minutes. You can make rules to only try letters and numbers to crack a completely unknown password if you know a certain Router’s default password contains only those. Possibilities of cracking is a lot higher in this way.

Important Note: Many users try to capture with network cards that are not supported. You should purchase a card that supports Kali Linux including injection and monitor mode etc. A list can be found in 802.11 Recommended USB Wireless Cards for Kali Linux. It is very important that you have a supported card, otherwise you’ll be just wasting time and effort on something that just won’t do the job.

Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because it’s faster and we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screenshot below:

Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WiFite. It now asks me,

What do you want to do?

[c][/c]ontinue attacking targets
[e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

Now that we have a capture file with handshake on it, we can do a few things:

We can Dictionary attack it.
We can BruteForce attack it.
- Amongst BruteForce, we can use crunch
- We can use oclhashcat.

In this guide, I will show Dictionary attack as almost 20% (that’s 1 in every 5) AP’s will have a standard dictionary password. In later chapters of this guide, I will show Brute Forcing.

Dictionary attack .cap capture file to crack Wifi password

To do a Dictionary attack, we need to grab a dictionary file.

Kali Linux provides some dictionary files as part of its standard installation. How sweet. Thanks Kali Linux Dev team.

Let’s copy one of best dictionary file to root directory.

cp /usr/share/wordlists/rockyou.txt.gz .

Unzip it.

gunzip rockyou.txt.gz

Because WPA2 minimum password requirement is 8 characters, let’s parse this file to filter out any passwords that is less than 8 characters and more than 63 characters. (well, you could just leave this line, but it is completely up to you). So we are saving this file as newrockyou.txt name.

cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

Let’s see how many passwords this file contains:

wc -l newrockyou.txt

That’s a whopping 9606665 passwords.

Original file contained even more..

wc -l rockyou.txt

That’s 14344392 passwords. So we made this file shorter which means we can test more AP’s in less time.

Finally, lets rename this file to wpa.lst.

mv newrockyou.txt wpa.lst

Create ESSID in Pyrit Database

Now we need to create ESSID in Pyrit Database.

pyrit –e BigPond create_essid

NOTE: If you have an AP that’s got Space it in, example: “NetComm Wireless” then your command will become like this:

pyrit -e 'NetComm Wireless' create_essid

I know a lot of the people struggles with this issue :)

Awesome, now we have our ESSID added to Pyrit Database.

Import Dictionary in Pyrit

Now that we have our ESSID added to Pyrit database, lets go an import our Password Dictionary.

Use the following command to import previously created password dictionary wpa.lst to Pyrit Database.

pyrit -i /root/cudacapture/wpa.lst import_passwords

Create tables in Pyrit using batch process

We now need to batch process to create tables.

This is simple, just issue the following command

pyrit batch

Because I’m on a laptop with a crappy AMD 7500 graphics card, I’m getting only 15019 PMKs per second (that includes my CAL++). If you got a more powerful Graphics card and managed to install either CUDA for NVIDIA Graphics card or CAL++ for AMD Cards, your speed will be a lot more.

Oh, and I just took this awesome screenshot while Pyrit was doing the batch processing. Check out my CPU usage, it’s hitting absolutely 100%.

Also check out my temperature of my cores:

You should be careful how big your dictionary file is and how HOT your CPU and Graphics card is burning. Use extra cooling if you can to avoid damage.

Cracking Process

We can crack using few different process.

Using Pyrit
Using Cowpatty

Attack a handshake with PMKs from the db using Pyrit

Simple. Just use the following command to start the cracking process.

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap attack_db

That’s it. It will take few minutes to go through the whole Database Table to get the password if it existed in the Dictionary. As you can see, 159159186.00 PMK‘s per second was the speed and it took less than 1 second to crack it. This is by far the fastest. I also had to blank out much of the screenshot.

Note: I tried it from a different workstation with a NVIDIA GTX460 Graphics card with CUDA and Cpyrit-CUDA installed. Obviously, this was much faster than my Laptop. But either way, this is super fast.

Attack a handshake with passwords from a file or Dictionary using Pyrit

If you don’t want to create Datbase and crunch through Dictionary file directly (much slower), following is what you can do:

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/wpa.lst attack_passthrough

Speed this way? 7807 PMKs per second. Much slower for my taste.

Crack using Cowpatty

To crack using cowpatty, you need to export in cowpatty format and then start the cracking process.

Export to cowpatty

I hope up to this point, everything went as planned and worked out. From Pyrit, we can push our output to either cowpatty or airolib-ng. All my tests shows that cowpatty is a lot more faster, so I’ll stick with that.

So let’s make our cowpatty file. This is again simple, issue the following command to export your output to cowpatty.

pyrit -e BigPond -o cow.out export_cowpatty

Let it rip: Crack WPA WPA2 PSK password using cowpatty

Now that we have our cowpatty output, let’s try to crack WPA2/PSK passphrase. Issue the following command to start the cracking process.

cowpatty -d cow.out -s BigPond -r hs/BigPond_58-98-35-E9-2B-8D.cap

Once you type it in, you’ll a bunch of passwords being tried against your hash file. This will keep going until the end of the file. Once a matching password is found in the dictionary file, the cracking process will stop with an output containing the password.

And bingo, it found a matching password. Look at the number of passwords tried in a seconds 164823.00 passphrases/second.

NOTE: cowpatty will fail if your password/dictionary file is larger than 2GB. You’ll have to stick to airolib-ng even though that’s slower.

Attack a handshake with PMKs from a cowpatty-file using Pyrit

Here’s another way using Pyrit…

You can use cow.out file in Pyrit next time

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/cow.out attack_cowpatty

Speed this way? 31683811 PMKs per second. Much slower than using Pyrit attack_db process. But at least you don’t have to batch process this way.

Cleanup Pyrit and database

Lastly, if you feel like, you can delete your essid and cleanup.

pyrit BigPond delete_essid

Conclusion

Thanks for reading. This process is not always possible and sometimes cracking Wifi WPA/WPA2 passwords using Reaver-WPS is much easier. You might want to check that too.

Cracking Wifi WPA/WPA2 passwords

If this guide helped you to achieve what you wanted, please share this article with friends.

Update: 13/03/2014: I just realized I forgot to credit purehate for his ORIGINAL post in BackTrack forum. Without his guide, much of this wouldn’t be possible.

Last but not the least, I’ll cover up my back …

Disclaimer: This guide is for training and educational purposes only. Ensure you have permission before you attack an access point as it is a felony in many countries. I take no responsibility of the usage of these instructions containing in this guide.

March 10, 2014 52 comments

Increase TX Power Signal Strength of WiFi

Kali Linux Wireless LAN (Wi-Fi)

802.11 Recommended USB Wireless Cards for Kali Linux

by blackMOREOps January 8, 2014

written by blackMOREOps

802.11 Recommended USB Wireless Cards for Kali Linux

NEW UPDATED PAGE

Best WiFi Adapters for Kali Linux

This post lists some of the best performing, supported and recommended USB Wireless Cards for Kali Linux.

There isn’t a “best” card. There is whatever is right for YOU.

Following recommended USB Wireless cards appears to be working for Kali Linux (i.e. monitor, injection etc.)

*Note* These are not in any type of order *Note*

A common problem in pentest distro such as Kali or BackTrack Linux is when users trying to use a card which is not supported or there just isn’t a supported driver. Most of the following cards are priced below $50USD and they take care of a massive headache and saves time to troubleshoot driver issues rather than investing time to actually do something. With each update these makeshift fixes seems to break old drivers and you end up doing the whole thing again and again.

A good card will allow you to crack Wifi on the fly or at least make it easier. Some examples are:

Cracking WPA WPA2 with Hashcat on Kali Linux (BruteForce MASK based attack on Wifi passwords)

Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat, cudaHashcat, oclHashcat on Kali Linux

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty on Kali Linux

This whole drama goes away when you get one of the recommended usb wireless cards. Then again, I got few different Wifi cards and I managed to make all of them work with Kali Linux including injection and monitor mode etc. It really depends on the user and type of card. This guide will possibly help someone who just got an unsupported card and/or tired of wasting time troubleshooting existing card and would rather spend some $$ to have this problem go away once and for all. This post is again adapted from none other than g0tmi1k’s post in Kali forums.

POST UPDATED:

28/03/2014 – Added Linksys WUSB54GC v1 Compact Wireless-G USB Adapter to recommended list.

12/01/2015 – Added Alfa RangeBooster Antenna’s and classic AWUS036H adapters (1000mW and 2000mW) to recommended list. See List of Nethunter supported devices here.

23/04/2015 – Added a poll. Please vote (you don’t need to register) so that readers can find the best card quickly.

[poll id=”2″]

2.4GHz Adapters

Rokland N3

~ https://store.rokland.com/products/th…b-for-macs-pcs

$32.97 off Rockland

Ralink RT3070 ~ https://wikidevi.com/wiki/Rokland_n3

700 mW

Detachable antenna (RP-SMA)

IEEE 802.11b/g/n

150Mbps

WEP, WPA/WPA2, WPS

USB 2.0

Alfa AWUS036NHA

~ https://www.alfa.com.tw/products_show.php?pc=34&ps=20

$20.17 off Amazon

Atheros AR9271 ~ https://wikidevi.com/wiki/ALFA_Network_AWUS036NHA

~800 mW (29dBm)

Detachable antenna (RP-SMA)

IEEE 802.11b/g/n

150Mbps

WEP, WPA/WPA2, WPS

USB 2.0

Alfa AWUS036H High power 1000mW 1W 802.11b/g and Alfa AWUS036NH 2000mW 2W 802.11g/n

~ https://www.alfa.com.tw/products_show.php?pc=34&ps=20

1000mW is priced at 39.99$ at Amazon

2000mW is priced at 39.99$ at Amazon

Atheros AR9271 ~ https://wikidevi.com/wiki/ALFA_Network_AWUS036NHA

~800 mW (29dBm)

Detachable antenna (RP-SMA)

IEEE 802.11b/g/n

150Mbps

WEP, WPA/WPA2, WPS

USB 2.0

TP-Link WN722N

~ https://uk.tp-link.com/products/detai…TL-WN722N#spec

$10.99 off Amazon

Atheros AR9002U ~ https://wikidevi.com/wiki/TP-LINK_TL-WN722N

500 mW ?

Detachable antenna (RP-SMA)

IEEE 802.11b/g/n

150Mbps

WEP, WPA/WPA2, WPS

USB 2.0

Linksys WUSB54GC v1

~ https://support.linksys.com/en-us/support/adapters/WUSB54GC

$19.99 off Amazon

Chipset: Ralink 2573 USB ~ https://wikidevi.com/wiki/Linksys_WUSB54GC_v1

Driver: rt73usb

IEEE 802.11b/g

150Mbps

WEP, WPA/WPA2, WPS

USB 2.0

Stack: mac80211

Injection: Yes

See discussion here:

5GHz (& 2.4GHz) Adapters

~~Rosewill RNX-N600UBE~~

~~~ https://www.rosewill.com/products/182…ifications.htm~~

~~$32.66 off Amazon~~

~~Ralink RT3572 ~ https://wikidevi.com/wiki/Rosewill_RNX-N600UBE~~

~~100 mW ?~~

~~Detachable antenna (SMA)~~

~~IEEE 802.11a/b/g/n~~

~~300Mbps~~

~~WEP, WPA/WPA2, WPS~~

~~USB 2.0~~

Update: Taken from a comment of ‘Proper Gander’ / December 11, 2014 at 11:37 pm

I should add that the Rosewill RNX-N600UBEs they’re selling at Amazon come with Ralink 5572s now so someone looking for a plug-and-play option will be disappointed, and frustrated, and praying that someone will see this comment on a half-year old article and give them a little help.

Comment: So unless someone else can verify that Ralink RT3572 was replaced by Ralink 5572, I am marking Rosewill RNX-N600UBE incompatible.

WiFi Booster Antenna’s

Alfa 9dBi WiFi Booster SMA OMNI-Directional High-Gain Screw-On Swivel Antenna

9.99$ off Amazon

802.11 b /g and “N”, 2000mW of power which is more powerful than ANY other WiFi adapter on the market

Includes a 4 inch 5 DdBi Screw-On Swivel Rubber Antenna that can be removed and upgrade up to 9dBi

Very Secure with wireless data encryption with 64/128-bit WEP, WPA, WPA2, TKIP,and AES and is Compatible with IEEE 802.11n

Supports driver for Windows 2000, XP 32/64, Vista 32/64, Windows 7, Linux (2.4.x/2.6.x),and Mac (10.4.x/10.5.x)

The Mount designed for easy clinging on Notebook, Netbook and Window.

Alfa 9dBi WiFi Booster SMA OMNI-Directional High-Gain Screw-On Swivel Antenna With magnetic base

14.99$ off Amazon

This Antenna is original Alfa brand – the most trusted nome in network range

Fits all routers access points VOIP devices and PCI cards with an RP-SMA connection

No aiming required – Omni-directional with +9 dB gain

Replaces Factory Standard Antenna and Boosts the Range of your Router as much as 4x

RP-SMA male connector 90 degree joining near base Length: 14.75-inches (approximate)

WUS036H, WUS036H1W, APA05, WUS036NH, WUS036NEH, WUS048NH, WUS036EW, WUS051NH

Other useful links

https://www.aircrack-ng.org/doku.php?id=install_drivers

https://aircrack-ng.blogspot.co.uk/20…tbook-for.html

If you have a different card feel free to share here which will probably help another user someday.

“No responsibility is taken for the correctness of this information.” == Double check before purchasing.

Conclusion

While these are the tested adapters and comes most recommended, manufacturers always change chipsets and it is simply impossible for to me keep this list up-to-date (on top of running this site alone). I strongly suggest you read the chipset info before purchasing.

Read the comments section below for more users experience and if you have any suggestions/recommendations, let me know. I can’t promise I will add everything, but at least the next user/reader will have some useful info to read and make an informed and better decision. Comments doesn’t require registration or validity, so feel free.

Followings guides will surely keep you busy for few days. I suggest looking around in Kali forums and generally Google/DuckDuckGo for more interesting stuffs.

Cracking Wifi WPA/WPA2 passwords

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty

Cracking Wireless WPA2 WPA passwords with Hashcat

Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

Cracking password hashes

Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat

DOS/DDOS attacks

DOS attack on Windows 2008 R2 server and Windows 7

DOS using hping3 with spoofed IP

Metasploit related

Hack Remote PC with Metasploit

SQLMap and Google Dorks

Use SQLMAP to hack a website

Google Dorks / Google Hacks

January 8, 2014 65 comments

How to Linux Wireless LAN (Wi-Fi)

TP-Link TL-WDN3200 N600 Wireless Dual Band USB Adapter in Linux

by blackMOREOps January 2, 2014

written by blackMOREOps

I’ve got this TP-Link TL-WDN3200 N600 Wireless Dual Band USB Adapter and I’ve been trying to make it work in Kali Linux which is a Debian derivative. I managed to find the Linux driver DPO_RT5572_LinuxSTA_2.6.1.3_20121022.tar.bz2 from https://www.mediatek.com/. The instructions were very clear but when I tried to compile I received an compile error “make: *** /lib/modules/3.7-trunk-amd64/build: No such file or directory. Stop.“. Following is how to re-produce and fix this error.

Plug-in the USB Adapter

Issue the following command which lists all plugged in USB devices.

root@oracle:~# lsusb 
Bus 001 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 002 Device 002: ID 8087:0020 Intel Corp. Integrated Rate Matching Hub
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 001 Device 003: ID 148f:2870 Ralink Technology, Corp. RT2870 Wireless Adapter
Bus 002 Device 003: ID 148f:5572 Ralink Technology, Corp. 
root@oracle:~#

Download driver and unpack it.

root@oracle:~# tar xvf DPO_RT5572_LinuxSTA_2.6.1.3_20121022.tar.bz2
root@oracle:~# cd Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/
root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# ls
chips    iwpriv_usage.txt  rate_ctrl          RT2870STA.dat             tools
common   Makefile          README_STA_usb     sta
include  os                RT2870STACard.dat  sta_ate_iwpriv_usage.txt

Modify makefile

In Makefile

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# leafpad Makefile

set the "MODE = STA" in Makefile and chose the TARGET to Linux by set "TARGET = LINUX".
You can modify more to meet your need.

Modify config.mk file

In os/linux/config.mk

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# leafpad os/linux/config.mk

2 Options:

** Build for being controlled by NetworkManager or wpa_supplicant wext functions
Please set ‘HAS_WPA_SUPPLICANT=y’ and ‘HAS_NATIVE_WPA_SUPPLICANT_SUPPORT=y’.
=> #>cd wpa_supplicant-x.x
=> #>./wpa_supplicant -Dwext -ira0 -c wpa_supplicant.conf -d
** Build for being controlled by WpaSupplicant with Ralink Driver
Please set ‘HAS_WPA_SUPPLICANT=y’ and ‘HAS_NATIVE_WPA_SUPPLICANT_SUPPORT=n’.
=> #>cd wpa_supplicant-0.5.7
=> #>./wpa_supplicant -Dralink -ira0 -c wpa_supplicant.conf -d

In my case, I choose y and y for both.

Complile code

Now lets try to compile using make command.

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# make
make -C tools
make[1]: Entering directory `/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools'
gcc -g bin2h.c -o bin2h
make[1]: Leaving directory `/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools'
/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools/bin2h
cp -f os/linux/Makefile.6 /root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/os/linux/Makefile
make -C /lib/modules/3.7-trunk-amd64/build SUBDIRS=/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/os/linux modules
make: *** /lib/modules/3.7-trunk-amd64/build: No such file or directory.  Stop.
make: *** [LINUX] Error 2

This is where I got the error:

make: *** /lib/modules/3.7-trunk-amd64/build: No such file or directory.  Stop.
make: *** [LINUX] Error 2

Determine headers

To fix this error we need to install correct headers as you can see the compiler is looking into the following directory /lib/modules/3.7-trunk-amd64/build
Following command will list available headers

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# aptitude search `uname -r`
p   linux-headers-3.7-trunk-amd64                 - Header files for Linux 3.7-trunk-amd64
i A linux-image-3.7-trunk-amd64                   - Linux 3.7 for 64-bit PCs              
p   linux-image-3.7-trunk-amd64-dbg               - Debugging symbols for Linux 3.7-trunk-amd64                             
v   linux-latest-modules-3.7-trunk-amd64          -                                       
v   linux-modules-3.7-trunk-amd64                 -                                       
p   xen-linux-system-3.7-trunk-amd64              - Xen system with Linux 3.7 on 64-bit PCs (meta-package)

Now let’s install the correct headers using the following command

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# apt-get install linux-headers-$(uname -r|sed 's,[^-]*-[^-]*-,,')
Reading package lists... Done
Building dependency tree       
Reading state information... Done
The following extra packages will be installed:
  linux-headers-3.7-trunk-amd64 linux-headers-3.7-trunk-common linux-kbuild-3.7
The following NEW packages will be installed:
  linux-headers-3.7-trunk-amd64 linux-headers-3.7-trunk-common linux-headers-amd64 linux-kbuild-3.7
0 upgraded, 4 newly installed, 0 to remove and 0 not upgraded.
Need to get 4,671 kB of archives.
After this operation, 30.0 MB of additional disk space will be used.
Do you want to continue [Y/n]? Y
.
.
.
.
.
<truncated>
.
.
.

Setting up linux-headers-3.7-trunk-common (3.7.2-0+kali8) ...
Setting up linux-kbuild-3.7 (3.7.1-1~experimental.1+kali2) ...
Setting up linux-headers-3.7-trunk-amd64 (3.7.2-0+kali8) ...
Setting up linux-headers-amd64 (3.7+46+kali1) ...

That looks good. Now we should be able to compile the code

Compile code – Take 2

Issue make command to complile source codes

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# make
make -C tools
make[1]: Entering directory `/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools'
gcc -g bin2h.c -o bin2h
make[1]: Leaving directory `/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools'
/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/tools/bin2h
cp -f os/linux/Makefile.6 /root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/os/linux/Makefile
make -C /lib/modules/3.7-trunk-amd64/build SUBDIRS=/root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/os/linux modules
make[1]: Entering directory `/usr/src/linux-headers-3.7-trunk-amd64'
.
.
.
.
.
<truncated>
.
.
.
.
.
make[1]: Leaving directory `/usr/src/linux-headers-3.7-trunk-amd64'
cp -f /root/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022/os/linux/rt5572sta.ko /tftpboot
root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022#

Thats looks better. Now we can try to actually use the driver.

Copy drivers

Copy the driver to /etc/Wireless/RT2870STA

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# mkdir -p /etc/Wireless/RT2870STA/
root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# cp RT2870STA.dat /etc/Wireless/RT2870STA/

Load driver module

Plugin the USB Adapter now if you haven’t already and load driver

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# insmod os/linux/rt5572sta.ko

Set interface up

Set interface up and you might need to restart Network Manager

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# ifconfig ra0 inet up
root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# service network-manager restart

Unload driver module

To unload driver, unplug the USB Adapter and

root@oracle:~/Desktop/DPO_RT5572_LinuxSTA_2.6.1.3_20121022# rmmod rt2870sta

That makes TP-Link TL-WDN3200 N600 Wireless Dual Band USB Adapter work in linux.

Thanks for reading.

January 2, 2014 15 comments

Newer Posts

Older Posts

Wireless LAN (Wi-Fi)

Examples of PCI devices

What is Peripheral Component Interconnect or PCI?

Question: How do I identify PCI driver for anything in Linux?

Identify PCI Driver Chipset Information in Linux

Step 1: List all PCI devices – Identify PCI driver

Step 2: Get verbose output for selected device – Identify PCI driver

Step 3: Get driver info for selected device – Identify PCI driver

Step 4: NVIDIA – Identify PCI driver dilemma

Step 5: More ways to Identify PCI driver details

Step 5.1: Identify PCI driver using lspci -k command

Step 5.2: Identify PCI driver using lshw command

Step 5.3: Identify PCI driver using lshw-gtk tool

Summary

Hashcat

Attack types

Variants

My Setup

NVIDIA Users:

AMD Users:

Why use Hashcat for cracking WPA WPA2 handshake file?

Built-in charsets

Numbered passwords

Letter passwords – All uppercase

Letter passwords – All lowercase

Passwords – Lowercase letters and numbers

Passwords – Uppercase letters and numbers

Passwords – Mixed matched with uppercase, lowercase, number and special characters.

Passwords – when you know a few characters

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty– with cuda or calpp in Kali Linux

NVIDIA Users:

AMD Users:

Capture handshake with WiFite

Dictionary attack .cap capture file to crack Wifi password

Create ESSID in Pyrit Database

Import Dictionary in Pyrit

Create tables in Pyrit using batch process

Cracking Process

Attack a handshake with PMKs from the db using Pyrit

Attack a handshake with passwords from a file or Dictionary using Pyrit

Crack using Cowpatty

Export to cowpatty

Let it rip: Crack WPA WPA2 PSK password using cowpatty

Attack a handshake with PMKs from a cowpatty-file using Pyrit

Cleanup Pyrit and database

Conclusion

Cracking Wifi WPA/WPA2 passwords

802.11 Recommended USB Wireless Cards for Kali Linux

2.4GHz Adapters

Rokland N3

Alfa AWUS036NHA

Alfa AWUS036H High power 1000mW 1W 802.11b/g and Alfa AWUS036NH 2000mW 2W 802.11g/n

TP-Link WN722N

Linksys WUSB54GC v1

5GHz (& 2.4GHz) Adapters

Rosewill RNX-N600UBE

WiFi Booster Antenna’s

Alfa 9dBi WiFi Booster SMA OMNI-Directional High-Gain Screw-On Swivel Antenna

Alfa 9dBi WiFi Booster SMA OMNI-Directional High-Gain Screw-On Swivel Antenna With magnetic base

Other useful links

Conclusion

Cracking Wifi WPA/WPA2 passwords

Cracking password hashes

DOS/DDOS attacks

Metasploit related

SQLMap and Google Dorks

Plug-in the USB Adapter

Download driver and unpack it.

Modify makefile

Modify config.mk file

2 Options:

Complile code

Determine headers

Compile code – Take 2

Copy drivers

Load driver module

Set interface up

Unload driver module

Random Posts

Useful Links