Showing posts with label HOW TO. Show all posts
Showing posts with label HOW TO. Show all posts

Monday, July 13, 2015

EASY STEP BY STEP HOW TO TUTORIALS TO PIMP OUT YOUR BLOG PAGE! GOOGLE EXTENDED THE BLOGGER HTML LANGUAGE LEARN THE SIMPLE LIBRARY TAGS CLASS RULE SET AND UPGRADE YOUR PAGE TODAY IN IUNDER AN HR- 7/12/ 2015 CUSTOMIZE BLOG DESIGN HEADERS TO FOOTER MAKE OVER

Blogger Page HTML Tutorial

 To Introduces Additions To  Blogger Template Language. All New Terms & Expressions Defined Then Reviewed. 10 Code Examples Of HTML Edits  To Pimp Out Blog Page/Post These Example Can Be Used As A Building Block or A Hands On Practice Guide For Inexperienced. 
Reading The Entire Blog Is Recommended In Order To Become Familiar and Gain A Full Understanding, Of The Primary Expressions HTML Language and Terminology To Even Begin. 



 Short Explanation of Reason Behind Blogger Library Adjustments or Should I say Improvements :

Recently HTML5 Canvas And Javascript Have Started To Explode On The Flash Ghost Town OF The Web, Beyond That HTML5 Baby Bro HTML Is A Stone Cold Pimp That Will Introduced  You To a new set of expressions to the Blogger template language, The Purpose Of The Revamped Library Is To Share A Pimpishly Awesome Blog Page. The Entire Extension And New Implementation of Functionality Added Was Designed to let you customize the HTML of EVERY POST/PAGE On Your BLOG!!! YAY :)  So Without Further Or Due Let The Introduction Of The New Google Blogger HTML Library Enhancements BEGIN. 


Lets Begin With 2 Simple Guidelines of Basic Principles and Overall Structure  For Any Language.


As with any language, you begin by defining your global variables. Then you create a setup() function, where you control the visualization's properties, like the canvas size, frame rate and perhaps variables such as the stoke-weight or background-color.

The next step is to create your draw() function, which controls the behavior of each frame in your animation. The draw function loops continuously unless you tell it otherwise by using the exit() command.

Awesome They Added These Terms To Assist In The Creation Of Global Variables. The Improvements Make It Possible To Compare Values  Instance Variables As Well. Bravo!  




  •     b:elseif for a simpler multiple-case b:if branch.
  •     b:switch and b:case for succinctly handling several possible cases of a variable.
  •     b:eval for evaluation of more complex expressions involving data variables.
  •     b:with for creating a nicer variable alias for a calculated value.




Lets Continue With More Great Advancements in 
These Expressions Now Allow Flexible Creation of Highly Complex Variables: Great Additions 


  • Includes (b:include)
  • Data Output (data:)
  • Loops (b:loop)
  • If, elseif & else (b:if)
  • Switches (b:switch)
  • Attribute expressions (expr:)
  • Evaluated Expressions (b:eval)
  • Variable alias (b:with)
  • See an example


Expressions in layouts tags


When you're using the layouts template to create the body section of your blog, you can change the HTML that gets rendered by using expressions.
Types of Operators

  • Pimping Your Blog Page Out: Pimpin Is Easy or Is The Aint Easy Whatever HTML is Pimp 
  • This section describes the operators you can use inside an expression on a Widget tag for Layouts.
  • Equivalence
  • And
  • Or
  • Not
  • Ternary Selector (?:)
  • Membership


Page Elements Tags for Layouts


 The <body> section of a Layouts template is made up primarily of sections and widgets. Sections mark out areas of your page, such as the sidebar, footer, etc. A 

 widget is an individual page element such as a picture, a blogroll, or anything else you can add from the Page Elements tab. You can include any HTML you like 

 around the sections in your template.

 Each section in your template has an opening and a closing tag, looking something like this:

<b:section id='header' class='header' maxwidgets="1" showaddelement="no">
</b:section>
A <b:section> tag can have the following attributes:

     id - (Required) A unique name, with letters and numbers only.
    class - (Optional) Common class names are 'navbar,' 'header,' 'main,' 'sidebar,' and 'footer.' If you switch templates later, these names help Blogger determine 

 how best to transfer over your content. However, you can use different names, if you like.
    maxwidgets - (Optional) The maximum number of widgets to allow in this section. If you don't specify a limit, there won't be one.
    showaddelement - (Optional) Can be 'yes' or 'no,' with 'yes' as the default. This determines whether the Page Elements tab will show the 'Add a Page Element' 

 link in this section.
    growth - (Optional) Can be 'horizontal' or 'vertical,' with 'vertical' as the default. This determines whether widgets within this section are arranged side-by-side 

or stacked.

 A section can contain widgets; it can't contain other sections or other code. If you need to insert extra code between or around certain widgets within a section, 

 you'll need to split the section into two or more new sections.

 In its simplest form, a widget is represented by a single tag, which is basically just a placeholder indicating how the widget should be handled in the Page 

 Elements tab. The actual data for any given widget is stored in the Blogger database and only accessed when the widget needs to be displayed. Some examples of widgets (one for a page header and one for a list) are:

<b:widget id="header" type='HeaderView' locked="yes"/>
<b:widget id="myList" type='ListView' locked="no" title="My Favorite Things"/>
<b:widget id=”BlogArchive1” locked=”false” mobile=”yes” title=”Blog Archive” type=”BlogArchive”/>

A widget may have the following attributes:


    id - (Required) May contain letters and numbers only, and each widget ID in your template should be unique. A widget's ID cannot be changed without deleting 

 the widget and creating a new one.
    type - (Required) Indicates what kind of a widget it is, and should be one of the valid widget types listed below.
    locked - (Optional) Can be 'yes' or 'no,' with 'no' as the default. A locked widget cannot be moved or deleted from the Page Elements tab.
    title - (Optional) A display title for the widget. If none is specified, a default title such as 'List1' will be used.
    pageType - (Optional) Can be 'all,' 'archive,' 'main,' or 'item,' with 'all' as the default. The widget will display only on the designated pages of your blog. (All 

 widgets display on the Page Elements tab, regardless of thier pageType.)
    mobile - (Optional) Can be 'yes', 'no,' or ‘only’ with 'default' as the default. This decides if the widget will be displayed on mobile or not. Only Header, Blog, 

 Profile, PageList, AdSense, Attribution will be displayed on mobile when the mobile attribute is 'default.'

The types of widgets you can specify are:


  •     BlogArchive
  •     Blog
  •     Feed
  •     Header
  •     HTML
  •     SingleImage
  •     LinkList
  •     List
  •     Logo
  •     BlogProfile
  •     Navbar
  •     VideoBar
  •     NewsBar

 Each widget can also be written out in an expanded form, detailing the complete layout and contents for that widget. This is what you'll see, for instance, if you 

 download your template from the Edit HTML tab to make a backup. Usually, you won't need to work with widgets in this mode, since it's simpler to just modify 

 them from the Page Elements tab. However, if you want to know more, you can read about the detailed widget tags.

 Note: In your published blog, all <b:section> and <b:widget> tags will be replaced with <div> tags, which will have the specified ID. So, you're welcome to refer to, 

 for example, div#header or div#myList in your CSS if you want to.



Fonts and Colors Tags for Layouts

If you know HTML or CSS, you're welcome to modify the fonts and colors in your template any way you like. However, if you want them to work with the Fonts and 
Colors feature of Blogger Layouts, then there are a few guidelines to follow. Doing it this way will let you modify the colors more easily if you change your mind 

 later. It also helps if you share your template with someone else who wants to customize their version a bit.

 In the <head> section of your code, you'll need to have a pair of <b:skin> </b:skin> tags. The CSS style declarations will go in between those tags, along with the 

 variable names that make your design work with the Fonts and Colors page. Here's a brief example of how it looks, before we get into the details:

<head>
...
<b:skin>
  <style type='text/css'>
  /*
   * Variable definitions:
   *  <Variable name='bgcolor' description='Page Background Color'
       type='color' default='#fff'/>
   */
  body {
    background: $bgcolor;
    margin: 0;
    padding: 40px 20px;
  }
  </style>
</b:skin>
</head>

The first part of the CSS code is enclosed in /* and */ comment tags, so it won't be shown on your blog, but only used by Blogger internally. There will be a list of 

 variables here, one for each font or color that you want to be editable from the Fonts and Colors tab. Each variable is required to have the information shown in 

 the example above and described here:

     name - This name may contain only letters or numbers, and each name in your template must be unique.
    description - This can be a more descriptive name, and can include spaces. This is what will appear in the Fonts and Colors tab.
    type - This can be either "font" or "color".
    default - The default value. For colors, this should be a hexadecimal color code, e.g. #FF0066. For fonts, it will be a list of the form font-style font-weight font-

 size font-family.

 After the variables are set up, the rest of the code looks like regular CSS, with one exception. Any time you want to use a color or font for which you made a 

 variable, you'll enter $variable_name instead of the actual color or font. In the example above, you can see that we created a variable called bgcolor and set it to 

 white (#fff). Then later on in the code, instead of setting the body background property to white explictly, we just said background: $bgcolor. This still has the 

 effect of making the background white, with the difference that we can change it easily from the Fonts and Colors tab if we want to.

 As you work on your template design, you'll add lots of variables for all the different fonts and colors you want to control. You do not, however, need to create 

 variables for other types of CSS attributes. These can be included in the CSS just as they normally would be (as with the margin: and padding: attributes in the 

example above).

 Note: If you need to brush up on your CSS, you can start here.




Widget Tags for Layouts

This section describes the HTML you can use inside of the closing tags.

Includes (b:include)When to use includes

When you're using the Layouts template to create the body section of your blog, you can use widgets to add page elements like pictures and a blogroll.
Types of tags

Includes are most useful if you have a section of code that you want to re-use in several different places, or only include in certain circumstances.

 To do this, write the content inside a b:includable, then use b:include wherever you want it to appear.
Format

<b:includable id='main' var='thiswidget'>
  [insert whatever content you want here]
</b:includable>
Attributes

     id (required): A unique identifier made up of letters and numbers. Each widget must have one includable with id='main'.
    var (optional) An identifier made up of letters and numbers, for referencing data within this section.

 If you make more includables with different IDs, they won't be displayed automatically. However, if you make an includable with id='new', then you can reference it 

 in your main includable with <b:include name='new' /> and it will display that way.

 The attributes for the b:include tag are as follows:

     name (required): An identifier made up of letters and numbers. It must match the ID of an existing b:includable in the same widget.
    data (optional): An expression or piece of data to pass on to the includable section. This will become the value of the var attribute in the includable.
    cond (optional) An expression which causes the include to only execute when its result is true. This is the same as the cond attribute on a b:if.

 Example

 Here's an example that shows how to use b:includable and b:include.

 The main thing to understand here is how the "main" section includes the "post" section within it. It passes along a post that it calls "p" and the included section 

 references it as its var "post", then prints the title.

 Note that the include only runs while the index is less than 10, so only a max of 10 posts would get rendered in this example (the index starts at 0).

<b:includable id='main'>
  <b:loop var='p' index='index' values='posts'>
    <b:include name='post' data='p' cond='index < 10'/>
  </b:loop>
</b:includable>
<b:includable id='post' var='post'>
  Title: <data:post.title/>
</b:includable>


Data Output (data:)
Examples
    <data:title/> would print out the title of a widget
    <data:photo.url/> - Size: <data.photo.width /> x <data.photo.height /> would print attributes of a photo component. A photo may have components such as url, 


height, and width. Using the "." notation indicates that we want the URL for this photo, rather than a URL from something else.

See more examplesSee our complete list of the layouts data tags that are supported.
Loops (b:loop)
When to use b:loop

 The b:loop tag lets you repeat a section of content multiple times. This is most commonly used for printing out each post in a list of posts for a given page, or 

 each comment, or each label, etc.
Format

The general format for using loops is this:


<b:loop var='identifier' values='set-of-data'>
  [repeated content goes here]
</b:loop>

 The 'identifier' (i) part can be any name you choose, and will be used to stand in for each new item in the list, each time through the loop. The set of data you 

 specify for the values can be any piece of data described in the data tags article as being a list of items.

 For example, in the blog posts widget, posts is a list. Code like the following will loop through each post, printing out the title for each one, with header tags 

 around it.



<b:loop var='i' values='data:posts'>
  <h2><data:i.title/></h2>
</b:loop>



 Notice how "i" takes on the value of each post in turn, so you can get the title from each one.
Number Range

A loop tag allows you to iterate across an inclusive number range, such as ‘1 to 3', ‘-3 to -9', where the value of the variable takes the number's value. The 

following example would create an unordered list of 1, 2 and 3.




<b:loop var='i' values='1 to 3'>
  <li><data:i /></li>
</b:loop>

Index Attribute
Loop tags also have an optional index attribute, which gives the zero-based index of the current iteration through the loop.

  <b:loop var='number' index='index' values='9 to 7'>
    <li>Index: <data:index />, Number: <data:number /></li>
  </b:loop>
</ul>
<ul>

 
This example would create an unordered list of:


    Index: 0, Number: 9
    Index: 1, Number: 8
    Index: 2, Number: 7
If, elseif & else (b:if)
When to use if, elseif, or else

You can use the b:if, b:elseif and b:else tags to display certain content in particular cases, and other content in other cases. For example, you might only want to 
show certain text on the homepage, but different text when looking at individual posts.Format
 

<b:if cond='condition'>
  [content to display if condition is true]
<b:elseif cond='another condition'>
  [content to display if no previous if or elseif conditions have been true, and this elseif condition is true]
<b:else/>
  [content to display if no if or elseif conditions are met]
</b:if>

 
The b:elseif and b:else tags are optional. Without them, the result will be either the content listed in the b:if section or nothing. The closing </b:if> is required in 
each case, however.
For "condition" you can put in anything that evaluates to either true or false. Some data tags are simply true/false values on their own, e.g. allowComments on a 
post. With other pieces of data, you can compare them with specific values to get a true or false. Here are some examples:

    <b:if cond='data:post.showBacklinks'>
    True if the current post is set to show backlinks.
    <b:if cond='data:blog.pageType == "item"'>
    True if the current page is an item page (post page).
    <b:if cond='data:blog.pageType == "item" and data:post.showBacklinks'>
    True if the current page is an item page (post page) and the current post is set to show backlinks.
    <b:if cond='data:displayname != "Fred"'>
    True if this is not Fred's display name.
    <b:if cond='data:displayname == "Fred" or data:blog.pageType == "static_page"'>
    True if Fred is the display name, or the current page is a static page (not a post page).
    <b:if cond='data:post.numComments > 1'>
    True if the current post has more than one comment.
    <b:if cond='data:blog.pageType in {"static_page", "item"}'> OR <b:if cond='{"static_page", "item"} contains data:blog.pageType'>
    True if the current page is a specific post, or a page.
Switches (b:switch)
When to use a Switch

You can use b:switch tag much like you would use a b:if tag that has several b:elseif tags. The advantage of a switch branch is that you don’t need to repeat the 

variable name. You can easily read them to see what defines each case, and what the default case is.
Format


<b:switch var=’[Data expression]’>
<b:case value=”[Value 1]” />
 [Output if evaluation of var is equal to Value 1]
<b:case value=”[Value 2]” />
 [Output if evaluation of var is equal to Value 2]
[… any other values]
<b:default />
 [Output if evaluation of var is not equal to any other stated b:case]
</b:switch>
Example


This example shows how to output a different header, depending on what type of page is being rendered.


<b:switch var=’data:blog.pageType’>
<b:case value=”static_page” />
  <h1>Page</h1>
<b:case value=”item” />
  <h1>Post</h1>
<b:default />
  <h2>Blog Posts</h2>
</b:switch>
Attribute expressions (expr:)
When to use Expressions


You can use the expr attribute to set attribute values based on values in the data dictionary. 

Examples:

    <a expr:href='data:blog.homepageUrl'>Home</a>
    A home link with the blog's homepage url.
    <a expr:href='data:blog.homepageUrl + "feeds/posts/default"'>Posts RSS</a>
    A link with the blog's post RSS feed url. The ‘+' operator concatenates the two strings.
    <a expr:class='data:post.allowComments ? "comment" : "no-comment">Comment</a>
    A link with the class "comment" when comments are allowed, and "no-comment" when they are not. The ternary operator (?:) takes the given boolean value and picks the first value (after the ?) if the boolean is true, or the second value (after the :) if the boolean is false.
Evaluated Expressions (b:eval)
When to use an Evaluated Expression
You can use b:eval tag to evaluate a more complicated expression than a standard data tag.
Format
<b:eval expr='[Expression]' />
Examples
    min-height: <b:eval expr="data:newWidth * data:height / data:width" />px;
    Output a calculated relative height, based on a new width value.
    <b:eval expr=”data:post.labels[0].url” />
    Output the url of the first post label.
    <b:eval expr='data:post.allowComments ? "Comment" : "Comments Disabled" />
    Output “Comment” when comments are allowed, and “Comments Disabled” when they are not. Note that this expression makes use of the ternary operator. 

See the Expressions in layouts tags article.

Variable alias (b:with)
When to use a variable alias

You can use b:with tag to temporarily store the value of a computed expression and avoid complicated inline expressions.
Format

<b:with var='myComputedValue' value=’[Data expression]’ />
Examples

For a complicated style attribute based on data variables, you can compute it before the rest of the HTML output, so that the nested HTML is easier to read.
<b:with var='style'
       value='”background-image: url(\”” + data:sourceUrl “\”); “
           + “ width: “ + data:width + “px; “ '>
 <div id=’header-outer’>
   <div id=’header-inner’ expr:style=’data:style’>
     <h1>My Header</h1>
   </div>
 </div>
</b:with>

 Note that the variable will only exist for the child nodes of the b:with tag.

Check Out This HTML Page List Widget An Excellent Example: HTML Code Written Below


In this widget, you can see example usages of the b:widget, b:includable (and b:include), b:if (and b:else), and b:loop tags.



 <b:widget id='PageList1' locked='false' title='Pages' type='PageList'>
  <b:includable id='main'>
    <b:if cond='data:title != ""'>
      <h2><data:title/></h2>
    </b:if>
    <div class='widget-content'>
      <b:if cond='data:mobile'>
        <select expr:id='data:widget.instanceId + "_select"'>
        <b:loop values='data:links' var='link'>
          <b:if cond='data:link.isCurrentPage'>
            <option expr:value='data:link.href' selected='selected'><data:link.title/></option>
          <b:else/>
            <option expr:value='data:link.href'><data:link.title/></option> 
          </b:if>
        </b:loop>
        </select>
        <span class='pagelist-arrow'>&amp;#9660;</span>
      <b:else/>
        <ul>
        <b:loop values='data:links' var='link'>
          <b:if cond='data:link.isCurrentPage'>
            <li class='selected'>
              <a expr:href='data:link.href'><data:link.title/></a>
            </li>
          <b:else/>
            <li>
              <a expr:href='data:link.href'><data:link.title/></a>
            </li>
          </b:if>
        </b:loop>
        </ul>
      </b:if>
      <b:include name='quickedit'/>
    </div>
  </b:includable>
</b:widget>

Coded by Jay Stilla at 4 comments:
Labels: , , , , , , , , , , , , , , , , , , ,
Masked Location: Cupertino, CA, USA

Sunday, January 4, 2015

INSTRUCTIONS: CRACK A Wifi WPA/WPA2 PASS CODE VIA IN KALI LINUX 99.9% SUCCESS RATE

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux C#

Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty– with cuda or calpp in Kali Linux


There are just too many guides on Cracking Wifi WPA/WPA2 passwords using different methods. Everyone has their own take on it. Personally, I think there’s no right or wrong way of cracking a Wireless Access Point. Following way is my way and I found it extremely efficient and fast during my tests for Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux where I attacked with Dictionary using either cuda or calpp (cal++) and at the same time I used WiFite to fast track a few things. This whole process was used in Kali Linux and it took me less than 10 minutes to crack a Wifi WPA/WPA2 password using pyrit cowpatty WiFite combination using my laptop running a AMD ATI 7500HD Graphics card.

Contents [hide]


You can make the following process faster like I did. If you have an AMD ATI Graphics card you’ll have to follow these guides below:

    Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty– with cuda or calpp in Kali Linux
  •         NVIDIA Users:
  •         AMD Users:
  •     Capture handshake with WiFite
  •     Create ESSID in Pyrit Database
  •     Import Dictionary in Pyrit
  •     Create tables in Pyrit using batch process
  •     Cracking Process
  •         Attack a handshake with PMKs from the db using Pyrit
  •         Attack a handshake with passwords from a file or Dictionary using Pyrit
  •         Crack using Cowpatty
  •         Export to cowpatty
  •         Let it rip: Crack WPA WPA2 PSK password using cowpatty
  •         Attack a handshake with PMKs from a cowpatty-file using Pyrit
  •     Cleanup Pyrit and database
  •     Conclusion
  •         Cracking Wifi WPA/WPA2 passwords
  •     Related

  • NVIDIA Users:
  •     Install proprietary NVIDIA driver on Kali Linux – NVIDIA Accelerated Linux Graphics Driver
  •     Install NVIDIA driver kernel Module CUDA and Pyrit on Kali Linux – CUDA, Pyrit and Cpyrit-cuda
  •  
  • AMD Users:
  •     Install AMD ATI proprietary fglrx driver in Kali Linux 1.0.6
  •     Install AMD APP SDK in Kali Linux
  •     Install Pyrit in Kali Linux
  •     Install CAL++ in Kali Linux























Readers, those who would like to try alternate ways of cracking Wifi WPA WPA2 passwords, use HashCat or cudaHashcat or oclHashcat to crack your unknown Wifi WPA WPA2 passwords. The benefit of using Hashcat is, you can create your own rule to match a pattern and do a Brute-force attack. This is an alternative to using dictionary attack where dictionary can contain only certain amount of words but a brute-force attack will allow you to test every possible combinations of given charsets. Hashcat can crack Wifi WPA/WPA2 passwords and you can also use it to crack MD5, phpBB, MySQL and SHA1 passwords. Using Hashcat is an good option as if you can guess 1 or 2 characters in a password, it only takes few minutes. For example: if you know 3 characters in a password, it takes 12 minutes to crack it. If you know 4 characters in a password, it takes 3 minutes. You can make rules to only try letters and numbers to crack a completely unknown password if you know a certain Router’s default password contains only those. Possibilities of cracking is a lot higher in this way.

Important Note: Many users try to capture with network cards that are not supported. You should purchase a card that supports Kali Linux including injection and monitor mode etc. A list can be found in 802.11 Recommended USB Wireless Cards for Kali Linux. It is very important that you have a supported card, otherwise you’ll be just wasting time and effort on something that just won’t do the job.


Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because it’s faster and we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

1-Wifite-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screenshot below:

2-Wifite-Screen-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops





Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

3-WiFite-Choice-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WIfite. It now asks me,

What do you want to do?

    ontinue attacking targets
    [e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

4-WiFite-continue-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

5-WiFite-captured-handshake-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Now that we have a capture file with handshake on it, we can do a few things:

    We can Dictionary attack it.
    We can BruteForce attack it.
        Amongst BruteForce, we can use crunch
        We can use oclhashcat.

In this guide, I will show Dictionary attack as almost 20% (that’s 1 in every 5) AP’s will have a standard dictionary password. In later chapters of this guide, I will show Brute Forcing.



Dictionary attack .cap capture file to crack Wifi password

To do a Dictionary attack, we need to grab a dictionary file.

Kali Linux provides some dictionary files as part of its standard installation. How sweet. Thanks Kali Linux Dev team.

Let’s copy one of best dictionary file to root directory.

cp /usr/share/wordlists/rockyou.txt.gz .

Unzip it.

gunzip rockyou.txt.gz

Because WPA2 minimum password requirement is 8 characters, let’s parse this file to filter out any passwords that is less than 8 characters and more than 63 characters. (well, you could just leave this line, but it is completely up to you). So we are saving this file as newrockyou.txt name.

cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

Let’s see how many passwords this file contains:

wc -l newrockyou.txt

That’s a whopping 9606665 passwords.

Original file contained even more..

wc -l rockyou.txt

That’s 14344392 passwords. So we made this file shorter which means we can test more AP’s in less time.

Finally, lets rename this file to wpa.lst.

mv newrockyou.txt wpa.lst



6-Get-dictionary-File-and-cleaning-it-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create ESSID in Pyrit Database

Now we need to create ESSID in Pyrit Database.

pyrit –e BigPond create_essid

NOTE: If you have an AP that’s got Space it in, example: “NetComm Wireless” then your command will become like this:

pyrit -e 'NetComm Wireless' create_essid

I know a lot of the people struggles with this issue :)



7-pyrit-create-essid-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Awesome, now we have our ESSID added to Pyrit Database.


Import Dictionary in Pyrit

Now that we have our ESSID added to Pyrit database, lets go an import our Password Dictionary.

Use the following command to import previously created password dictionary wpa.lst to Pyrit Database.

pyrit -i /root/cudacapture/wpa.lst import_passwords

8-pyrit-import-dictionary-password-file-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create tables in Pyrit using batch process

We now need to batch process to create tables.

This is simple, just issue the following command

pyrit batch





9-pyrit-create-tables-using-batch-process-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Because I’m on a laptop with a crappy AMD 7500 graphics card, I’m getting only 15019 PMKs per second (that includes my CAL++). If you got a more powerful Graphics card and managed to install either CUDA for NVIDIA Graphics card or CAL++ for AMD Cards, your speed will be a lot more.

Oh, and I just took this awesome screenshot while Pyrit was doing the batch processing. Check out my CPU usage, it’s hitting absolutely 100%.

10-pyrit-100-percent-CPU-usage-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Also check out my temperature of my cores:

11-pyrit-high-CPU-Temperature-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



You should be careful how big your dictionary file is and how HOT your CPU and Graphics card is burning. Use extra cooling if you can to avoid damage.


Cracking Process

We can crack using few different process.

    Using Pyrit
    Using Cowpatty


Attack a handshake with PMKs from the db using Pyrit

Simple. Just use the following command to start the cracking process.

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap attack_db





21-pyrit-attack_db-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



That’s it. It will take few minutes to go through the whole Database Table to get the password if it existed in the Dictionary. As you can see, 159159186.00 PMK's per second was the speed and it took less than 1 second to crack it. This is by far the fastest. I also had to blank out much of the screenshot.

Note: I tried it from a different workstation with a NVIDIA GTX460 Graphics card with CUDA and Cpyrit-CUDA installed. Obviously, this was much faster than my Laptop. But either way, this is super fast.


Attack a handshake with passwords from a file or Dictionary using Pyrit

If you don’t want to create Datbase and crunch through Dictionary file directly (much slower), following is what you can do:

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/wpa.lst attack_passthrough

Speed this way? 7807 PMKs per second. Much slower for my taste.


Crack using Cowpatty

To crack using cowpatty, you need to export in cowpatty format and then start the cracking process.


Export to cowpatty

I hope up to this point, everything went as planned and worked out. From Pyrit, we can push our output to either cowpatty or airolib-ng. All my tests shows that cowpatty is a lot more faster, so I’ll stick with that.

So let’s make our cowpatty file. This is again simple, issue the following command to export your output to cowpatty.

pyrit -e BigPond -o cow.out export_cowpatty



12-pyrit-export-to-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Let it rip: Crack WPA WPA2 PSK password using cowpatty

Now that we have our cowpatty output, let’s try to crack WPA2/PSK passphrase. Issue the following command to start the cracking process.

cowpatty -d cow.out -s BigPond -r hs/BigPond_58-98-35-E9-2B-8D.cap





13-crack-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

Once you type it in, you’ll a bunch of passwords being tried against your hash file. This will keep going until the end of the file. Once a matching password is found in the dictionary file, the cracking process will stop with an output containing the password.

14-cracked-it-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

And bingo, it found a matching password. Look at the number of passwords tried in a secods

164823.00 passphrases/second.

NOTE: cowpatty will fail if your password/dictionary file is larger than 2GB. You’ll have to stick to airolib-ng even though that’s slower.


Attack a handshake with PMKs from a cowpatty-file using Pyrit

Here’s another way using Pyrit…

You can use cow.out file in Pyrit next time

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/cow.out attack_cowpatty

Speed this way? 31683811 PMKs per second. Much slower than using Pyrit attack_db process. But at least you don’t have to batch process this way.


Cleanup Pyrit and database

Lastly, if you feel like, you can delete your essid and cleanup.

pyrit BigPond delete_essid



15-cleanup-pyrit-and-database-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Conclusion

Thanks for reading. This process is not always possible and sometimes cracking Wifi WPA/WPA2 passwords using Reaver-WPS is much easier. You might want to check that too.
Cracking Wifi WPA/WPA2 passwords

    Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty
    Cracking Wireless WPA2 WPA passwords with Hashcat
    Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

If this guide helped you to achieve what you wanted, please share this article with friends.

Update: 13/03/2014: I just realized I forgot to credit purehate for his ORIGINAL post in BackTrack forum. Without his guide, much of this wouldn’t be possible.

Follow us on Facebook/Twitter.

Last but not the least, I’ll cover up my back …

    Disclaimer: This guide is for training and educational purposes only. Ensure you have permission before you attack an access point as it is a felony in many countries. I take no responsibility of the usage of these instructions containing in this guide.

Related
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)

In "Cracking"
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

In "Cracking"
802.11 Recommended USB Wireless Cards for Kali Linux
802.11 Recommended USB Wireless Cards for Kali Linux

In "Kali Linux"
About blackMORE Ops

blackMORE Ops is dedicated to How to, Guides, Security features and Tips and Tricks for Linux OS. Thank you for visiting us and follow us here www.blackmoreops.com.
View all posts by blackMORE Ops →
Leave a Reply
18 thoughts on “Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux”

    Reply ↓
    ali October 30, 2014 at 9:36 pm

    nice thanks bro

    Pingback: No internet for me! - blackMORE Ops
    Reply ↓
    b rass November 26, 2014 at 5:18 am

    This is a newbie question, but here goes: if I have two different handshakes from two different ESSID that I want to crack, do I have to run the batch process twice?
        Reply ↓
        D-Maub December 15, 2014 at 3:12 pm

        No assuming that you are using the same password file you uploaded
        Reply ↓
        D-Mub December 16, 2014 at 7:02 am

        Sorry after further research, Yes you would need to use the batch process twice. This is because the ESSID acts as a salt to the hashes.

    Pingback: Hacking Wifi The Easiest WayUsing Wifite In Kali Linux

    Pingback: A detailed guide on installing Kali Linux on VirtualBox - blackMORE Ops

    Pingback: Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords) - blackMORE Ops

    Pingback: Cracking Wifi WPA/WPA2 passwords using Reaver-WPS - blackMORE Ops
    Reply ↓
    xyxyxyxyxy@gmail.com December 11, 2014 at 3:46 am

    hey if u have time please add a tread how to start from Rasberry p ..i want to start with Kali Linux and i don`t know anything have to learn commands and all ill b very thankful if you could do this i come from windows and Kali seems much greater ..i`ll come baq here soon :) mayb u can drop a link if u have time for that thank u for all what u doin to share your knowledge
    Reply ↓
    Melvin December 12, 2014 at 4:44 pm

    Hi, how about cleanup the passwords in Pyrit?
    Reply ↓
    gilbert enriquez December 12, 2014 at 11:53 pm

    I have a .cap file,can you crack it?
        Reply ↓
        Melvin December 17, 2014 at 2:17 pm

        I can.
    Reply ↓
    KaliHacker2014 December 15, 2014 at 3:22 pm

    Thank-you, very helpful ;)
    Reply ↓
    Melvin December 17, 2014 at 2:15 pm

    Hi, I think need to add -e option for pyrit BigPond delete_essid

    Pingback: 802.11 Recommended USB Wireless Cards for Kali Linux - blackMORE Ops
    Reply ↓
    edcion January 3, 2015 at 11:42 am

    you blanked the essid of all your screenshots expect “check out the temp of my cores”
    Reply ↓
    kl January 3, 2015 at 5:02 pm

    You state that when using attack_cowpatty we don’t have to batch process. But when I try to do that i get an error, “0 entries written. All done’

    Even if attack_db is much faster, it doesn’t matter because creating the database takes so long. do you only create the db once per wordlist? because otherwise the speed from attack_db or attack_cowpatty doesn’t matter, all that matters is the speed of creating the database, which for me was about 8000/s

    Am I doing something wrong? I don’t understand why you wouldn’t just recommend the attack_cowpatty method if you really can do it w/o creating a batch process to create tables. because of course someone would rather do that at 31 million keys per second than the 15 thousand keys per second you got creating tables.

Post navigation

    ← Install AMD ATI proprietary fglrx driver in Kali Linux 1.0.6
    Step failed: Installing the system or Installing step failed : Install the system at 80% or The failing step is install the system error on Kali Linux →

Google Site Search


   
   
Recent Posts

    Determine if a disk is SSD or HDD
    darodar.com referrer spam and should you be worried?
    Random quotes and creatures using fortune and cowsay in Linux terminal
    Fixing error: Package packagename is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source E: Package ‘packagename’ has no installation candidate

Recent Comments

    kl on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    edcion on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on How to install Pyrit in Kali Linux?
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on Install AMD ATI proprietary driver (fglrx) in Kali Linux 1.0.6 running Kernel version 3.12.6

Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because it’s faster and we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

1-Wifite-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screenshot below:

2-Wifite-Screen-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops





Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

3-WiFite-Choice-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WIfite. It now asks me,

What do you want to do?

    ontinue attacking targets
    [e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

4-WiFite-continue-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

5-WiFite-captured-handshake-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Now that we have a capture file with handshake on it, we can do a few things:

    We can Dictionary attack it.
    We can BruteForce attack it.
        Amongst BruteForce, we can use crunch
        We can use oclhashcat.

In this guide, I will show Dictionary attack as almost 20% (that’s 1 in every 5) AP’s will have a standard dictionary password. In later chapters of this guide, I will show Brute Forcing.



Dictionary attack .cap capture file to crack Wifi password

To do a Dictionary attack, we need to grab a dictionary file.

Kali Linux provides some dictionary files as part of its standard installation. How sweet. Thanks Kali Linux Dev team.

Let’s copy one of best dictionary file to root directory.

cp /usr/share/wordlists/rockyou.txt.gz .

Unzip it.

gunzip rockyou.txt.gz

Because WPA2 minimum password requirement is 8 characters, let’s parse this file to filter out any passwords that is less than 8 characters and more than 63 characters. (well, you could just leave this line, but it is completely up to you). So we are saving this file as newrockyou.txt name.

cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

Let’s see how many passwords this file contains:

wc -l newrockyou.txt

That’s a whopping 9606665 passwords.

Original file contained even more..

wc -l rockyou.txt

That’s 14344392 passwords. So we made this file shorter which means we can test more AP’s in less time.

Finally, lets rename this file to wpa.lst.

mv newrockyou.txt wpa.lst



6-Get-dictionary-File-and-cleaning-it-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create ESSID in Pyrit Database

Now we need to create ESSID in Pyrit Database.

pyrit –e BigPond create_essid

NOTE: If you have an AP that’s got Space it in, example: “NetComm Wireless” then your command will become like this:

pyrit -e 'NetComm Wireless' create_essid

I know a lot of the people struggles with this issue :)



7-pyrit-create-essid-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Awesome, now we have our ESSID added to Pyrit Database.


Import Dictionary in Pyrit

Now that we have our ESSID added to Pyrit database, lets go an import our Password Dictionary.

Use the following command to import previously created password dictionary wpa.lst to Pyrit Database.

pyrit -i /root/cudacapture/wpa.lst import_passwords

8-pyrit-import-dictionary-password-file-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create tables in Pyrit using batch process

We now need to batch process to create tables.

This is simple, just issue the following command

pyrit batch





9-pyrit-create-tables-using-batch-process-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Because I’m on a laptop with a crappy AMD 7500 graphics card, I’m getting only 15019 PMKs per second (that includes my CAL++). If you got a more powerful Graphics card and managed to install either CUDA for NVIDIA Graphics card or CAL++ for AMD Cards, your speed will be a lot more.

Oh, and I just took this awesome screenshot while Pyrit was doing the batch processing. Check out my CPU usage, it’s hitting absolutely 100%.

10-pyrit-100-percent-CPU-usage-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Also check out my temperature of my cores:

11-pyrit-high-CPU-Temperature-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



You should be careful how big your dictionary file is and how HOT your CPU and Graphics card is burning. Use extra cooling if you can to avoid damage.


Cracking Process

We can crack using few different process.

    Using Pyrit
    Using Cowpatty


Attack a handshake with PMKs from the db using Pyrit

Simple. Just use the following command to start the cracking process.

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap attack_db





21-pyrit-attack_db-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



That’s it. It will take few minutes to go through the whole Database Table to get the password if it existed in the Dictionary. As you can see, 159159186.00 PMK's per second was the speed and it took less than 1 second to crack it. This is by far the fastest. I also had to blank out much of the screenshot.

Note: I tried it from a different workstation with a NVIDIA GTX460 Graphics card with CUDA and Cpyrit-CUDA installed. Obviously, this was much faster than my Laptop. But either way, this is super fast.


Attack a handshake with passwords from a file or Dictionary using Pyrit

If you don’t want to create Datbase and crunch through Dictionary file directly (much slower), following is what you can do:

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/wpa.lst attack_passthrough

Speed this way? 7807 PMKs per second. Much slower for my taste.


Crack using Cowpatty

To crack using cowpatty, you need to export in cowpatty format and then start the cracking process.


Export to cowpatty

I hope up to this point, everything went as planned and worked out. From Pyrit, we can push our output to either cowpatty or airolib-ng. All my tests shows that cowpatty is a lot more faster, so I’ll stick with that.

So let’s make our cowpatty file. This is again simple, issue the following command to export your output to cowpatty.

pyrit -e BigPond -o cow.out export_cowpatty



12-pyrit-export-to-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Let it rip: Crack WPA WPA2 PSK password using cowpatty

Now that we have our cowpatty output, let’s try to crack WPA2/PSK passphrase. Issue the following command to start the cracking process.

cowpatty -d cow.out -s BigPond -r hs/BigPond_58-98-35-E9-2B-8D.cap





13-crack-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

Once you type it in, you’ll a bunch of passwords being tried against your hash file. This will keep going until the end of the file. Once a matching password is found in the dictionary file, the cracking process will stop with an output containing the password.

14-cracked-it-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

And bingo, it found a matching password. Look at the number of passwords tried in a secods

164823.00 passphrases/second.

NOTE: cowpatty will fail if your password/dictionary file is larger than 2GB. You’ll have to stick to airolib-ng even though that’s slower.


Attack a handshake with PMKs from a cowpatty-file using Pyrit

Here’s another way using Pyrit…

You can use cow.out file in Pyrit next time

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/cow.out attack_cowpatty

Speed this way? 31683811 PMKs per second. Much slower than using Pyrit attack_db process. But at least you don’t have to batch process this way.


Cleanup Pyrit and database

Lastly, if you feel like, you can delete your essid and cleanup.

pyrit BigPond delete_essid



15-cleanup-pyrit-and-database-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Conclusion

Thanks for reading. This process is not always possible and sometimes cracking Wifi WPA/WPA2 passwords using Reaver-WPS is much easier. You might want to check that too.
Cracking Wifi WPA/WPA2 passwords

    Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty
    Cracking Wireless WPA2 WPA passwords with Hashcat
    Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

If this guide helped you to achieve what you wanted, please share this article with friends.

Update: 13/03/2014: I just realized I forgot to credit purehate for his ORIGINAL post in BackTrack forum. Without his guide, much of this wouldn’t be possible.

Follow us on Facebook/Twitter.

Last but not the least, I’ll cover up my back …

    Disclaimer: This guide is for training and educational purposes only. Ensure you have permission before you attack an access point as it is a felony in many countries. I take no responsibility of the usage of these instructions containing in this guide.

Related
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)

In "Cracking"
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

In "Cracking"
802.11 Recommended USB Wireless Cards for Kali Linux
802.11 Recommended USB Wireless Cards for Kali Linux

In "Kali Linux"
About blackMORE Ops

blackMORE Ops is dedicated to How to, Guides, Security features and Tips and Tricks for Linux OS. Thank you for visiting us and follow us here www.blackmoreops.com.
View all posts by blackMORE Ops →
Leave a Reply
18 thoughts on “Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux”

    Reply ↓
    ali October 30, 2014 at 9:36 pm

    nice thanks bro

    Pingback: No internet for me! - blackMORE Ops
    Reply ↓
    b rass November 26, 2014 at 5:18 am

    This is a newbie question, but here goes: if I have two different handshakes from two different ESSID that I want to crack, do I have to run the batch process twice?
        Reply ↓
        D-Maub December 15, 2014 at 3:12 pm

        No assuming that you are using the same password file you uploaded
        Reply ↓
        D-Mub December 16, 2014 at 7:02 am

        Sorry after further research, Yes you would need to use the batch process twice. This is because the ESSID acts as a salt to the hashes.

    Pingback: Hacking Wifi The Easiest WayUsing Wifite In Kali Linux

    Pingback: A detailed guide on installing Kali Linux on VirtualBox - blackMORE Ops

    Pingback: Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords) - blackMORE Ops

    Pingback: Cracking Wifi WPA/WPA2 passwords using Reaver-WPS - blackMORE Ops
    Reply ↓
    xyxyxyxyxy@gmail.com December 11, 2014 at 3:46 am

    hey if u have time please add a tread how to start from Rasberry p ..i want to start with Kali Linux and i don`t know anything have to learn commands and all ill b very thankful if you could do this i come from windows and Kali seems much greater ..i`ll come baq here soon :) mayb u can drop a link if u have time for that thank u for all what u doin to share your knowledge
    Reply ↓
    Melvin December 12, 2014 at 4:44 pm

    Hi, how about cleanup the passwords in Pyrit?
    Reply ↓
    gilbert enriquez December 12, 2014 at 11:53 pm

    I have a .cap file,can you crack it?
        Reply ↓
        Melvin December 17, 2014 at 2:17 pm

        I can.
    Reply ↓
    KaliHacker2014 December 15, 2014 at 3:22 pm

    Thank-you, very helpful ;)
    Reply ↓
    Melvin December 17, 2014 at 2:15 pm

    Hi, I think need to add -e option for pyrit BigPond delete_essid

    Pingback: 802.11 Recommended USB Wireless Cards for Kali Linux - blackMORE Ops
    Reply ↓
    edcion January 3, 2015 at 11:42 am

    you blanked the essid of all your screenshots expect “check out the temp of my cores”
    Reply ↓
    kl January 3, 2015 at 5:02 pm

    You state that when using attack_cowpatty we don’t have to batch process. But when I try to do that i get an error, “0 entries written. All done’

    Even if attack_db is much faster, it doesn’t matter because creating the database takes so long. do you only create the db once per wordlist? because otherwise the speed from attack_db or attack_cowpatty doesn’t matter, all that matters is the speed of creating the database, which for me was about 8000/s

    Am I doing something wrong? I don’t understand why you wouldn’t just recommend the attack_cowpatty method if you really can do it w/o creating a batch process to create tables. because of course someone would rather do that at 31 million keys per second than the 15 thousand keys per second you got creating tables.

Post navigation

    ← Install AMD ATI proprietary fglrx driver in Kali Linux 1.0.6
    Step failed: Installing the system or Installing step failed : Install the system at 80% or The failing step is install the system error on Kali Linux →

Google Site Search


   
   
Recent Posts

    Determine if a disk is SSD or HDD
    darodar.com referrer spam and should you be worried?
    Random quotes and creatures using fortune and cowsay in Linux terminal
    Fixing error: Package packagename is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source E: Package ‘packagename’ has no installation candidate

Recent Comments

    kl on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    edcion on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on How to install Pyrit in Kali Linux?
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on Install AMD ATI proprietary driver (fglrx) in Kali Linux 1.0.6 running Kernel version 3.12.6

Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because it’s faster and we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

1-Wifite-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screenshot below:

2-Wifite-Screen-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops





Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

3-WiFite-Choice-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WIfite. It now asks me,

What do you want to do?

    ontinue attacking targets
    [e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

4-WiFite-continue-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

5-WiFite-captured-handshake-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Now that we have a capture file with handshake on it, we can do a few things:

    We can Dictionary attack it.
    We can BruteForce attack it.
        Amongst BruteForce, we can use crunch
        We can use oclhashcat.

In this guide, I will show Dictionary attack as almost 20% (that’s 1 in every 5) AP’s will have a standard dictionary password. In later chapters of this guide, I will show Brute Forcing.



Dictionary attack .cap capture file to crack Wifi password

To do a Dictionary attack, we need to grab a dictionary file.

Kali Linux provides some dictionary files as part of its standard installation. How sweet. Thanks Kali Linux Dev team.

Let’s copy one of best dictionary file to root directory.

cp /usr/share/wordlists/rockyou.txt.gz .

Unzip it.

gunzip rockyou.txt.gz

Because WPA2 minimum password requirement is 8 characters, let’s parse this file to filter out any passwords that is less than 8 characters and more than 63 characters. (well, you could just leave this line, but it is completely up to you). So we are saving this file as newrockyou.txt name.

cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

Let’s see how many passwords this file contains:

wc -l newrockyou.txt

That’s a whopping 9606665 passwords.

Original file contained even more..

wc -l rockyou.txt

That’s 14344392 passwords. So we made this file shorter which means we can test more AP’s in less time.

Finally, lets rename this file to wpa.lst.

mv newrockyou.txt wpa.lst



6-Get-dictionary-File-and-cleaning-it-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create ESSID in Pyrit Database

Now we need to create ESSID in Pyrit Database.

pyrit –e BigPond create_essid

NOTE: If you have an AP that’s got Space it in, example: “NetComm Wireless” then your command will become like this:

pyrit -e 'NetComm Wireless' create_essid

I know a lot of the people struggles with this issue :)



7-pyrit-create-essid-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Awesome, now we have our ESSID added to Pyrit Database.


Import Dictionary in Pyrit

Now that we have our ESSID added to Pyrit database, lets go an import our Password Dictionary.

Use the following command to import previously created password dictionary wpa.lst to Pyrit Database.

pyrit -i /root/cudacapture/wpa.lst import_passwords

8-pyrit-import-dictionary-password-file-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create tables in Pyrit using batch process

We now need to batch process to create tables.

This is simple, just issue the following command

pyrit batch





9-pyrit-create-tables-using-batch-process-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Because I’m on a laptop with a crappy AMD 7500 graphics card, I’m getting only 15019 PMKs per second (that includes my CAL++). If you got a more powerful Graphics card and managed to install either CUDA for NVIDIA Graphics card or CAL++ for AMD Cards, your speed will be a lot more.

Oh, and I just took this awesome screenshot while Pyrit was doing the batch processing. Check out my CPU usage, it’s hitting absolutely 100%.

10-pyrit-100-percent-CPU-usage-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Also check out my temperature of my cores:

11-pyrit-high-CPU-Temperature-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



You should be careful how big your dictionary file is and how HOT your CPU and Graphics card is burning. Use extra cooling if you can to avoid damage.


Cracking Process

We can crack using few different process.

    Using Pyrit
    Using Cowpatty


Attack a handshake with PMKs from the db using Pyrit

Simple. Just use the following command to start the cracking process.

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap attack_db





21-pyrit-attack_db-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



That’s it. It will take few minutes to go through the whole Database Table to get the password if it existed in the Dictionary. As you can see, 159159186.00 PMK's per second was the speed and it took less than 1 second to crack it. This is by far the fastest. I also had to blank out much of the screenshot.

Note: I tried it from a different workstation with a NVIDIA GTX460 Graphics card with CUDA and Cpyrit-CUDA installed. Obviously, this was much faster than my Laptop. But either way, this is super fast.


Attack a handshake with passwords from a file or Dictionary using Pyrit

If you don’t want to create Datbase and crunch through Dictionary file directly (much slower), following is what you can do:

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/wpa.lst attack_passthrough

Speed this way? 7807 PMKs per second. Much slower for my taste.


Crack using Cowpatty

To crack using cowpatty, you need to export in cowpatty format and then start the cracking process.


Export to cowpatty

I hope up to this point, everything went as planned and worked out. From Pyrit, we can push our output to either cowpatty or airolib-ng. All my tests shows that cowpatty is a lot more faster, so I’ll stick with that.

So let’s make our cowpatty file. This is again simple, issue the following command to export your output to cowpatty.

pyrit -e BigPond -o cow.out export_cowpatty



12-pyrit-export-to-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Let it rip: Crack WPA WPA2 PSK password using cowpatty

Now that we have our cowpatty output, let’s try to crack WPA2/PSK passphrase. Issue the following command to start the cracking process.

cowpatty -d cow.out -s BigPond -r hs/BigPond_58-98-35-E9-2B-8D.cap





13-crack-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

Once you type it in, you’ll a bunch of passwords being tried against your hash file. This will keep going until the end of the file. Once a matching password is found in the dictionary file, the cracking process will stop with an output containing the password.

14-cracked-it-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

And bingo, it found a matching password. Look at the number of passwords tried in a secods

164823.00 passphrases/second.

NOTE: cowpatty will fail if your password/dictionary file is larger than 2GB. You’ll have to stick to airolib-ng even though that’s slower.


Attack a handshake with PMKs from a cowpatty-file using Pyrit

Here’s another way using Pyrit…

You can use cow.out file in Pyrit next time

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/cow.out attack_cowpatty

Speed this way? 31683811 PMKs per second. Much slower than using Pyrit attack_db process. But at least you don’t have to batch process this way.


Cleanup Pyrit and database

Lastly, if you feel like, you can delete your essid and cleanup.

pyrit BigPond delete_essid



15-cleanup-pyrit-and-database-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Conclusion

Thanks for reading. This process is not always possible and sometimes cracking Wifi WPA/WPA2 passwords using Reaver-WPS is much easier. You might want to check that too.
Cracking Wifi WPA/WPA2 passwords

    Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty
    Cracking Wireless WPA2 WPA passwords with Hashcat
    Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

If this guide helped you to achieve what you wanted, please share this article with friends.

Update: 13/03/2014: I just realized I forgot to credit purehate for his ORIGINAL post in BackTrack forum. Without his guide, much of this wouldn’t be possible.

Follow us on Facebook/Twitter.

Last but not the least, I’ll cover up my back …

    Disclaimer: This guide is for training and educational purposes only. Ensure you have permission before you attack an access point as it is a felony in many countries. I take no responsibility of the usage of these instructions containing in this guide.

Related
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)

In "Cracking"
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

In "Cracking"
802.11 Recommended USB Wireless Cards for Kali Linux
802.11 Recommended USB Wireless Cards for Kali Linux

In "Kali Linux"
About blackMORE Ops

blackMORE Ops is dedicated to How to, Guides, Security features and Tips and Tricks for Linux OS. Thank you for visiting us and follow us here www.blackmoreops.com.
View all posts by blackMORE Ops →
Leave a Reply
18 thoughts on “Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux”

    Reply ↓
    ali October 30, 2014 at 9:36 pm

    nice thanks bro

    Pingback: No internet for me! - blackMORE Ops
    Reply ↓
    b rass November 26, 2014 at 5:18 am

    This is a newbie question, but here goes: if I have two different handshakes from two different ESSID that I want to crack, do I have to run the batch process twice?
        Reply ↓
        D-Maub December 15, 2014 at 3:12 pm

        No assuming that you are using the same password file you uploaded
        Reply ↓
        D-Mub December 16, 2014 at 7:02 am

        Sorry after further research, Yes you would need to use the batch process twice. This is because the ESSID acts as a salt to the hashes.

    Pingback: Hacking Wifi The Easiest WayUsing Wifite In Kali Linux

    Pingback: A detailed guide on installing Kali Linux on VirtualBox - blackMORE Ops

    Pingback: Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords) - blackMORE Ops

    Pingback: Cracking Wifi WPA/WPA2 passwords using Reaver-WPS - blackMORE Ops
    Reply ↓
    xyxyxyxyxy@gmail.com December 11, 2014 at 3:46 am

    hey if u have time please add a tread how to start from Rasberry p ..i want to start with Kali Linux and i don`t know anything have to learn commands and all ill b very thankful if you could do this i come from windows and Kali seems much greater ..i`ll come baq here soon :) mayb u can drop a link if u have time for that thank u for all what u doin to share your knowledge
    Reply ↓
    Melvin December 12, 2014 at 4:44 pm

    Hi, how about cleanup the passwords in Pyrit?
    Reply ↓
    gilbert enriquez December 12, 2014 at 11:53 pm

    I have a .cap file,can you crack it?
        Reply ↓
        Melvin December 17, 2014 at 2:17 pm

        I can.
    Reply ↓
    KaliHacker2014 December 15, 2014 at 3:22 pm

    Thank-you, very helpful ;)
    Reply ↓
    Melvin December 17, 2014 at 2:15 pm

    Hi, I think need to add -e option for pyrit BigPond delete_essid

    Pingback: 802.11 Recommended USB Wireless Cards for Kali Linux - blackMORE Ops
    Reply ↓
    edcion January 3, 2015 at 11:42 am

    you blanked the essid of all your screenshots expect “check out the temp of my cores”
    Reply ↓
    kl January 3, 2015 at 5:02 pm

    You state that when using attack_cowpatty we don’t have to batch process. But when I try to do that i get an error, “0 entries written. All done’

    Even if attack_db is much faster, it doesn’t matter because creating the database takes so long. do you only create the db once per wordlist? because otherwise the speed from attack_db or attack_cowpatty doesn’t matter, all that matters is the speed of creating the database, which for me was about 8000/s

    Am I doing something wrong? I don’t understand why you wouldn’t just recommend the attack_cowpatty method if you really can do it w/o creating a batch process to create tables. because of course someone would rather do that at 31 million keys per second than the 15 thousand keys per second you got creating tables.

Post navigation

    ← Install AMD ATI proprietary fglrx driver in Kali Linux 1.0.6
    Step failed: Installing the system or Installing step failed : Install the system at 80% or The failing step is install the system error on Kali Linux →

Google Site Search


   
   
Recent Posts

    Determine if a disk is SSD or HDD
    darodar.com referrer spam and should you be worried?
    Random quotes and creatures using fortune and cowsay in Linux terminal
    Fixing error: Package packagename is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source E: Package ‘packagename’ has no installation candidate

Recent Comments

    kl on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    edcion on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on How to install Pyrit in Kali Linux?
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on Install AMD ATI proprietary driver (fglrx) in Kali Linux 1.0.6 running Kernel version 3.12.6


Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because it’s faster and we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

PHOTO CMMD



So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screenshot below:

PHOTO CMMD



Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

pHOTO3



Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WIfite. It now asks me,

What do you want to do?

    ontinue attacking targets
    [e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

PHOT 4



And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

PHOTO5

Now that we have a capture file with handshake on it, we can do a few things:

    We can Dictionary attack it.
    We can BruteForce attack it.
        Amongst BruteForce, we can use crunch
        We can use oclhashcat.

In this guide, I will show Dictionary attack as almost 20% (that’s 1 in every 5) AP’s will have a standard dictionary password. In later chapters of this guide, I will show Brute Forcing.

To do a Dictionary attack, we need to grab a dictionary file.

Kali Linux provides some dictionary files as part of its standard installation. How sweet. Thanks Kali Linux Dev team.

Let’s copy one of best dictionary file to root directory.

cp /usr/share/wordlists/rockyou.txt.gz .

Unzip it.

gunzip rockyou.txt.gz

Because WPA2 minimum password requirement is 8 characters, let’s parse this file to filter out any passwords that is less than 8 characters and more than 63 characters. (well, you could just leave this line, but it is completely up to you). So we are saving this file as newrockyou.txt name.

cat rockyou.txt | sort | uniq | pw-inspector -m 8 -M 63 > newrockyou.txt

Let’s see how many passwords this file contains:

wc -l newrockyou.txt

That’s a whopping 9606665 passwords.

Original file contained even more..

wc -l rockyou.txt

That’s 14344392 passwords. So we made this file shorter which means we can test more AP’s in less time.

Finally, lets rename this file to wpa.lst.

mv newrockyou.txt wpa.lst



6-Get-dictionary-File-and-cleaning-it-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create ESSID in Pyrit Database

Now we need to create ESSID in Pyrit Database.

pyrit –e BigPond create_essid

NOTE: If you have an AP that’s got Space it in, example: “NetComm Wireless” then your command will become like this:

pyrit -e 'NetComm Wireless' create_essid

I know a lot of the people struggles with this issue :)



7-pyrit-create-essid-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Awesome, now we have our ESSID added to Pyrit Database.


Import Dictionary in Pyrit

Now that we have our ESSID added to Pyrit database, lets go an import our Password Dictionary.

Use the following command to import previously created password dictionary wpa.lst to Pyrit Database.

pyrit -i /root/cudacapture/wpa.lst import_passwords

8-pyrit-import-dictionary-password-file-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops




Create tables in Pyrit using batch process

We now need to batch process to create tables.

This is simple, just issue the following command

pyrit batch





9-pyrit-create-tables-using-batch-process-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Because I’m on a laptop with a crappy AMD 7500 graphics card, I’m getting only 15019 PMKs per second (that includes my CAL++). If you got a more powerful Graphics card and managed to install either CUDA for NVIDIA Graphics card or CAL++ for AMD Cards, your speed will be a lot more.

Oh, and I just took this awesome screenshot while Pyrit was doing the batch processing. Check out my CPU usage, it’s hitting absolutely 100%.

10-pyrit-100-percent-CPU-usage-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



Also check out my temperature of my cores:

11-pyrit-high-CPU-Temperature-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



You should be careful how big your dictionary file is and how HOT your CPU and Graphics card is burning. Use extra cooling if you can to avoid damage.


Cracking Process

We can crack using few different process.

    Using Pyrit
    Using Cowpatty


Attack a handshake with PMKs from the db using Pyrit

Simple. Just use the following command to start the cracking process.

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap attack_db





21-pyrit-attack_db-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops



That’s it. It will take few minutes to go through the whole Database Table to get the password if it existed in the Dictionary. As you can see, 159159186.00 PMK's per second was the speed and it took less than 1 second to crack it. This is by far the fastest. I also had to blank out much of the screenshot.

Note: I tried it from a different workstation with a NVIDIA GTX460 Graphics card with CUDA and Cpyrit-CUDA installed. Obviously, this was much faster than my Laptop. But either way, this is super fast.


Attack a handshake with passwords from a file or Dictionary using Pyrit

If you don’t want to create Datbase and crunch through Dictionary file directly (much slower), following is what you can do:

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/wpa.lst attack_passthrough

Speed this way? 7807 PMKs per second. Much slower for my taste.


Crack using Cowpatty

To crack using cowpatty, you need to export in cowpatty format and then start the cracking process.


Export to cowpatty

I hope up to this point, everything went as planned and worked out. From Pyrit, we can push our output to either cowpatty or airolib-ng. All my tests shows that cowpatty is a lot more faster, so I’ll stick with that.

So let’s make our cowpatty file. This is again simple, issue the following command to export your output to cowpatty.

pyrit -e BigPond -o cow.out export_cowpatty



12-pyrit-export-to-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Let it rip: Crack WPA WPA2 PSK password using cowpatty

Now that we have our cowpatty output, let’s try to crack WPA2/PSK passphrase. Issue the following command to start the cracking process.

cowpatty -d cow.out -s BigPond -r hs/BigPond_58-98-35-E9-2B-8D.cap





13-crack-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

Once you type it in, you’ll a bunch of passwords being tried against your hash file. This will keep going until the end of the file. Once a matching password is found in the dictionary file, the cracking process will stop with an output containing the password.

14-cracked-it-wpa-wpa2-psk-password-cowpatty-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops

And bingo, it found a matching password. Look at the number of passwords tried in a secods

164823.00 passphrases/second.

NOTE: cowpatty will fail if your password/dictionary file is larger than 2GB. You’ll have to stick to airolib-ng even though that’s slower.


Attack a handshake with PMKs from a cowpatty-file using Pyrit

Here’s another way using Pyrit…

You can use cow.out file in Pyrit next time

pyrit -r hs/BigPond_58-98-35-E9-2B-8D.cap -i /root/cow.out attack_cowpatty

Speed this way? 31683811 PMKs per second. Much slower than using Pyrit attack_db process. But at least you don’t have to batch process this way.


Cleanup Pyrit and database

Lastly, if you feel like, you can delete your essid and cleanup.

pyrit BigPond delete_essid



15-cleanup-pyrit-and-database-Cracking-Wifi-WPAWPA2-passwords-using-pyrit-and-cowpatty-blackMORE-Ops


Conclusion

Thanks for reading. This process is not always possible and sometimes cracking Wifi WPA/WPA2 passwords using Reaver-WPS is much easier. You might want to check that too.
Cracking Wifi WPA/WPA2 passwords

    Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty
    Cracking Wireless WPA2 WPA passwords with Hashcat
    Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

If this guide helped you to achieve what you wanted, please share this article with friends.

Update: 13/03/2014: I just realized I forgot to credit purehate for his ORIGINAL post in BackTrack forum. Without his guide, much of this wouldn’t be possible.

Follow us on Facebook/Twitter.

Last but not the least, I’ll cover up my back …

    Disclaimer: This guide is for training and educational purposes only. Ensure you have permission before you attack an access point as it is a felony in many countries. I take no responsibility of the usage of these instructions containing in this guide.

Related
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)
Cracking WPA2 WPA with Hashcat in Kali Linux (BruteForce MASK based attack on Wifi passwords)

In "Cracking"
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS
Cracking Wifi WPA/WPA2 passwords using Reaver-WPS

In "Cracking"
802.11 Recommended USB Wireless Cards for Kali Linux
802.11 Recommended USB Wireless Cards for Kali Linux

In "Kali Linux"
\
    Determine if a disk is SSD or HDD
    darodar.com referrer spam and should you be worried?
    Random quotes and creatures using fortune and cowsay in Linux terminal
    Fixing error: Package packagename is not available, but is referred to by another package. This may mean that the package is missing, has been obsoleted, or is only available from another source E: Package ‘packagename’ has no installation candidate

Recent Comments

    kl on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    edcion on Cracking Wifi WPA/WPA2 passwords using pyrit cowpatty in Kali Linux
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on How to install Pyrit in Kali Linux?
    安装 Kali Linux 后需要做的 20 件事 « ________道子千秋 on Install AMD ATI proprietary driver (fglrx) in Kali Linux 1.0.6 running Kernel version 3.12.6

Coded by Jay Stilla at 6 comments:
Labels: , , , , , , , , , , , , , , , , , ,
Masked Location: Silicon Valley, CA, USA
Subscribe to: Posts (Atom)