Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

WirelesSHack
Source of news for electronic projects including Kali Linux, Wireless Security, KODI, SDR, Raspberry Pi, How-To-
information, Guides and Tutorials.

Home
KODI
SDR
Raspberry Pi
Pen Testing
WIFI and Wireless

Step By Step Kali Linux and Wireless Hacking

Basics WEP Hacking Part 3
By WirelessHack | May 19, 2015 31 Comments

This is a multiple part series for someone new to wireless hacking, with
pictures and videos.
Introduction To Kali and WiFi Pen Testing
How to Install Kali Linux
WEP Hacking
Kali Linux and Reaver
Getting a Handshake and a Data Capture, WPA Dictionary Attack
Using Aircrack and a Dictionary to Crack a WPA Data Capture
Cracking a WPA Capture with the GPU using HashCat
Next Creating a Dictionary / Wordlist with Crunch Part 8

1 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Note: If you are using a updated version of Kali and aicrack-ng mon0
interface has been changed to wlan0mon. Read here for more info.

Kali Linux and WEP Hacking

WEP is the original widely used encryption standard on routers. WEP is
notoriously easy to hack. Even though WEP is rarely seen anymore it still
does pop up every now and again.

Also this is a good place to start for someone new to wireless pen testing
before moving on to WPA encryption.

Penetration Testing Setup

Setup a old router and log into it setting it up as WEP for wireless security
to use as a test router. Have one other computer, tablet, or smartphone
connected to it wirelessly since the encrypted data between the two will
need to be captured.

The basic idea of this attack is to capture as much trac as possible using
airodump-ng. Each data packet has an associated three byte Initialization
Vector called IVs. After the attack is launched the goal is to get as many
encrypted data packets or IVs as possible then use aircrack-ng on the
captured le and show the password.

At this point Kali Linux should be running along with the WEP encrypted
router and a wireless connected device. Also a wireless USB adapter
should be plugged in and ready.

Open a terminal window by pressing the terminal icon at the top left.

2 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Next type in the command airmon-ng without the quotes to see if your
adapter is seen by Kali Linux. It should show the interface, chipset, and
driver. If it doesnt then some troubleshooting will have to be done as to
why the adapter is not seen.

Next type in airmon-ng start wlan0 to set the USB adapter into monitor
mode.

3 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Now we need to see what routers are out there and nd the test router.
To do this run the command airodump-ng mon0. After this command is
run a screen will come up showing the routers in range and there
information.

(If a adapter comes up enabled on mon1 or mon2 simply used that instead
of mon0)

4 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

The test machine that was setup should be seen along with its
information. The information needed will be the BSSID, channel (CH), and
ESSID. The test machine here is the dlink router with the BSSID:
00:26:5A:F2:57:2B the channel is on 6 and the ESSID is dlink.

Once this information is seen dont close the terminal window press
CTRL+C inside the window to stop it from using the USB adapter and
leave it to refer back to.

Open another terminal window to run the next command. Also when
done this way the BSSID can be simply copied and pasted when needed.

Next the WEP encrypted data packets needs to be captured. To do this

the airodump-ng command is used along with some switches and
information collected.

For me this would be:

airodump-ng -w dlink -c 6 bssid 00:26:5A:F2:57:2B mon0

airodump-ng is the command, -w is a switch saying to write a le called

dlink to the drive, -c is a switch saying the target is on channel 6, bssid is
another switch saying which bssid to use, and nally mon0 is the
command to use the USB adapter enabled on mon0.

Change the le name, channel, and bssid to match your test router. Copy
the information from the rst terminal window. Copy and pasting the
BSSID into the new terminal window is much quicker then typing it for

5 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

most.
airodump-ng -w (ESSID) -c (channel) bssid (BSSID) mon0

After this is done correctly a window will come up and show information
about the target router. The main feedback we need to watch is the
Beacons and the Data.

These numbers will start at zero and grow as trac is passed between
the router and another device. As these numbers grow, they are being
captured in the le specied in the previous command for this example it
would be a le named dink. IVs need to grow big to crack the password
usually at least 20,000 plus, but ideally 100,000 plus. At this point
someone can simply wait for the IVs to grow large enough to crack the

6 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

password, but there is a way to speed things up.

To speed up the IVs open a third terminal window letting the second run
capturing the data. In the new terminal window the aireplay-ng command
will be used in a two part process rst use the command aireplay-ng -1 0
-a (BSSID) mon0. So for this example it would be aireplay-ng -1 0 -a
00:26:5A:F2:57:2B mon0

After this run the command airplay-ng -3 -b (BSSID) mon0 for this
example it would be the following:
aireplay-ng -3 -b 00:26:5A:F2:57:2B mon0

7 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

This will begin sending out ARP request and the data and the beacons
should begin to grow quickly. Again speeding up the capturing of the IVs
is not necessary but handy.

Aircrack-ng will be used on the data le being written to with the

information. Aircrack-ng can be run at anytime even when there is not
enough data captured it will say on the screen it needs more if there is
not enough.

To use aircrack-ng we need the data le being written to the hard drive. In
this example it is dlink. Open a new terminal window and type the
command ls to see the le. The one aircrack-ng needs is the .CAP le
here it is called dlink-01.cap.

To start aircrack-ng run the command aircrack-ng (le name) so here

that would be
aircrack-ng dlink-01.cap

Aircrack will begin to run and start to crack the password. Here is what is
what it looks like when it is done.

8 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

After Key Found it shows the password in hexadecimal or ASCII they are
the same and either one can be used. For this example the password on
the router was 12345.

Cracking WEP with Kali Linux tutorial (Verbal step by step)

Next Kali Linux and Reaver

9 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Udemy Online Courses Learn Cracking Wi- Passwords/Keys (WEP/WPA

/WPA2)

JOIN OUR Subscribed to WirelessHack

NEWSLETTER
We hate spam. Your email address will not be sold
or shared with anyone else.

SUBSCRIBE FOR FREE

Wireless Security

Step By Step Kali Linux and Wireless Step By Step Kali Linux and Wireless Hacking
Hacking Basics Installation Part 2 Basics Reaver Part 4

10 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

31 thoughts on Step By Step Kali Linux and Wireless Hacking Basics WEP Hacking Part
3

Tecno
October 18, 2015

Ive a problem on the terminal im new with Kali and linux in general, im using bootable
USB this is the the problem im facing:

root@kali:~# airodump-ng wlan0monmon

ioctl(SIOCSIWMODE) failed: Device or resource busy

ARP linktype is set to 1 (Ethernet) expected ARPHRD_IEEE80211,

ARPHRD_IEEE80211_FULL or ARPHRD_IEEE80211_PRISM instead. Make
sure RFMON is enabled: run airmon-ng start wlan0monmon
Sysfs injection support was not found either.

Reply

WirelessHack
October 18, 2015

Kali 2.0 has been having these errors with some setups.

Run these commands

ifcong wlan0mon down
iwcong wlan0mon mode monitor
ifcong wlan0mon up

Here is a video showing the steps.

11 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

How To Fix airodump-ng Error With wlan0mon Kali 2.0

Reply

ANISH
December 19, 2015

root@kali:~# ifcong wlan0mon down

wlan0mon: ERROR while getting interface ags: No such device
root@kali:~# iwcong wlan0mon mode monitor
Error for wireless request Set Mode (8B06) :
SET failed on device wlan0mon ; No such device.
root@kali:~# ifcong wlan0mon up
wlan0mon: ERROR while getting interface ags: No such device
root@kali:~#

Reply

WirelessHack
December 19, 2015

@ANISH: Kali is not seeing your WiFi at all be sure you have Kali compatible USB
adapter.

12 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Reply

zero
January 6, 2016

how do we troubleshoot the adapter so that kali can see the adapteram having
trouble doing that

Reply

Halp
October 24, 2015

When using aircrack-ng getting error, Please specify dictionary

Reply

Halp
October 24, 2015

Extra info: Im not getting any handshake during airodump, nor am I getting any
stations.

Reply

WirelessHack
October 25, 2015

Do you have a Kali Linux compatible USB adapter? How are you running Kali?

Reply

chand
December 18, 2015

A.s to All and i have a poblem that i have also running the kali linux but i can not access

13 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

the wi password by using the wite and and some others commands
wpa/wpa2.:)Have a any person who will help me.?

Reply

Norm Perron
December 25, 2015

Im just getting started with Kali. Using the booted DVD. In Terminal, entering
airmon-ng shows:
phy0 wlan0 i Intel wireless-n 2230
phy1 wlan1mon rt2800usb asustek usb-n53 ralink rt3572

entering airmon-ng start wlan1mon shows:

found 4 processes
phy0 wlan0..
phy1 wlan1mon rt2800usb asustek
(mac80211 monitor mode vif enabled for [phy1]wlan1mon on [phy1]wlan1monmon
(.mac80211 station mode vif disabled for [phy1]wlan1mon)

entering airodump-ng *
where for * I entered lots of possible strings like wlan1monmon, [phy1]wlan1mon
I always get:
arp linktype is set to 1 (ethernet) = expected arphrd_ieee80211,
arphrd_ieee80211_full
make sure rfmon is enabled: run airmon-ng start wlan1monmon
sysfs injection support was not found either.

Questions:
should my last commend be dierent?
could i be getting a false reading on injection support (looking for the wrong device)?
assuming this asus ralink rt3572 is not supported, i also have a eub-362 usb client, does
anyone know if that is supported?
Thanks, Norm

Reply

14 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Norm Perron
December 25, 2015

Also, Kali 2.0 has timed out, with the time and date showing and some arrows pointing
up. How do I get back to the terminal session while running the bootable cd? Thanks

Reply

Alex
January 1, 2016

While capturing the selected network, my beacons grow slowly, and #Data is always
zero. When I use aircrack-ng it says Got no data packets from target network!
Can anyone help me out? Please. Thanks in advance.

Reply

buzz
January 8, 2016

did you use the terminal commands that speed it up? and is there any real world trac
on the ap?

Reply

I
February 26, 2016

Same here

Reply

SH
January 12, 2016

So mine says Key Found [xx:xx:xx:xx:xx]. Thats it.

15 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Reply

SH
January 12, 2016

Never mind, found out.

Reply

hex
January 17, 2016

Hello WirelessHack,

Ive been testing your tutorial on my wireless network and after all procedure you
mentioned here, I got HEX of my password but it is wrong. I tried it couple of times,
same result. Any ideas?

Reply

NoobGUY
February 1, 2016

NEED HELP with 7th Picture from the starting in this post.

In a quiz, the same pic is provided, and it is asked that:

****
SMART ENOUGH???

What does the above FRAMES refer to?

****

can anyone tell what does the word frames in 7th pic refer to?

Reply

16 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Dale T
February 17, 2016

Hi, I ran aircrack (v1.2 rc3) on a .cap le [WEP network] and it says key found
[xx:xx:xx:xx:xx], but this is all I get. Now how do convert this information into the
password?
Any help with this would be greatly appreciated!

Reply

COOL
February 25, 2016

Try Hexadecimal to ascii converter

Reply

Devashish
March 25, 2016

I am having a problem in the very begining . As i just installed kali linux , every time i
type airmon-ng it shows your kernel supports rfkill but you donot have rfkill installed .
When i type
Apt-get install rfkill
It says unable to locate pacage rfkill . I have tried update and upgrade as well .. please
help . !!!

Reply

matt
March 30, 2016

any answer to the rfkill issue? i have the same thing.

Reply

Silent Killer

17 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

March 31, 2016

Guys Why you all use Kali linux only ?????

there are many softwares to hac

Reply

Tharindu
April 28, 2016

Hi every one is this method not working for me any one else i think impossible to hack
wi wep2 ,wep password ?am i right
Pls admin you have to correct post for your readers
Thank you

Reply

bobee
April 28, 2016

There is no WEP2, if you mean WPA2 your on the wrong page.

Reply

Predator
May 17, 2016

root@Jinthu:~# aircrack-ng pre-01.cap -w /root/Desktop/md5_loweralpha-numeric-

symbol32-space#1-7_1.md5sums
Opening pre-01.cap
Read 179163 packets.

# BSSID ESSID Encryption

1 30:B5:C2:59:7B:7C Predator WPA (0 handshake)

Choosing rst network as target.

Opening pre-01.cap

18 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

No valid WPA handshakes found..

how can i x it? any one help me

Reply

jainy
July 20, 2016

root@lovebirds:~# airmon-ng

PHY Interface Driver Chipset

phy0 wlan0 b43 non-mac80211 device? (report this!)

root@lovebirds:~#

Reply

john
August 27, 2016

i have a problem with wlan0, when i open terminal then i go type airmon-ng then i will
see interface, drive, chip and phy but no wlan0, so what can i do from here?

Reply

khali
October 31, 2016

mine says WARWING: unable to start monitor mode what should i do

Reply

Manu
November 22, 2016

this work 100%, Im using an alfa wireless card

19 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Reply

Who am I
December 17, 2016

My #data still takes a lot of time to grow. I used the speed up suggestion, it just reads
the packets

Reply

Leave a Reply

Your email address will not be published. Required elds are marked *

Comment

Name *

Email *

Website

20 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Post Comment

Our Picks For Best Amazon Echo DOT Accessories

Our Picks for Best Hardware Boxes To Run KODI Media Center

New KODI 17 Krypton Setup and Exodus Install

How To Turn Your Old Car Stereo into a Bluetooth Radio

Review: Mini M8S Budget Android Kodi Smart TV Box

What is a Good Wireless Storage Device?

How To Install KODI On a Raspberry Pi 3

How To Cut The Cable Satellite TV Cord In 2016

Our Picks for Best Android TV Box Remote Controls and Keyboards

How to Extend Your Wireless Range Using an Old Router

What is the Easiest Home Internet IP Camera To Setup?

Wireless USB Adapter Buyers Guide

10 Tips For Faster Online Gaming + WiFi Connection

21 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Step by Step Kodi Jarvis and Exodus Install

How To Install SALTS addon into Kodi

How to Replace Your Cable Modem and Save Money

What are the Best Remote Controls For Kodi?

How To Increase a 5 GHz WiFi Router Range

How To Install Kali Linux on a Raspberry Pi 3

Our Picks for Best Bluetooth Speakers on a Budget

Our Picks for Best Amazon Fire TV Stick Bluetooth Speakers

Recent Posts

How To Install Beaus Place Add-on Kodi 17 Krypton

Our Picks for Best Echo DOT Alexa Smart Light Switches

New Nvidia Shield TV 4K HDR 2017 Edition

Review: DOLAMEE D9 TV Box Android Amlogic S912 Octa-core 2GHz

How To Install M4U Add-on Kodi 17 Krypton

How to Install Excalibur Streams Add-on Kodi 17 Krypton

Our Picks for Best Echo DOT Alexa Smart Thermostats

How to Install Zen Add-on Kodi 16.1 Jarvis

How to Install Imperial Streams Add-on Kodi 16.1 Jarvis

How To Install Project M Add-on Kodi 16.1 Jarvis

22 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

TOP BEST WORKING KODI Video Add-ons January 2017

How To Install Gobble Add-on Kodi 16.1 Jarvis

How To Install Fido Video Add-on KODI Jarvis 16.1

Review: AUKEY 20000mAh Portable Charger with Quick Charge 3.0

Our Picks for Best Echo DOT Alexa WiFi Smart Plug Outlets

How to Install Falcon Movies Add-on Kodi 17 Krypton

Our Picks For Best Amazon Echo Dot Alexa Smart Light Bulbs

How to Install Evolve Add-on Kodi 17 Krypton

Our Picks for Best USB Wireless Network Adapters 2017

How to Install or Update Kodi on a Android TV Box

How To Install Fido Video Add-on Kodi 17 Krypton

Review: NET-DYN 300M Mini USB Wireless WiFi Adapter

Our Picks For Best Amazon Echo DOT Accessories

How to Install Real Movies Add-on Kodi 17 Krypton

New KODI 17 Krypton Setup and Exodus Install

How to Install Specto Fork Add-on Kodi 17 Krypton

How To Pair a Amazon Echo DOT to a Bluetooth Speaker

A Step by Step Guide To KODI and Streaming Movies or TV Shows

How To Install Kodi on the New Updated Fire TV Stick

Review: Koogeek Smart Plug Outlet for Siri Apple HomeKit

How to Install Bob Unrestricted Add-on Kodi 17 Krypton

How To Install Paragon Add-on Kodi 17 Krypton

Our Picks for the Best Amazon Echo DOT Bluetooth Speakers

Our Picks for Best Fire TV Stick Bluetooth Headphones

How to Install Salts Add-on Kodi 17 Krypton

How to Install Phoenix Add-on Kodi 17 Krypton

How to Install 1Channel Add-on Kodi 17 Krypton

23 of 24 01/08/17 14:04
Step By Step Kali Linux and Wireless Hacking Bas... http://www.wirelesshack.org/step-by-step-kali-linu...

Our Picks for Best WiFi USB Adapters with High Gain Antennas

How to Install UK Turk Playlists Kodi 17 Krypton

How To Install Kodi On a Android Phone and Stream TV Shows and Movies

All information on this site is for testing and educational purposes only; for use by network secu-
rity administrators, penetration testing professionals, hobbyist and wireless enthusiast. Kodi is a
free Open Source media player which we are not aliated with. Any Kodi add-on should only be
used to stream public domain content.

Wirelesshack.org is a source of news for electronic projects including Kali Linux, Wireless Security,
Network Security, Raspberry Pi, How-To- information, Guides and Tutorials.

Contact Information: WirelessHack@outlook.com

Privacy Policy

The owner of this website, www.wirelesshack.org, is a participant in the Amazon

Services LLC Associates Program, an aliate advertising program designed to

provide a means for sites to earn advertising fees by advertising and linking
www.wireleshack.org to Amazon properties including, but not limited to,
amazon.com, endless.com, myhabit.com, smallparts.com, or amazonwireless.com

24 of 24 01/08/17 14:04