How long til a 4-way handshake is captured with Aireplay-ng

Question

I've got a TP-Link TL-WN722N wifi adapter which I believe allows monitoring/injection to a network (was reassured by the comments of other users). When I follow a guide by Vulnerableuser I can get to the stage where I am sending deauth packets to the target MAC Address via the AP, but I don't seem to see a a WPA Handshake.

My question is, How long should this deauth approach take to successfully receive the handshake? I understand that there isn't a fixed amount of time for this to occur, but what would this time be on average - a few hours, days, weeks!?

I can confirm that there are devices connected to the network being two desktops, one mobile, and one tablet (mobile and tablet being the ones connected via wifi). Since they are all using the same AP and WPA2 Key, this shouldn't have any effect on when a handshake should take place (can someone please confirm this?).

Any insight to this would be a great help.

score 2 · Accepted Answer · answered Feb 26 '16 at 19:39

2

Usually it takes only few seconds.however, if you're using the card on a virtual machine you might face problems.

I can confirm that the card works (i tried it myself). first time was with Backtrack-5 live boot CD and it worked perfectly, next time was on virtual Kali 2.0 and it didn't work. Just as you described it, the deauth packet goes and nothing happens.

answered Feb 26 '16 at 19:39

HSN

968
5
14

So would you recommend me using BT5 over Kali? – Luke Willmer Feb 26 '16 at 20:19
1

I would recommend live\resident OS over virtual one . – HSN Feb 26 '16 at 20:25
Well I am currently running the live version of Kali from the ISO as it's default user is root, saving me the effort of using sudo all the time. Would that be sufficient? But that is being ran via a virtual machine which may make it not work? – Luke Willmer Feb 26 '16 at 20:26
What version of Kali are you using ? There has been some reports about problems with wireless attacks on Kali 2.0 – HSN Feb 26 '16 at 20:38
https://forums.kali.org/showthread.php?26521-Wifite-not-capturing-WPA-handshake/page2 – HSN Feb 26 '16 at 20:41
http://security.stackexchange.com/questions/57261/no-handshake-from-airodump?rq=1 – HSN Feb 26 '16 at 20:41
Using lsb_release -a identifies my kali version as Rolling? – Luke Willmer Feb 26 '16 at 20:48
I guess it's Kali 2.0 then . Check the links i posed above. And try to preform the same attack from Kali 1.x – HSN Feb 26 '16 at 21:01
Okay, attempting them now. – Luke Willmer Feb 26 '16 at 21:02

score 1 · Answer 2 · answered Feb 26 '16 at 19:43

1

It depends on the number of users on the network. If there isn't anyone using the network you won't get any handshakes.

answered Feb 26 '16 at 19:43

d1str0

2,348
14
24

Well since its my home network I can confirm at least three devices connected to the router – Luke Willmer Feb 26 '16 at 20:19
Please clarify this in the original question. – d1str0 Feb 26 '16 at 20:20

score 1 · Answer 3 · answered Mar 04 '16 at 01:30

It will happen pretty quickly most of the time. Open a second terminal and try the de-authenticating client air replay line again and the second time it will work. Also the WPA handshake will show where you view the airodump-ng traffic . so make sure you're checking the right spot

score 0 · Answer 4 · answered Jul 19 '17 at 04:53

After running the command for deauthenticating a client, if you don't get a wpa handshake in a few seconds or a minutes, terminate the command by pressing ctrl+c. Wait for a few seconds and you should get a wpa handshake . You can see it written on right corner of airodump-ng screen. What happens is that when you continuously keep sending deauthentication packets to the client, sometimes it is not able get reconnect to the access point. So when you terminate the deauthentication command the client reconnects to the access point wpa handshake is a success. It is necessary that a client connects the access point after you have typed the "airodump-ng -c -w -b " command and hit enter, to get a wpa handshake. It might also happen that your luck is very good and a client connects to the access point after you have executed the above command. IF that is the case then you will automatically get a handshake without even deauhenticating an already connected client. Even if now you you are not getting a hand shake the you must check your wireless for injection capabilities.

How long til a 4-way handshake is captured with Aireplay-ng

4 Answers4