-
Book Overview & Buying
-
Table Of Contents
BackTrack 5 Wireless Penetration Testing Beginner's Guide
By :
We will setup a WPA-PSK Honeypot with the ESSID Wireless Lab. The -z 2 option creates a WPA-PSK access point which uses TKIP:

Let's also start airodump-ng to capture packets from this network:

Now when our roaming client connects to this access point, it starts the handshake but fails to complete it after Message 2 as discussed previously:

But airodump-ng reports that the handshake has been captured:

We run the airodump-ng capture file through aircrack-ng with the same dictionary file as before, eventually the passphrase is cracked as shown next:

We were able to crack the WPA key with just the client. This was possible because even with just the first two packets, we have all the information required to launch a dictionary attack on the handshake.
We would recommend setting different WEP keys on the client and trying this exercise a couple of times to gain confidence. You may notice many times that...
Change the font size
Change margin width
Change background colour