Cracking WPA/WPA2 Networks without dictionaries using REAVER

What is reaver?  Reaver is a tool that implements a brute-force attack against the WiFi Protected Setup (WPS) PIN registrar used to recover WPA/WPA2 passwords<br /><br />OK, now that we know what Reaver is and what it's used for, let's get into the subject a bit. The 1st thing we must do is put our network card in monitor mode. To do this we open a terminal and type the following command line, see image:<br /><br />

Airmon-ng start wlan0

<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />As we can see in the previous image, we have already put our card in monitor mode, in this case mine will be mon0.<br /><br />Next, what we need for our operation to be successful is to locate a network that has WPS (WiFi Protected Setup) enabled. There are several methods to achieve this, I'm going to use the tool WIFITE, already included in our distribution Backtrack5 and Kali Linux. To run WIFITE, in Kali Linux which is the case, we open a terminal and simply type wifite and press enter, see image:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once we have typed wifite and pressed enter, the tool will begin scanning the network on its own and at the same time it will mark the networks that have WPS(WiFi Protected Setup) enabled, see image:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />As we can see in the previous image, it has already scanned the network and I'm going to select the network called wlan_4D55 (since this one is mine)<br /><br />Now that we know that the network we are going to audit has WPS (WiFi Protected Setup) enabled, we know it is vulnerable to the ATTACK with REAVER.<br /><br />The next step we need to crack the network is to discover its BSSID. To do this we will use the tool airodump-ng. To do this the only thing we have to do is open a terminal and type the following command line in it:<br /><br />

Airodump-ng mon0

<br /><br />And it will automatically start scanning the network and showing us their BSSIDs, among which our network's will be found, see image:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />As we can appreciate in the previous image, we have already discovered the BSSID of the network we are auditing. Now with this data we can begin the attack with REAVER to recover our password without needing to use dictionaries.<br /><br />To run REAVER, we open a terminal and type the following command line in it and press enter:<br /><br />

Reaver –i mon0 –b A4:52:6F:E2:4D:56 –VV

<br /><br />I'll briefly explain this previous command line –i mon0 =our network card in monitor mode. –b A4:52:6F:E2:4D:56=the BSSID of our network. –vv=verbose mode, to see what is happening it would look something like this.<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />Once we have entered the previous command line and pressed enter, the tool will begin working on its own, and the only thing we must do now is wait and be very patient, since this operation can take between 4 and 15 hours, it will all depend on the quality of the network signal and our equipment.<br /><br />Once REAVER has finished working it will show us the following data in the terminal:<br /><br />Los enlaces son solo para miembros. Registrate o iniciá sesión<br /><br />As we can see in the previous image, we have already recovered our password and the PIN of our network. IT IS IMPORTANT TO SAVE THE PIN in a place where we can see it whenever we want, because once we have the network's PIN, with this command line:<br /><br />

Reaver –i mon0 –b A4:52:6F:E2:4D:56 –p 13409708 –VV

<br /><br />If we notice, we have added to the previous REAVER command the parameter (p) followed by the PIN number, well, this way the cracking won't take more than 10 minutes the next time we lose the password J<br /><br />Now we're going to briefly explain some optional REAVER commands and their functionality:<br /><br /><br />[+] -c to select the network channel<br />[+] -e to select the network name (Essid)<br />[+] -t Thereception timeout by default is 5 seconds, with this command we can set it down to a minimum of 1 second.<br />[+] –fixed with this command we make REAVER change channel consecutively at the same time as the network, "if it were to do so".<br />[+] –lock-delay= with this command we tell REAVER every how many seconds we want it to resume the operation, since some networks block the WPS attack every so often.<br /><br />Finally I want to point out that there are more commands that can be used with REAVER, but no doubt with those named in this brief overview of the tool, it will be quite easy for us to recover (Crack) the password of our router.<br /><br />Source: highsec.es