Yes, it is possible to find out the password of a WiFi network. Yes, the process is very useful to check the security of your wireless network. No, you should not use this to steal WiFi from your neighbor. No, I can't do anything to prevent it. So... where do we start? Basically, by downloading a distro: WiFiSlax. There are similar alternatives out there, but being a development in Spanish, WiFiSlax gives us an extra advantage.
A wireless network, a security algorithm, and all the desire to find out its password. Perhaps it is the simple act of testing your patience and knowledge. It is also possible that you need a "backup WiFi" for those moments when your provider leaves you on the road. And of course, it would be a mistake on our part to ignore the "malice factor". Many information security enthusiasts decided to expose the vulnerabilities of a network or a system (after having explained the problem to no end) by becoming the attackers themselves, just to prove they were right. Today it is not difficult to find some configuration horrors in WiFi networks, starting with the use of WPS, and even worse, the heavily cracked WEP algorithm. If you have wondered how to find out the password of a WiFi network under those conditions, you are in the right place.
How to find out the password of a WiFi network using WiFiSlax
The first step is to download the ISO image of WiFiSlax, a distro based on Slackware. There are two editions: the standard 4.12, and WiFiSlax64 1.1 64-bit. I personally decided to use WiFiSlax64, but everything you read below should apply to both versions. Being a Live distro, WiFiSlax requires a USB drive with sufficient capacity (I used a 4 GB one), and the process of transferring the image to the memory was left to the classic Rufus.
Once finished, restart the computer from the USB drive, choose the first option in the WiFiSlax boot menu, and wait until the desktop appears (essentially KDE). But before...
WiFiSlax doesn't detect my network card
There is no room for error here. You need a wireless network card that is compatible and can be configured in monitor mode. I admit that WiFiSlax's support proved to be very good (at least on this side), but there is always that strange chip that arrives late with its drivers. The most effective in such cases is to get a USB WiFi adapter that works directly with WiFiSlax. Fortunately, in the official forum they have shared a list with the recommended models, and some are very cheap (less than 20 euros).
WEP networks
Also known as "Colanders" or "Revolving Doors", WEP networks capture the interest of beginners for how easy it is to enter them. The presence of clients on the WiFi network makes things a little easier, but in general, the utilities offer different types of attacks, and include advanced injection mechanisms. WiFiSlax's offering is very wide, and today we are going to follow the path of minidwep-gtk.
- Start menu -> WiFiSlax -> Wireless -> minidwep-gtk.
- Choose the network card (wlan0), Channel in All, and Encryption in WEP.
- Select all Aireplay-ng modes.
- Try with Injection Rate at 800. If there are problems, you can lower it.
- Press Scan, and wait between 30 and 60 seconds to detect networks.
- Press Ctrl+C to stop detection, and select the WEP network to attack.
- Click on Launch, and wait.
Several minutes and about 60,000 IVs later, our sacrifice router gave up at the feet of minidwep-gtk, delivering the key without complaint. Depending on network activity and connected clients, some WEP networks end up cracked with less than 10,000 IVs, while others need more than 100,000. Patience.
WPS attack
WPS technology (Wi-Fi Protected Setup) was designed to simplify connection to wireless access points. With WPS, the user doesn't need to be a security expert... and as expected, it didn't do a great job. Attacks directed at the WPS standard are very well documented, to the point that the first and only recommendation is to disable it. However... it is very common to find routers that still report WPS active. In fact, there are isolated models that don't even allow its full deactivation. Logically, WiFiSlax has tools with the potential to cut WPS like butter. This time, our chosen one is Geminis Auditor.
- Start menu -> WiFiSlax -> Wireless -> Geminis Auditor
- Enter 'Scan for targets', and choose a WiFi network with WPS.
- With the network already chosen, go to 'Attack selected target'.
- The available attacks may vary, but if there is a 'vulnerable' entry, start there.
- Let the program work.
If the PIN is considered 'generic' or uses a known pattern, Geminis Auditor won't take long to report both the PIN and the WPA key. Our slave router of test has exactly that problem with its WPS implementation, and everything ended in less than five seconds. Of course, this is one of the best scenarios for an attacker. In normal sessions, you will have to wait much longer.
WPA and WPA2
Yes, in the past we have talked about the KRACK vulnerability and the imminent arrival of WPA3, but in the vast majority of cases, if you want to find out the password of a WiFi network with WPA or WPA2, you will need three things: 1) The network to have clients connected, 2) Capture a handshake, and 3) Enough firepower to chew that handshake in a reasonable time. This last point tends to be the most complicated, as it involves brute force and the use of dictionaries. In very relaxed terms, the attacks bombard clients with DeAuth commands to force their disconnection. When one of the clients tries to reconnect, the handshake is captured, and a file with .cap or .pcap extension is generated. WiFiSlax is compatible with handshake processing using AMD and Nvidia graphics cards, but installing the modules with their drivers is not the most comfortable thing in the world. However, that doesn't prevent taking the .cap, loading it in another Linux distro with better AMD/Nvidia support, and processing it there. Another alternative is online services. Most accept cryptocurrencies, and you only pay after the password has been discovered (unless you want to try with larger dictionaries).
As an example, I am going to commit the gigantic error of protecting a WPA network with a birth date, and share the extraction process using a combination of Handshaker and Brutus:
- Start menu -> WiFiSlax -> WPA -> Handshaker
- Choose the interface, and wait for network detection.
- Press Ctrl+C to stop the search, and select the network to attack.
- There are several types of attacks. Start with Aireplay-ng.
- Wait for Handshaker to obtain the handshake.
The truth is that this can take hours, or fall in a matter of minutes. As soon as we have the handshake, it is necessary to copy the .cap file to Brutus's folder. The original is in /opt/Handshaker/Handshake, and the copy is saved in /opt/Brutus. Once that is done:
- Start menu -> WiFiSlax -> WPA -> BrutusHack
- Brutus presents a list of options. In this case, Dates.
- Brutus asks for a digit from 0 to 9 as a starting point. We'll go with 0.
- Type of attack. Aircrack-ng is the most basic, but enough for our .cap.
- We wait.
A little over four minutes later, the key '27121989' was exposed. If anyone asks you why we can't use birth dates or special events as passwords, show them this: An eight-year-old Intel Atom processor broke its security in the time a song lasts.
Well, I think that's enough for today. If you discover that these methods don't work for you, don't worry. Finding out the password of a WiFi network is not a uniform and infallible process. With a simple web search you will notice that many users prefer to use other tools in WiFiSlax. Pyrit, Linset, Airgeddon, WiFiMoSys... the list goes on. There are also aspects beyond your control. If a network doesn't have enough clients, attacks lose effectiveness, and maybe it's not a bad idea to try later. Have fun, and don't do harm. Good luck!
