If not success, change target to another access point. Make sure you got message Association successful. Run this command to fake BSSID authentication Let this terminal / konsole window opens, then we open another terminal / konsole window to fake BSSID authentication.Ħ. Parameter “-w the_result” shows the file name where we want to save captured data. Parameter “-c 3” shows that access point 99:88:77:66:55:44 is using channel 3. Open terminal / konsole and run this command: Here we choose yoyo access point as target.ĥ. PWR = signal strength, the lower the value the nearer the access point That 's all from me, hope this might be of help to someone who is trying to accomplish the same thing as I did but is not an expert in wifi security.The following are important columns you have to note:īSSID = target access point’s mac address Wireshark could also be used instead Kismet but didn't experiment with it. I t took me ~45 minutes to get enough IVs to crack my WEP key. On laptop2 I had FreeBSD and sniffed traffic with Kismet. Fact that we can join Kismet sessions really helps! For example I connected with laptop1 on my AP and started downloading a torrent, browsed a little bit too. On a network that has low or zero wireless traffic this is more or less useless but on a network that has a normal wireless activity (browsing, torrents and other stuff your neighbor might do) it's just a matter of time. Kismet basically replaces airodump-ng but do es not replace aireplay-ng, so we can't inject/attack and speed up the process of collecting IVs. I cracked my 64 bit WEP key today with ~13000 IVs. ( -n 64 tells aircrack-ng that it's a 64 bit WEP key, omit it if you don't know).Īircrack-ng will show how much IVs are collected for a certain SSID. After Kismet comes aircrack-ng, so start aircrack-ng and pass Kismet's pcapdump files (yes, we can pass multiple Kismet sessions, aircrack-ng will merge the results). Also you just need to log pcapdump files which contain raw packets. Kismet will save collected packets every X seconds, this can be set in Kismet's configuration file. Now start Kismet as root or with sudo and sniff (this could take a while). (my wireless card uses rum drivers but yours could use ath or something else depending what chipset your wireless card is based on, run ifconfig to find out).

# ifconfig wlan0 create wlandev rum0 wlanmode monitor If not already in monitor mode destroy current interface:

Logtemplate=/path/where/to/save/dumps/%p%n-%D-%t-%i.%līefore we start Kismet we need to put our card in MONITOR mode: Ncsource=wlan0:type=radiotap_bsd_ag,name=rum_usb

Crack wep password cmd