3

So I'm trying to hack my own WiFi using aircrack or reaver but have had no success with either. With aircrack I cannot achieve a successful handshake as the deauth doesn't seem to have any effect on my targeted devices. This is what it outputs:

root@kali:~# aireplay-ng -0 0 -a C0:05:C2:3B:8E:42 -c 98:9E:63:A1:E7:03 wlan0mon

20:21:49  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 8| 1 ACKs]

20:21:59  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [34| 0 ACKs]

20:21:59  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 3| 2 ACKs]

20:22:00  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [21| 5 ACKs]

20:22:10  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 9| 2 ACKs]

20:22:10  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

20:22:11  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [12| 0 ACKs]

20:22:20  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [11| 0 ACKs]

20:22:21  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

20:22:21  Sending 64 directed DeAuth. STMAC: [98:9E:63:A5:E7:03] [ 0| 0 ACKs]

In addition, with aircrack, sometimes when i try to use the deauth command it says:

20:24:09  Waiting for beacon frame (BSSID: C0:05:C2:3B:8E:42) on channel 6

20:24:09  wlan0mon is on channel 6, but the AP uses channel 1

However, normally I can just keep trying and the two channels will sync up. I don't know if this has any impact but on my airodump terminal, the first line of the table keeps changing the 'fixed channel' number. (The 9 keeps changing):

CH  1 ][ Elapsed: 7 mins ][ 2018-01-06 20:23 ][ fixed channel wlan0mon: 9

With Reaver, the command is executed and goes to check the first pin but it gets stuck and repeats this over and over again:

[+] Waiting for beacon from C0:05:C2:4B:7D:48

[+] Switching wlan0mon to channel 1

[+] Received beacon from C0:05:C2:4B:7D:48

[+] Vendor: AtherosC

[+] Trying pin "12345670"

[+] Associated with C0:05:C2:3B:8D:41 (ESSID: VM7781911)

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

[!] WARNING: Receive timeout occurred

[+] Sending EAPOL START request

Anyone know where I've gone wrong or how to fix these problems?

EDIT: When I enter my card into monitoring mode it outputs this:

PHY      Interface      Driver      Chipset

phy0     wlan0          iwlwifi     Intel corporation wireless 3165 (rev 79) 

                    (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0wlan0mon])
                    (mac80211 monitor mode vif disabled for [phy0]wlan0)

Is this okay?

Raghav Dinesh
  • 115
  • 4
Non0
  • 31
  • 1
  • 1
  • 6
  • Are you running `airodump` with the `-c` channel flag? If not, you should be. Otherwise, it will constantly hop channels, which is not what you want. – multithr3at3d Jan 07 '18 at 15:39
  • No, I’m not usually. Thanks for letting me know. Know anything about my other problems, though? – Non0 Jan 07 '18 at 22:17
  • See if that helps any of those issues – multithr3at3d Jan 07 '18 at 23:14
  • No chance, had no effect. Thanks for your help though – Non0 Jan 08 '18 at 17:04
  • When i enter my card into monitoring mode it outputs this: PHY Interface Driver Chipset phy0 wlan0 iwlwifi Intel corporation wireless 3165 (rev 79) (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0wlan0mon]) (mac80211 monitor mode vif disabled for [phy0]wlan0) Is this okay? – Non0 Jan 08 '18 at 17:20
  • It's also possibly that the AP itself does not work well with this attack; perhaps it has very strict rate limiting – multithr3at3d Jan 08 '18 at 17:27
  • The AP rate limiting affects aircrack cracking methods? I thought this just effected Reaver. Sorry if I’m being dumb... – Non0 Jan 08 '18 at 17:32
  • I'm referring to Reaver's PIN brute forcing. I do not see anything about using aircrack itself (only aireplay). You've got a couple different questions going on I guess. – multithr3at3d Jan 08 '18 at 18:29
  • yeah... lol. That's what i though you were referring to. Is my output to airmon okay? especially this bit: (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0wlan0mon]) (mac80211 monitor mode vif disabled for [phy0]wlan0). – Non0 Jan 08 '18 at 18:45

3 Answers3

1

You need to set an amount of packets to send, 0 is 0, send nothing, put more than 0 :D (deauth)

-0 22

root@kali:~# aireplay-ng -0 22 -a C0:05:C2:3B:8E:42 -c 98:9E:63:A1:E7:03 wlan0mon

[EDIT]

Also, run airmon-ng check kill before you start as said by G. T

Pixar Filmz
  • 11
  • 2
  • 1
    Isn’t 0 just infinite? I’ve tried using other amounts too but that didn’t help either... – Non0 Jan 09 '18 at 07:12
  • Could it be that my WiFi adapter doesn’t support this kind of stuff? – Non0 Jan 09 '18 at 07:13
  • Do you have errors ? – Pixar Filmz Jan 13 '18 at 00:36
  • `0 - infinite`, as stated by @Non0. Please check the sources, there's a statement that breaks the loop only if the "count" is "greater than 0": https://github.com/aircrack-ng/aircrack-ng/blob/master/src/aireplay-ng/aireplay-ng.c#L438 – Faither Jun 15 '22 at 18:45
1

I had the same problem it seems like the issue is on the bandwidth. Aircrack uses 2.4Ghz as default and the Access Point you are sending the packets may be communicating with 5Ghz. You need to change your bandwidth as same as the connection you want to interrupt.

From the page of airodump:

--band <abg>          : Band on which airodump-ng should hop

This has fixed the problem for me.

BoonMaboon
  • 11
  • 1
0

I had somewhat the same problem. I could deauth clients, but never got the handshake.

Before starting the first airodump-ng Run this command: airmon-ng check kill

This did the trick for me. Some processes were standing in the way for the handshake to be caught correctly.

Also, when you have done the first airodump-ng to find the Mac address. Stop that dump from running. Start a new one, one only the channel you need.

schroeder
  • 123,438
  • 55
  • 284
  • 319
G.T
  • 1
  • So I tried using deauthenticating clients from another laptop and it worked so I think my first laptop’s wireless adapter didn’t support packet injection. In addition neither laptop worked with Reaver so I guess my router is protected against it? – Non0 Jan 21 '18 at 12:07
  • Is there anything I can if my wireless adapter doesn’t support packet injection? I tested like suggested above and no, it does not support packet injection. – Non0 Jan 21 '18 at 14:32