Giter Club home page Giter Club logo

wifite2's Introduction

GitHub version GitHub issues GitHub forks GitHub stars Android Supported GitHub license

Wifite

This repo is a complete re-write of wifite, a Python script for auditing wireless networks.

Wifite runs existing wireless-auditing tools for you. Stop memorizing command arguments & switches!

Wifite is designed to use all known methods for retrieving the password of a wireless access point (router). These methods include:

  1. WPS: The Offline Pixie-Dust attack
  2. WPS: The Online Brute-Force PIN attack
    WPS: The Offline NULL PIN attack
  3. WPA: The WPA Handshake Capture + offline crack.
  4. WPA: The PMKID Hash Capture + offline crack.
  5. WEP: Various known attacks against WEP, including fragmentation, chop-chop, aireplay, etc.
  6. WIFI Signal jammer, block specific accesspoints or multiple. signal jamming only works for specific Atheros WiFi chipsets.

Run wifite, select your targets, and Wifite will automatically start trying to capture or crack the password.

Supported Operating Systems

Wifite is designed specifically for the latest version of Kali Linux. ParrotSec is also supported.

NetHunter (Android) is also widely supported by wifite, but it will require a custom kernel with modules support and various patches for injection in order to work. Tested on Android 10 (Q), Android 11 (R), Android 12 (S) and Android 13 (T)

More information regarding Android: NetHunter is found there and you should also take a look at the NetHunter WIKI which is more up to date then NetHunter.com .

Other pen-testing distributions (such as BackBox or Ubuntu) have outdated versions of the tools used by Wifite. Do not expect support unless you are using the latest versions of the Required Tools, and also patched wireless drivers that support injection.

Required Tools

First and foremost, you will need a wireless card capable of "Monitor Mode" and packet injection (see this tutorial for checking if your wireless card is compatible and also this guide). There are many cheap wireless cards that plug into USB available from online stores.

Second, only the latest versions of these programs are supported and must be installed for Wifite to work properly:

Required:

  • Suggest using python3 as python2 was marked deprecated as of january 2020.
  • As we moved from older python and changed to fully support and run on python3.11
  • Iw: For identifying wireless devices already in Monitor Mode.
  • Ip: For starting/stopping wireless devices.
  • Aircrack-ng suite, includes:
    • airmon-ng: For enumerating and enabling Monitor Mode on wireless devices.
    • aircrack-ng: For cracking WEP .cap files and WPA handshake captures.
    • aireplay-ng: For deauthing access points, replaying capture files, various WEP attacks.
    • airodump-ng: For target scanning & capture file generation.
    • packetforge-ng: For forging capture files.

Optional, but Recommended:

  • tshark: For detecting WPS networks and inspecting handshake capture files.
  • reaver: For WPS Pixie-Dust & brute-force attacks.
    • Note: Reaver's wash tool can be used to detect WPS networks if tshark is not found.
  • bully: For WPS Pixie-Dust & brute-force attacks.
    • Alternative to Reaver. Specify --bully to use Bully instead of Reaver.
    • Bully is also used to fetch PSK if reaver cannot after cracking WPS PIN.
  • john: For CPU (OpenCL)/GPU cracking passwords fast.
  • coWPAtty: For detecting handshake captures.
  • hashcat: For cracking PMKID hashes.

Install dependencies

Either, do it the proper python way with

$ python3 -m venv venv
$ source venv/bin/activate
$ pip3 install -r requirements.txt

Run Wifite

$ sudo ./wifite.py

Install Wifite

To install onto your computer (so you can just run wifite from any terminal), again, the choice is the old fashioned way of python ..

$ sudo python3 setup.py install

This will install wifite to /usr/sbin/wifite which should be in your terminal path.

Brief Feature List

  • PMKID hash capture (enabled by-default, force with: --pmkid)
  • WPS Offline Brute-Force Attack aka "Pixie-Dust". (enabled by-default, force with: --wps-only --pixie)
  • WPS Online Brute-Force Attack aka "PIN attack". (enabled by-default, force with: --wps-only --no-pixie)
  • WPA/2 Offline Brute-Force Attack via 4-Way Handshake capture (enabled by-default, force with: --no-wps)
  • Validates handshakes against tshark, cowpatty, and aircrack-ng (when available)
  • Various WEP attacks (replay, chopchop, fragment, hirte, p0841, caffe-latte)
  • Automatically decloaks hidden access points while scanning or attacking.
    • Note: Only works when channel is fixed. Use -c <channel>
    • Disable this using --no-deauths
  • 5Ghz support for some wireless cards (via -5 switch).
    • Note: Some tools don't play well on 5GHz channels (e.g. aireplay-ng)
  • Stores cracked passwords and handshakes to the current directory (--cracked)
    • Includes information about the cracked access point (Name, BSSID, Date, etc).
  • Easy to try to crack handshakes or PMKID hashes against a wordlist (--crack)

TIP! Use wifite.py -h -v for a collection of switches and settings for your own customization, automation, timers and so on ..

What's new?

Comparing this repo to the "old wifite" @ https://github.com/derv82/wifite

  • Less bugs
    • Cleaner process management. Does not leave processes running in the background (the old wifite was bad about this).
    • No longer "one monolithic script". Has working unit tests. Pull requests are less-painful!
  • Speed
    • Target access points are refreshed every second instead of every 5 seconds.
  • Accuracy
    • Displays realtime Power level of currently-attacked target.
    • Displays more information during an attack (e.g. % during WEP chopchop attacks, Pixie-Dust step index, etc)
  • Educational
    • The --verbose option (expandable to -vv or -vvv) shows which commands are executed & the output of those commands.
    • This can help debug why Wifite is not working for you. Or so you can learn how these tools are used.
  • More-actively developed, with some help from the awesome open-source community.
  • Python 3 support.
  • Sweet new ASCII banner.

What's gone?

  • Some command-line arguments (--wept, --wpst, and other confusing switches).
    • You can still access some of these obscure options, try wifite -h -v

What's not new?

  • (Mostly) Backwards compatible with the original wifite's arguments.
  • Same text-based interface everyone knows and loves.

Screenshots

NetHunter Android 13 (S) scanning for targets / target information Scanning for targets


Cracking WPS PIN using reaver's Pixie-Dust attack, then fetching WPA key using bully: Pixie-Dust with Reaver to get PIN and Bully to get PSK


Cracking WPA key using PMKID attack: PMKID attack


Decloaking & cracking a hidden access point (via the WPA Handshake attack): Decloaking and Cracking a hidden access point


Cracking a weak WEP password (using the WEP Replay attack): Cracking a weak WEP password


Cracking a pre-captured handshake using John The Ripper (via the --crack option): --crack option

wifite2's People

Contributors

a9g-data-droid avatar cbrunnkvist avatar chunshengzhao avatar codeswhite avatar deix avatar dependabot[bot] avatar derv82 avatar examin avatar goll avatar kimocoder avatar mako2580 avatar mayankmetha avatar mrrob0-x avatar nastyagrifon avatar ostoic avatar random-robbie avatar renovate[bot] avatar rhertzog avatar ritiek avatar sagsmug avatar sbrun avatar schoonc avatar shubhamvis98 avatar silversteven avatar snyk-bot avatar soaringswine avatar tiagogalvao avatar v-t-p avatar viniciusmarangoni avatar yaroslav-karpenko avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

wifite2's Issues

Skip other scans too if the AP is in cracked.txt

Should Wifite try to crack a WiFi AP even if it is cracked already?
I guess not. It is not supposed to do that.

Then why does it try to do a Pixie-Dust, WPS-Null-Pin, WPS BruteForce, PMKID stuff and then after trying to capture or after caturing a CAP file it is somehow decided to say that it is already cracked.

Why spend so much energy if it is already cracked?

Can't catch a handshake

I'm using internal mon mode on OnePlus 6T and can't seem to get the handshake. It times out before capturing.

TODO

There are some issues that needs to be resolved.

  • Add capture analyze with hcxtools, pyrit is getting old and lazy on the matter
  • Add back "--strip" option, with the use of hcxdumptool
  • PMKID attack needs some attention. Make better use of the hcxtools suite! @ZerBea you in?
  • Some tracebacks/outputs needs to be a bit nicer (like the caffe-latte attack repons below)
  • EvilTwin is an attack that's half-way implemented, but not working/usable. [W.I.P]
  • Find a better way to load 88XXau and the rtl8188eus driver (8188eu) (keep in mind that airmon-ng has support now)

Screenshot from 2019-10-24 06-16-22

0 scanning results

i run wifite using command - sudo wifite --wpa --kill

and get the output ----

. .
.´ · . . · . wifite2 2.5.7 : : : (¯) : : : a wireless auditor by derv82 . · /¯\ ´ · .´ maintained by kimocoder /¯¯¯\ ´ https://github.com/kimocoder/wifite2

[+] option: kill conflicting processes enabled
[+] option: targeting WPA-encrypted networks
[!] Warning: Recommended app pyrit was not found. install @ https://github.com/JPaulMora/Pyrit/wiki
[!] Killing 2 conflicting processes
[!] stopping network-manager (service network-manager stop)
[!] Terminating conflicting process wpa_supplicant (PID 28597)

Interface   PHY   Driver              Chipset                                                                                                      

  1. wlan0 phy0 ath10k_pci Qualcomm Atheros QCA9377 802.11ac Wireless Network Adapter (rev 31)

[+] enabling monitor mode on wlan0... enabled wlan0mon

[+] Scanning. Found 0 target(s), 0 client(s). Ctrl+C when ready

but even after long time ago, no nearby wifi shown.

kindly look into it.

info ------

os : kali linux 2020.4 live iso
wifi card : inbuilt wifi with monitor mode.

Feature Request: Full Automation

Would like to see if it would be possible to have a way to fully automate the handshake / PMKID collection.

  • A no WPS option for times when you don't have the time and just want a PMKID or handshake
  • Maybe create a white/black list that way you wouldn't need to select which network it would just go based on those lists. If blacklist is blank... conduct PMKID and handshake for everything.
  • Adjustable timing, this would reduce wasted time on a network that you may never hear a client on for the handshake
  • Do client only option on each loop of the automated process to speed up the loop process if there are no clients.
  • GPS support (PPI) same as issue 36

Feature Request: GPS

Looking to use this for wardriving / warwalking and would like to see if the GPS functionality can be added. I know airodump only supports GPSD, a check in wifite2 to see if GPSD is running and if it is added it to the pcap/pcapng.

[!] Error: Cannot find any interfaces in monitor mode

Interface PHY Driver Chipset

  1. wlan0 phy2 rtl8188eu TP-Link TL-WN722N v2

[+] enabling monitor mode on wlan0... failed
failed

[!] Error: Cannot find any interfaces in monitor mode

[!] Full stack trace below
.
.
.
but ive enabled monitor mode via airmon-ng

Docker build Fails at hcxtools

It appears a few source code lines in a hcxtools leverage the PRId64, PRIx64, and PRIu64 identifiers, which throw errors while compiling. I used the dockerfile as is and spun the container up to troubleshoot. Gcc is version 4.9.2 within the container.
After reading:
https://stackoverflow.com/questions/11869593/c99-printf-formatters-vs-c11-user-defined-literals
I added:
#define __STDC_FORMAT_MACROS
#include <inttypes.h>
to the hcxpcapngtool.c and hcxhashtool.c files and it built fine. I think this "could" be an upstream issue; however, given the container is based on Jessie (old) I did not want to speculate, since newer systems have much more recent compilers that may work.

[!] Error: 'tuple|int' object has no attribute 'split'

Got the latest master to post this error.

[!] Error: 'tuple' object has no attribute 'split'

[!] Full stack trace below

[!] Traceback (most recent call last):
[!] File "/media/kali/DATA/Stuff/wifite2-master/wifite/main.py", line 97, in entry_point
[!] wifite.start()
[!] File "/media/kali/DATA/Stuff/wifite2-master/wifite/main.py", line 52, in start
[!] self.scan_and_attack()
[!] File "/media/kali/DATA/Stuff/wifite2-master/wifite/main.py", line 77, in scan_and_attack
[!] targets = s.select_targets()
[!] File "/media/kali/DATA/Stuff/wifite2-master/wifite/util/scanner.py", line 260, in select_targets
[!] for choice in input().split(','):
[!] AttributeError: 'tuple' object has no attribute 'split'

[!] Exiting

On the previous 2.5.7 version, the error that I have came across was this one:

!] Error: 'int' object has no attribute 'split'

[!] Full stack trace below

[!] Traceback (most recent call last):
[!] File "/media/kali/DATA/Stuff/wifite2-2.5.7/wifite/main.py", line 97, in entry_point
[!] wifite.start()
[!] File "/media/kali/DATA/Stuff/wifite2-2.5.7/wifite/main.py", line 52, in start
[!] self.scan_and_attack()
[!] File "/media/kali/DATA/Stuff/wifite2-2.5.7/wifite/main.py", line 77, in scan_and_attack
[!] targets = s.select_targets()
[!] File "/media/kali/DATA/Stuff/wifite2-2.5.7/wifite/util/scanner.py", line 260, in select_targets
[!] for choice in input().split(','):
[!] AttributeError: 'int' object has no attribute 'split'

[!] Exiting

However on 2.5.5 this error did not pop up before.

Airmon class missing some methods

Hi !

Not sure if this was intended or not but since commit e607189 Airmon class in Airmon.py is missing 3 methods : stop_bad_driver(), start_bad_driver() and start()

Fallback to 'iw' if 'iwconfig' fails

This happened on NetHunter with Wifite v2.2.5.

root@kali:~# iwconfig 2>&1 | grep wlan
wlan1     no wireless extensions.
wlan0     no wireless extensions.
root@kali:~# airmon-ng start wlan1
Found 1 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode
  PID Name
26073 wpa_supplicant
PHY Interface   Driver      Chipset
phy0    p2p0        icnss       Not pci, usb, or sdio
phy0    wlan0       icnss       Not pci, usb, or sdio
phy9    wlan1       rt2800usb   Ralink Technology, Corp. RT2870/RT3070
        (mac80211 monitor mode vif enabled for [phy9]wlan1 on [phy9]wlan1mon)
        (mac80211 station mode vif disabled for [phy9]wlan1)
root@kali:~# iwconfig 2>&1 | grep wlan
wlan0     no wireless extensions.
wlan1mon  no wireless extensions.
root@kali:~# wifite
   .               .
 .´  ·  .     .  ·  `.  wifite 2.2.5
 :  :  :  (¯)  :  :  :  automated wireless auditor
 `.  ·  ` /¯\ ´  ·  .´  https://github.com/derv82/wifite2
   `     /¯¯¯\     ´
 [!] Warning: Recommended app bully was not found. install @ https://github.com/aanarchyy/bully
 [!] Warning: Recommended app pyrit was not found. install @ https://github.com/JPaulMora/Pyrit/wiki
 [!] Warning: Recommended app hashcat was not found. install @ https://hashcat.net/hashcat/
 [!] Warning: Recommended app hcxdumptool was not found. install @ https://github.com/ZerBea/hcxdumptool
 [!] Warning: Recommended app hcxpcaptool was not found. install @ https://github.com/ZerBea/hcxtools
 [!] Conflicting processes: wpa_supplicant (PID 26073)
 [!] If you have problems: kill -9 PID or re-run wifite with --kill)
    Interface   PHY   Driver              Chipset
-----------------------------------------------------------------------
 1. p2p0        phy0  icnss               Not pci, usb, or sdio
 2. wlan0       phy0  icnss               Not pci, usb, or sdio
 3. wlan1mon    phy9  rt2800usb           Ralink Technology, Corp. RT2870/RT3070
 [+] Select wireless interface (1-3): 3
 [+] enabling monitor mode on wlan1mon... failed
failed
 [!] Error: Cannot find any interfaces in Mode:Monitor
 [!] Full stack trace below
 [!]    Traceback (most recent call last):
 [!]    File "/usr/lib/python2.7/dist-packages/wifite/__main__.py", line 93, in entry_point
 [!]        wifite.start()
 [!]    File "/usr/lib/python2.7/dist-packages/wifite/__main__.py", line 53, in start
 [!]        Configuration.get_monitor_mode_interface()
 [!]    File "/usr/lib/python2.7/dist-packages/wifite/config.py", line 129, in get_monitor_mode_interface
 [!]        cls.interface = Airmon.ask()
 [!]    File "/usr/lib/python2.7/dist-packages/wifite/tools/airmon.py", line 319, in ask
 [!]        iface.interface = Airmon.start(iface)
 [!]    File "/usr/lib/python2.7/dist-packages/wifite/tools/airmon.py", line 190, in start
 [!]        raise Exception('Cannot find any interfaces in Mode:Monitor')
 [!]  Exception: Cannot find any interfaces in Mode:Monitor
 [!] Exiting

It seems like it tries to use iwconfig output to determine if the card is in monitor mode (as seen by Mode:Monitor), but apparently, ieee80211 compatibility has been disabled, so any deprecated command (iwconfig and others) will fail, and this can be seen at the very beginning of the output.
So, what I would recommend is that if it happens, is to fallback to using iw to check if the interface is in monitor mode.

Note that airodump-ng works just fine on it.

I'm not sure if this happens with this version but I decided to open this here since derv82's repo hasn't seen any activity in a long time. Let me know if you prefer to have it opened in derv82's repo.

Eternal WPS Pin Attack

I have been trying to crack a network for almost 2 days and still only got one PIN. I'm running the application with its default settings. It should detect that if it doesn't progress, better continue with another attack or the next network.
Selection_392

wifite throws errors while doing --crack at some SSIDs

wifite throwing some errors like this while doing --crack stuff:

Listing captured handshakes from /media/kali/DATA/Stuff/wifite2-2.5.4/hs:

Error: Cannot find BSSID or ESSID in cap file hs/pmkid_Seko_E8-37-7A-22-C8-4B_2020-04-28T23-17-42.16800

Full stack trace below

Traceback (most recent call last):
File "/media/kali/DATA/Stuff/wifite2-2.5.4/wifite/main.py", line 97, in entry_point
wifite.start()
File "/media/kali/DATA/Stuff/wifite2-2.5.4/wifite/main.py", line 47, in start
CrackHelper.run()
File "/media/kali/DATA/Stuff/wifite2-2.5.4/wifite/util/crack.py", line 57, in run
handshakes = cls.get_handshakes()
File "/media/kali/DATA/Stuff/wifite2-2.5.4/wifite/util/crack.py", line 162, in get_handshakes
handshakenew.divine_bssid_and_essid()
File "/media/kali/DATA/Stuff/wifite2-2.5.4/wifite/model/handshake.py", line 40, in divine_bssid_and_essid
raise ValueError('Cannot find BSSID or ESSID in cap file %s' % self.capfile)
ValueError: Cannot find BSSID or ESSID in cap file hs/pmkid_Seko_E8-37-7A-22-C8-4B_2020-04-28T23-17-42.16800

Exiting

And the contents of the file is:
32439416205d47d1d475a7e8d779b0b5*e8377a22c84b*c0eefbd300aa*53656b6f

PS: The last part is the ESSID

Samples from pmkid captures that give error: https://gofile.io/d/ARhBX7

Wifite exits immediately after starting

I just installed the latest 2.5.2 on my Google Nexus 5, started Nexmon, and then ran wifite. It starts normally, gets to the 'Scanning. Found 0 target(s)..." part, then immediately exits with [Error] No targets found. I added a -p 60 to try to force it to wait, but it still immediately exits. Besside works fine, so I'm assuming it's not an injection issue. Any ideas?

Offline cracking not working.

I happened to have an old 2.2.2 version, and when I run wifite with the --crack option, it works fine.

However, when I run it on 2.5.2, it hangs extra long at "Listing captured handshakes", then shows:
Discovered essid "First-ESSID"
Discovered essid "Second-ESSID"
Error: Cannot find BSSID or ESSID in cap file hs/pmkid....

Then it exits with errors. Is this a known issue, or am I doing something wrong?

WPA handshake crack using john fails - not in dictionary, aircrack succeeds with same dictionary

Shoot - crossposting here because I originally posted this in the derv82 branch and realized that's not the version I'm using...

This is intermittent. Sometimes the handshakes are cracked fine with John and sometimes they are not. I see more success with 8 character passwords, and more failures with passwords 9 characters and up. I get 100% success with aircrack instead of john but prefer john for speed.

I'm using Wifite 2.5 on Kali 2020.1 ARM build on Raspberry Pi4, and test passwords contained in the default /usr/share/dict/wordlist-probable.txt file. The cap file I used in the below tests is attached.

(editing to add hcxpcaptool version)

root@kali:~# hcxpcaptool -v
hcxpcaptool 6.0.0 (C) 2020 ZeroBeat

kernel version:

root@kali:~# uname -a
Linux kali 4.19.93-Re4son-v8l+ #1 SMP PREEMPT Tue Jan 7 22:53:24 UTC 2020 aarch64 GNU/Linux

Second edit to add wifi card info:

I've verified the problem on these two cards --
Ralink RT5370
Alfa AWUS036ACH

Collected the handshake with wifite (note pyrit error - I see this on ALL handshakes collected):

[+] (1/1) Starting attacks against A2:2A:A8:81:B0:18 (TEST)
 [+] TEST (72db) WPA Handshake capture: Discovered new client: F4:AF:E7:DE:9E:72                                                        
 [+] TEST (70db) WPA Handshake capture: Captured handshake                                                                              
 [+] saving copy of handshake to hs/handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap saved

 [+] analysis of captured handshake file:
 [+]   tshark: .cap file contains a valid handshake for a2:2a:a8:81:b0:18
 [!]    pyrit: .cap file does not contain a valid handshake
 [+] cowpatty: .cap file contains a valid handshake for (TEST)
 [+] aircrack: .cap file contains a valid handshake for A2:2A:A8:81:B0:18
 [+] Not cracking handshake because skip_atk was used
 [+] Finished attacking 1 target(s), exiting

Attempt to crack with john:

root@kali:~/wpatest# wifite --crack -v
   .               .    
 .  ·  .     .  ·  `.  wifite2 2.5.0
 :  :  :  (¯)  :  :  :  an automated wireless auditor forked from @derv82
 `.  ·  ` /¯\   ·  .  https://github.com/kimocoder/wifite2
   `     /¯¯¯\         

 [+] option: verbosity level 1
 [!] Warning: Recommended app hashcat was not found. install @ https://hashcat.net/hashcat/

 [+] Listing captured handshakes from /root/wpatest/hs:

  NUM  ESSID (truncated)  BSSID              TYPE   DATE CAPTURED
  ---  -----------------  -----------------  -----  -------------------
    1  TEST               A2:2A:A8:81:B0:18  4-WAY  2020-01-31 20:30:58
 [+] Select handshake(s) to crack (1-1, select multiple with , or - or all): 1
                                                                                                                                                                                                                                           
 [!] Unavailable tools (install to enable):
     * hashcat (hashcat)

 [+] Enter the cracking tool to use (aircrack, john, cowpatty): john
                                                                                                                                                                                                                                           
 [+] Cracking 4-Way Handshake TEST (A2:2A:A8:81:B0:18)
 [+] Running: hcxpcaptool -j /tmp/wifiteil1nxn6l/generated.john hs/handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap
 [+] Running: john --format=wpapsk --wordlist /usr/share/dict/wordlist-probable.txt /tmp/wifiteil1nxn6l/generated.john
 [+] Running: john --show /tmp/wifiteil1nxn6l/generated.john
 [!] Failed to crack TEST (A2:2A:A8:81:B0:18): Passphrase not in dictionary

Attempt to manually convert and crack with hcxpcaptool and john

root@kali:~/wpatest# hcxpcaptool -j generated.john hs/handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap 

reading from handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap
failed to read pcap packet header for packet 1732
                                                
summary capture file:                           
---------------------
file name........................: handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap
file type........................: pcap 2.4
file hardware information........: unknown
capture device vendor information: 000000
file os information..............: unknown
file application information.....: unknown (no custom options)
network type.....................: DLT_IEEE802_11 (105)
endianness.......................: little endian
read errors......................: yes
minimum time stamp...............: 31.01.2020 20:30:30 (GMT)
maximum time stamp...............: 31.01.2020 20:30:57 (GMT)
packets inside...................: 1732
skipped damaged packets..........: 0
packets with GPS NMEA data.......: 0
packets with GPS data (JSON old).: 0
packets with FCS.................: 0
beacons (total)..................: 1
probe responses..................: 42
reassociation requests...........: 2
authentications (OPEN SYSTEM)....: 3
authentications (APPLE)..........: 1
deauthentications................: 473
action packets...................: 6
EAPOL packets (total)............: 4
EAPOL packets (WPA2).............: 4
best handshakes (total)..........: 1 (ap-less: 0)

summary output file(s):
-----------------------
1 handshake(s) written to generated.john
message pair M12E2...............: 1

root@kali:~/wpatest# john --format=wpapsk --wordlist /usr/share/dict/wordlist-probable.txt generated.john 
Using default input encoding: UTF-8
Loaded 1 password hash (wpapsk, WPA/WPA2/PMF/PMKID PSK [PBKDF2-SHA1 128/128 ASIMD 4x])
Cost 1 (key version [0:PMKID 1:WPA 2:WPA2 3:802.11w]) is 2 for all loaded hashes
Will run 4 OpenMP threads
Note: Minimum length forced to 2 by format
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:02 DONE (2020-01-31 20:33) 0g/s 1340p/s 1340c/s 1340C/s nicarao..sss
Session completed
root@kali:~/wpatest# john --show generated.john 
0 password hashes cracked, 1 left

Finally, attempt to crack the same handshake with aircrack (this took 6 minutes!)

root@kali:~/wpatest# wifite --crack -v
   .               .    
 .  ·  .     .  ·  `.  wifite2 2.5.0
 :  :  :  (¯)  :  :  :  an automated wireless auditor forked from @derv82
 `.  ·  ` /¯\   ·  .  https://github.com/kimocoder/wifite2
   `     /¯¯¯\         

 [+] option: verbosity level 1
 [!] Warning: Recommended app hashcat was not found. install @ https://hashcat.net/hashcat/

 [+] Listing captured handshakes from /root/wpatest/hs:

  NUM  ESSID (truncated)  BSSID              TYPE   DATE CAPTURED
  ---  -----------------  -----------------  -----  -------------------
    1  TEST               A2:2A:A8:81:B0:18  4-WAY  2020-01-31 20:30:58
 [+] Select handshake(s) to crack (1-1, select multiple with , or - or all): 1
                                                                                                                                        
 [!] Unavailable tools (install to enable):
     * hashcat (hashcat)

 [+] Enter the cracking tool to use (aircrack, john, cowpatty): aircrack
                                                                                                                                        
 [+] Cracking 4-Way Handshake TEST (A2:2A:A8:81:B0:18)
 [+] Running: aircrack-ng -a 2 -w /usr/share/dict/wordlist-probable.txt --bssid A2:2A:A8:81:B0:18 -l /tmp/wifitervcl804r/wpakey.txt hs/handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap                                                                                 
 [+] Cracking WPA Handshake: 87.74% ETA: 45s @ 548.7kps (current key: odontoglossate)                                                   
 [+] Cracked TEST (A2:2A:A8:81:B0:18). Key: "password123456"
 [+] saved crack result to cracked.txt (2 total)
root@kali:~/wpatest#

handshake_TEST_A2-2A-A8-81-B0-18_2020-01-31T20-30-58.cap.gz

Errors on Arch or Manjaro

Hi,
I installed it on manjaro from AUR and it is given the following output

`[+] enabling monitor mode on wlp6s0... enabled wlp6s0mon

[+] Scanning. Found 0 target(s), 0 client(s). Ctrl+C when ready

[!] Error: [Errno 2] No such file or directory: 'tshark'

[!] Full stack trace below

[!] Traceback (most recent call last):

[!] File "/usr/share/wifite2/wifite/main.py", line 93, in entry_point

[!] wifite.start()

[!] File "/usr/share/wifite2/wifite/main.py", line 54, in start

[!] self.scan_and_attack()

[!] File "/usr/share/wifite2/wifite/main.py", line 78, in scan_and_attack [!] s = Scanner()

[!] File "/usr/share/wifite2/wifite/util/scanner.py", line 42, in init

[!] self.targets = airodump.get_targets(old_targets=self.targets)

[!] File "/usr/share/wifite2/wifite/tools/airodump.py", line 163, in get_targets [!] Tshark.check_for_wps_and_update_targets(capfile, targets)

[!] File "/usr/share/wifite2/wifite/tools/tshark.py", line 177, in check_for_wps_and_update_targets [!] p = Process(command)

[!] File "/usr/share/wifite2/wifite/util/process.py", line 89, in init

[!] self.pid = Popen(command, stdout=sout, stderr=serr, stdin=stdin, cwd=cwd, bufsize=bufsize)

[!] File "/usr/lib/python3.8/subprocess.py", line 854, in init

[!] self._execute_child(args, executable, preexec_fn, close_fds,

[!] File "/usr/lib/python3.8/subprocess.py", line 1702, in _execute_child [!] raise child_exception_type(errno_num, err_msg, err_filename)

[!] FileNotFoundError: [Errno 2] No such file or directory: 'tshark'

[!] Exiting

[!] Note: Leaving interface in Monitor Mode! [!] To disable Monitor Mode when finished: airmon-ng stop wlp6s0mon`

john doesn't find passphrase, aircrack does

running wifite --crack --dict /tmp/dictsome1 on some network with saved handshake, while dictsome1 contains correct key.

choosing john the passphrase is not found while choosing aircrack does find it.

worth mentioning, if I pick even a 1GB wordlist, john will run for about 5-10 minutes before quitting without the key, while aircrack reports estimated time of ~40hours.

Error if SSID with "space" and "dot (.)" in name

If SSID have a space " " or un dot "." in name, the file in hs, no generate the same name of SSID and parameter in cowpatty -s is no correct.
For example.
image

image

image

The parameter "-s" is not correct.
image

image

You maybe fix this code:
image

in wifite/util/crack.py

WPA Hanshake Fails

Cannot detect WPA handshake and loop for deauth for 300s and fails to capture handshake.

Use the standard oui.txt file?

Hi,
In Debian we prefer to have just one copy of files / data files like the oui.txt.
We have the package ieee-data that provides the oui.txt file.

You provide a ieee-oui.txt file that is not exactly the same as the one installed by Debian but provides same information.
Is it possible to find a way to use this file maybe if ieee-data.txt is not found?

Thanks

Wifite on Nexus 5

I'm having problems getting wifite working on a Nexus 5 using the internal Wifi and nexmon.
if I open a Kali terminal window, and enter:

source monstart-nh
wifite

I get the 'Too many values to unpack" errors, which usually indicates Nexmon is injecting extra text. I tried recompiling the latest libfakeioctlkali.so, but got a ton of errors.

If I try opening the 'wlan1 Monitor UP' window in Custom Commands, and then run wifite -i wlan1, it simply exits immediately after 'Scanning. found 0 targets...', with 'Error. No targets found'

Any ideas what I'm doing wrong?

Skip some ESSIDs

May I do a feature request?

It would be nice if a special .skiplist file exists that has lines like:

ESSID_1
ESSID_2
...
ESSID_n

Timeout value problem

First of all, thanks for your work, this is currently the only working wifite version I can find on oneplus7 + nethunter. I found a small problem, Perhaps these two parameters will conflict. When the "--num-deauths" setting is large, the timeout setting is obviously too short.When the signal is poor, sometimes it needs to send multiple times to get valid results. Perhaps should allow people to customize this "timeout" value.

"timeout=2"
file: https://github.com/kimocoder/wifite2/blob/master/wifite/tools/aireplay.py#L388

"--num-deauths"
file: https://github.com/kimocoder/wifite2/blob/master/wifite/args.py#L180

Cracked ESSID names are fixed in cracked.txt

The cracked SSID 's ESSID is taken from the hs/filename. This omits spaces, hyphens, dashes and some special characters. It should be taken from the captured handshake I guess.

Can't recover PSK with PIN using Bully

When I run Wifite, with or without the --reaver option, I get to my AP, it cracks the PIN, then tries to recover the PSK, using Bully. It always hangs there. If I take the PIN and run it through Reaver, it recovers the PSK. As far as I know, Bully doesn't have the ability to recover the PSK from the PIN anymore.
The message I'm seeing:

[+] (27/30) Starting attacks against 12:34:56:78:90:FF (My_SSID)
[+] My_SSID (34db) WPS Pixie-Dust: [4m39s] Cracked WPS PIN: 12345678
[+] My_SSID (34db) WPS Pixie-Dust: [4m39s] Retrieving PSK using bully ...
And it sits here forever.
Yes, I changed my PIN, PSK, SSID, and MAC.

Tagged release?

Hi,
We would like to package the latest version in Debian / Kali with the fixes and Python 3 compatibility.
Could you make a tagged release? It's easier for packager to use that.
Thanks

Feature Request for --WPS-off

Hello kimocoder

Firstly thank you very much for making and sharing wifite, I have found wifite very useful over many months.

I would like to make a feature request if that's ok. Would you please consider allowing the user to disable all WPS attacks, perhaps a switch like --wps-off?

I ask this because wifite is great for making a quick capture for testing purposes but having to ctrl c through pixie, Null and pin attacks each time is very time consuming.

I notice you have provided a PMKID off option which is very helpful. (Small bug report, when the user disables PMKID attack wifite reports there are the same number of attacks left despite PMKID being disabled).

To be honest I have not discovered a router vulnerable to WPS attacks for a VERY long time now anyway.

I hope you will consider my request and hopefully think it ok to add it to wifite.

Thanks again for your work.

sudo wifite after install

sudo wifite
Traceback (most recent call last):
File "/usr/sbin/wifite", line 11, in
load_entry_point('wifite==2.5.7', 'console_scripts', 'wifite')()
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 489, in load_entry_point
return get_distribution(dist).load_entry_point(group, name)
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2793, in load_entry_point
return ep.load()
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2411, in load
return self.resolve()
File "/usr/lib/python3/dist-packages/pkg_resources/init.py", line 2417, in resolve
module = import(self.module_name, fromlist=['name'], level=0)
ModuleNotFoundError: No module named 'wifite.wifite'

Error after selecting targets

[!] Error: 'int' object has no attribute 'split'

[!] Full stack trace below

[!] Traceback (most recent call last):
[!] File "/usr/bin/wifite2/wifite/main.py", line 97, in entry_point
[!] wifite.start()
[!] File "/usr/bin/wifite2/wifite/main.py", line 52, in start
[!] self.scan_and_attack()
[!] File "/usr/bin/wifite2/wifite/main.py", line 77, in scan_and_attack
[!] targets = s.select_targets()
[!] File "/usr/bin/wifite2/wifite/util/scanner.py", line 260, in select_targets
[!] for choice in input().split(','):
[!] AttributeError: 'int' object has no attribute 'split'

[!] Exiting

checked with wifite 2.2.5 and it works okay there. just loss access to hcxpcaptool

OS: kali, with latest updates
Device: raspberry pi 4
Device URL: https://www.amazon.co.uk/Network-AWUS036NHA-Adapter-150-Mbps-802-11b/dp/B004Y6MIXS/ref=sr_1_1?dchild=1&keywords=Alfa+AWUS036NHA&qid=1619550112&sr=8-1

Scans good but attacking sucks..

Dear @kimocoder
running program using this command:
wifite -i wlan0
airodump works, but attacking sucks in reaver and pmkid captures.
sketch-1585164030152
sketch-1585164136426
sketch-1585164174626

So you see, it got lots of timeouts errors..
I patch BCM43455 using nexmon, patched kernel kali nethunter for my device.
My kernel:

Linux version 3.10.84suzuran-nethunter-1.0-xxxxxx-dirty (root@kali) (gcc version 4.9.4 20151028 (prerelease) (Linaro GCC 4.9-2016.02) ) xx SMP PREEMPT xxx xxx 4 xx:xx:xx UTC xxxx

Problem wifite2 nethunter nexus 6p

Hello, in wifite2 with nexus6p monitor mode I have problems with deauthentication and capping the handshake, outside of wifite it does it correctly, by terminal it works Kali Chroot or AndroidSU
Thanks for your time.
sorry my bad English

The option to include 5ghz networks "-5" and "--5ghz" is wrong

The help menu says ..
"-5, --5ghz Include 5Ghz channels (default: off)"

But the option only shows 5ghz networks and not 2.4ghz networks.
My suggestion we add both 2.4ghz and 5ghz networks as a standard and make a "--5ghz" and "--2.4ghz" option instead or something 👍

WPS attacks being run against networks listed with "no" WPS support

Hello,

I guess first - is this normal behavior ? I don't remember older versions of wifite ever doing this. When I have my scan complete, there are some networks as "yes" for WPS and some for "no". wifite runs all the WPS attacks against the ones listed as "no" as well. If this isn't intentional - seems like broken detection.

PS: No idea if this is related to #35 or not.

PPS: I'm running this on the latest Kali (2020.3), all updated. I've tried with both the Kali wifite (which is yours) as well as a git clone today. Same behavior. I'm using an Alfa AWUS036ACH (rtl8812au driver). All of the other attacks I've tried seem to work (WEP ARP replay, WPS Pixie, PMKID, Handshake...). It's just the networks flagged as no WPS are still getting those attacks so I have to ctrl-c through them all.

Thanks.

[!] Error: type object 'Airmon' has no attribute 'start'

`
[!] Error: type object 'Airmon' has no attribute 'start'

[!] Full stack trace below

[!] Traceback (most recent call last):
[!] File "/usr/local/lib/python3.7/dist-packages/wifite/main.py", line 98, in entry_point
[!] wifite.start()
[!] File "/usr/local/lib/python3.7/dist-packages/wifite/main.py", line 51, in start
[!] Configuration.get_monitor_mode_interface()
[!] File "/usr/local/lib/python3.7/dist-packages/wifite/config.py", line 155, in get_monitor_mode_interface
[!] cls.interface = Airmon.ask()
[!] File "/usr/local/lib/python3.7/dist-packages/wifite/tools/airmon.py", line 237, in ask
[!] iface.interface = Airmon.start(iface)
[!] AttributeError: type object 'Airmon' has no attribute 'start'
`

PMKID in pcap or pcapng

Please add an option to output PMKID in pcap or pcapng format, so you can convert PMKID with wpapcap2john (which dont support 16800 as input), so you can crack PMKID with JTR. Thanks!

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.