- In this video I'm gonna show you how to use
a brute force attack to crack a WPA version 2 password.
We gonna do that within a few minutes.
So within seven minutes,
using this laptop behind me,
I'm gonna show you how to crack a WPA version 2 password,
random password using brute force
and an application called Hashcat.
Now, for this to work you need access to a GPU,
in your laptop as an example.
So in that laptop I have a GEForce GPU
that I can access to do a brute force attack very,
very quickly against a WPA version 2 password.
Please note that the password that I'm using
in this example is a random password on a TP Link router.
This is actually the password that the router shipped with.
One of the problems with TP Link routers,
same on this router,
is that the default password
that the routers are configured with
is an eight digit number.
That allows us to much more quickly crack the password
using a brute force attack with a GPU.
They're not using alphanumeric characters,
they're just using numeric characters.
They're not using special characters
as part of the default password.
So if a user uses the default password,
and a lot of people do when they get new routers,
we can use a brute force attack with a GPU
to very quickly crack the password.
This is a terrible weakness on TP Link routers.
It once again took me less than seven minutes
to crack this password using a laptop
and a GEForce GPU in the laptop.
Now, I'm showing you the whole process in this video.
I'm gonna show you how to capture the 4-way handshake.
I'm gonna show you how to convert the cap file
into a format that Hashcat can understand.
I'm gonna show you how to bring that into windows
and use Hashcat within windows to launch
the brute force attack against the password.
So use this menu to jump to a specific topic of interest.
If you're not interested in the 4-way handshake capture,
you're just interested in the
Hashcat brute force part of the video,
then again jump to the relevant part of the video.
Okay. Let's get started.
♪ I've been in your waters ♪
Okay. So once again I'm controlling that laptop
from my Mac using VNC.
First thing I need to do is have
a wireless network card.
So in this example,
I'm using an Alfa network adapter.
I've connected it to
that laptop using its USB port.
And what I've done is connected
to the Kali virtual machine running
on this windows computer.
So if I open up a command prompt
and type IP address,
what you'll notice is wlan0 is available.
So in other words the wireless network adapter
has been picked up by Kali Linux.
So to simplify this process,
I'm gonna use Wifite.
And I'm gonna use this command,
"sudo wifite wpa kill."
I'm only gonna attack WPA networks
and I'm gonna kill any processes that interfere.
Have a look at this video where I explained
some of the basics of Wifite.
I'm not gonna explain too much about the
software in this video.
You don't have to use Wifite,
you could use other tools.
But Wifite just makes it very simple.
So first thing I need to do is decide which network
I'm gonna attack.
I'm gonna press Control + C
to stop Wifite scanning for networks.
In this example,
I wanna attack this network, TP-Link.
So I'm gonna press 1 to
start the attack.
Now we could run a Pixie Dust attack,
but I'm not gonna do that.
I'm gonna press Control + C
and then C to continue to the next attack.
I'm also not gonna run the null pin attack.
Press C to continue.
I'm also not gonna run a WPS Pin attack.
C to continue.
Could also run another attack
but I'm not gonna do that.
The only attack I'm wanting to run in this example
is the WPA handshake attack.
Now, it's discovered clients.
I'll try and connect to the TP-Link router.
But I'm getting kicked off the network.
That's what we want.
It's now captured the handshake
and it's tryna run
the probable word list against that captured handshake.
Now, in my previous videos,
a lot of people complained saying
they not gonna be using simple passwords
on their wifi networks.
But again, in this example,
I'm using the default password
that the router is configured as.
So this specific TP-Link router has this wireless password.
This router has a different password,
but it's also only eight characters in length.
So these are the random passwords that the routers
are shipped with.
So again, this is the password on the router.
But that wasn't discovered
because it's not in this word list.
If I type ls,
we have this hs directory.
And if I go to that directory
and type ls you'll notice there's a cap file.
So that's the captured handshake.
I'll clear the screen.
And once again,
there's the captured handshake.
That needs to be converted now into a format
that Hashcat can use.
So to do that,
I'm gonna use user,
share, hashcat- Utils.
They quite a few tools here
but the tool I wanna use is this tool.
And I wanna convert our handshake file
to a file such as wpa2hccapx.
And press enter.
Okay. So I should have remembered to put sudo in.
So let's put sudo in to convert that.
We can see that the handshake has been written.
So ls now shows us that we've got this new handshake
in this directory.
So I'll clear the screen.
And once again,
there is the new handshake saved in Kali.
What I'll do now is open up a folder.
So under hs,
we've got the file.
And what I'm gonna do is make
VM way smaller.
And I'm gonna copy that file
into windows into my Hashcat directory.
To actually use Hashcat,
I'm gonna open up a command prompt.
I'm gonna go to my downloads directory.
I'm gonna go to my Hashcat software.
DIR shows me the files here.
I'll clear the screen.
The software that I wanna use is Hashcat.exe.
And I'll use hyphen
or dash I to see the GPUs available
on this computer.
So we can see that device three is unstable.
But we've got CUDA information here.
Backend device number one is a GEForce GTX 1650 Ti.
And then we've got OpenCl information.
We've got NVIDIA CUDA information here.
Device two is once again the GEForce GTX GPU
in the computer.
Now, fortunately, we don't have to specify
all of those details when running Hashcat.
What I'm gonna do is run Hashcat,
the executable
and the type that we're going to attack is WPA.
You can see all of those options on the Hashcat Wiki.
So we gonna be attacking WPA version 2.
The attack is gonna be a brute force attack.
So in the Wiki as an example,
they've got a brute force attack against MD5.
That's not what we're using here
because we're not using -0,
we're using -2,500, so WPA.
But it's a brute force attack.
And the attack that I wanna launch
is against the WPA2 file that we created.
And this specifies that Hashcat
should use brute force using digits,
eight digits in length in this example.
So I'll press enter there.
Hashcat is starting.
We can press S to see the status.
We can see that we're using a WPA attack
against this file called WPA2.
The estimated time to break this
is nine minutes.
So within 10 minutes,
and it's actually gonna be quicker In this example,
Hashcat will crack this WPA2 password.
Press S to see the status again.
We can see that we already
at 5.9% progress.
Now, this is one of the problems that you can have
with your GPUs,
is that the performance will be reduced
because of the temperature being raised.
But notice the attack has lost at 55 seconds.
Estimated is 9 minutes 41 seconds.
It's already progressed through 8.6%
of this number of variations.
So at this point,
the fans on that laptop are spinning up
making a lot of noise.
But notice we are now at 11%,
after 1 minute
and 18 seconds.
Now, when going I'm gonna speed up the video at this point
because all it's gonna do now is continue
going through all the different variations
doing a brute force attack against that password.
It's taken it about 2 minutes 41 seconds
to get through a quarter
of all of those different options.
So it's not taking a lot of time.
After five minutes,
it's through about 50%
of all the combinations.
Okay, so there you go.
After 6 minutes
and 55 seconds,
it's cracked the password.
It went through 69%
of a hundred million combinations.
So the 69 millionth combination
was the actual password.
And if I type this again,
it will tell us
that it's already got the password.
We should use show to display the password.
So if I typed show now,
I can see that this is the password
for this wireless network.
And if I go
and look on the access point,
there you go.
That's the password using WPA version 2 PSK,
encryption is AES.
It took Hashcat 6 minutes
and 55 seconds to crack that password.
Now in windows,
you can open up the potfile
with, say notepad.
And you'll be able to see
the actual password,
which once again
is the password on the wireless access point.
Hashcat is fantastic software,
lots of options available.
I'll show you in subsequent videos,
more about Hashcat.
I'll teach you more about Hashcat If you're interested.
Hope you enjoyed this video.
If you did,
please like it,
please subscribe to my YouTube channel.
And please click on the bell to get notifications.
I'm David Bombal,
wanna wish you all the very best.
♪ I've been in your waters ♪
♪ I thought you were my love ♪
♪ I know one thing for sure ♪
♪ I've never been so close ♪