Ethical Hacking and Penetration Testing Guide

Command
:
airodump-ng mon0
Attacking the Target
Step 3
—In order to crack the WEP key, we would need to capture of the contents of the data 
file and write it to a file which we can analyze later. To accomplish this task, we would use 
airodump and restrict our monitoring only to the access point (ap) we are targeting.
Structure
airodump-ng mon0 --bssid –c (channel) –w (file name to save)
Command
:
airodump-ng mon0 --bssid 98:fc:11:c9:14:22 --channel 6 --write RHAWEP
We had to specify the bssid of the target that we learnt from the previous step, followed by the 
channel that the access point is on, which we also learnt from previous step (channel 6). The reason 
we want to restrict it to channel 6 is that we don’t want our wireless card to switch channels. Then 
we instruct it to write the results to a file called RHAWEP. The file would be in several formats, 
such as kismet, cap, etc., so that we can analyze it using different tools. What we are interested in 
is the contents of the cap file.

---

300
◾ 
Ethical Hacking and Penetration Testing Guide
Speeding Up the Cracking Process
Step 4
—In order to decrypt the wep key, we would need data packets, but waiting to collect 
them would be time consuming. To speed up this process, we can use a fake authentication 
attack which will associate our MAC address with the access point. This attack is only useful 
in the case where we have no clients associated with the access point.
Structure
aireplay-ng - 1 3 –a (bssid of the target) (interface)
Command
:
aireplay-ng -1 3 –a 98:fc:11:c9:14:22 mon0
The –1 parameter specifies that we want to use a fake authentication attack followed by the 
number of times we want to send the authentication request, then the –a