{"action":"created","issue":{"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/651","repository_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration","labels_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/651/labels{/name}","comments_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/651/comments","events_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/651/events","html_url":"https://github.com/jbenden/aircrack-ng-migration/issues/651","id":297941083,"number":651,"title":"aircrack-ng/airodump-ng  WPA/WPA2 handshake bug","user":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"labels":[{"id":839245116,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/%23aircrack-ng","name":"#aircrack-ng","color":"0000aa","default":false},{"id":839245322,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/@major","name":"@major","color":"f6f6f6","default":false},{"id":839242827,"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/labels/bug","name":"bug","color":"d73a4a","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/milestones/9","html_url":"https://github.com/jbenden/aircrack-ng-migration/milestone/9","labels_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/milestones/9/labels","id":3122450,"number":9,"title":"1.2","description":"  * ~~Improve cracking speed~~\r\n  * ~~Phase out old airmon-ng in favor of airmon-zc~~\r\n  * ~~Support recent version of GPSd (with JSON)~~\r\n  * ~~Improve building code and testing~~\r\n  * ~~Support libnl~~\r\n  * ~~Radiotap fixes (causing wrong channel displayed)~~\r\n  * ~~Airbase-ng fixes and improvements~~\r\n  * Autotools\r\n  * Hashcat output (HCCAPx)","creator":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":9,"state":"open","created_at":"2018-02-16T15:18:39Z","updated_at":"2018-02-16T22:34:47Z","due_on":null,"closed_at":null},"comments":10,"created_at":"2018-02-16T22:34:39Z","updated_at":"2018-02-16T22:34:57Z","closed_at":null,"author_association":"OWNER","body":"**Reported by darkAudax on 11 Jul 2009 18:55 UTC**\n\nThis came out my investigation for the following thread:\nhttp://tinyshell.be/aircrackng/forum/index.php?topic=4054\n\nJano sent me some files which were not working with aircrack-ng.  Basically aircrack-ng would fail to find the passphrase even though it was in the password file.  I am sending you this by e-mail instead of posting to the trac system because Jano does not want the capture files to be public.\n\nHis e-mail and files are at the end.  I am also including my \"fixed\" file:  alice.fixed4.cap  I simply selected two correct handshake packets.  The PSK is \"ulwnbe5izzpx06zmxgk2zvgj\".  \n\nBasically the root problem is that aircrack-ng fails to properly select handshake packets when there are lots of bits and pieces of handshakes in the capture.  I looked at the source code to see how it selects the handshake.  I have documented this below plus documented what I think the criteria should be.  Please see if you agree.  If you do agree then aircrack-ng plus airodump-ng would need to be updated.\n\nCurrently how EAPOL packets are determined:\n\nPacket 1\nPairwise Key = 1, Install = 0, ACK = 1, MIC = 0\n\nPacket 2\nPairwise Key = 1, Install = 0, ACK = 0, MIC = 0\n\nPacket 3\nPairwise Key = 1, Install = 1, ACK = 1, MIC = 1\n\nPacket 4\nPairwise Key = 1, Install = 0, ACK = 1, MIC = 0\nNOTE: In the aircrack-ng code, packets 2 and 4 are grouped together.\n\n\nHere is the revised criteria:\nPacket 1\nPairwise Key = 1, Install = 0, ACK = 1, MIC = 0\n\nPacket 2\nPairwise Key = 1, Install = 0, ACK = 0, MIC = 0\nPlus it has (Vendor Specific: WPA Tag number 22) or (RSN Information Tag number 48).  IE WPA or WPA2.\n\nPacket 3\nPairwise Key = 1, Install = 1, ACK = 1, MIC = 1\n\nPacket 4\nPairwise Key = 1, Install = 0, ACK = 1, MIC = 0\nPlus it has no tags, unlike packet 2 which does have tags.\n\nValid combinations are packets 2/3 or packets 3/4.\n\nHere is additional criteria to be added:\n\nWhen it is packet 2/3 then:\nReplay counter field must be consecutive.  Examples: 0/1, 23/24, 67/68.\n\nWhen it is packet 3/4 then:\nReplay counter field must have the same value.\n\nAdditionally, the frame numbers for both packets 2/3 and 3/4 should be fairly close to each other.  Possibly have an additional criteria that require the frame numbers to be within say 20 of each other.  Normally they would be very, very close.  However, if the network is busy then maybe they could be further apart.\n\nSome personal notes which cannot be used in programming:\nWPA / WPA2\n\nPacket 1\nKey Information: 0x89 / 0x8A\n\nPacket 2\nKey Information: 0x109 / 0x10A\n\nPacket 3\nKey information: 0x1C9 / 0x13CA\n\nPacket 4\nKey information: 0x109 / 0x30A\n\n++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++\nE-MAIL from Jano:\n\n- This is the files, i tested with reduced .cap file, but i have the same result\n- Thanks for attention\n\nJano\n\njano:~/Pentest/cowpatty$ ./cowpatty -r Alice_reduced.cap -f dict -s Alice-93689788\ncowpatty 4.3 - WPA-PSK dictionary attack. \n\nCollected all necessary data to mount crack against WPA/PSK passphrase.\nStarting dictionary attack. Please be patient.\nkey no. 1000: appointment\nkey no. 2000: canonize\nkey no. 3000: contraceptive\nkey no. 4000: division\n\nThe PSK is \"ulwnbe5izzpx06zmxgk2zvgj\".\n\n4092 passphrases tested in 77.15 seconds: 53.04 passphrases/second\n___________________________________________________________________________________\n\njano:~/Pentest/cowpatty$ ./cowpatty -n -r Alice_reduced.cap -f dict -s Alice-93689788\ncowpatty 4.3 - WPA-PSK dictionary attack. \n\nCollected all necessary data to mount crack against WPA/PSK passphrase.\nStarting dictionary attack. Please be patient.\nkey no. 1000: appointment\nkey no. 2000: canonize\nkey no. 3000: contraceptive\nkey no. 4000: division\nUnable to identify the PSK from the dictionary file. Try expanding your\npassphrase list, and double-check the SSID. Sorry it didn't work out.\n\n4092 passphrases tested in 74.08 seconds: 55.24 passphrases/second\n____________________________________________________________________________________\n\njano:~/Pentest/cowpatty$ aircrack-ng -w Dict_Alice_not_found.txt Alice_reduced.cap\nOpening Alice_reduced.cap\nRead 18 packets.\n\n # BSSID ESSID Encryption\n\n 1 00:1C:A2:D6:D3:84 Alice-93689788 WPA (1 handshake)\n\nChoosing first network as target.\n\nOpening Alice_reduced.cap\nReading packets, please wait...\n\n Aircrack-ng 1.0 rc2 aircrack-ng/aircrack-ng@\n\n\n [00:00:04] 1616 keys tested (325.25 k/s)\n\n\n Current passphrase: osahm6ezxmcvzfiq2pcs5vz0 \n\n\nMigrated-From: https://trac.aircrack-ng.org/ticket/651"},"comment":{"url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/comments/366378397","html_url":"https://github.com/jbenden/aircrack-ng-migration/issues/651#issuecomment-366378397","issue_url":"https://api.github.com/repos/jbenden/aircrack-ng-migration/issues/651","id":366378397,"user":{"login":"jbenden","id":73767,"avatar_url":"https://avatars3.githubusercontent.com/u/73767?v=4","gravatar_id":"","url":"https://api.github.com/users/jbenden","html_url":"https://github.com/jbenden","followers_url":"https://api.github.com/users/jbenden/followers","following_url":"https://api.github.com/users/jbenden/following{/other_user}","gists_url":"https://api.github.com/users/jbenden/gists{/gist_id}","starred_url":"https://api.github.com/users/jbenden/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jbenden/subscriptions","organizations_url":"https://api.github.com/users/jbenden/orgs","repos_url":"https://api.github.com/users/jbenden/repos","events_url":"https://api.github.com/users/jbenden/events{/privacy}","received_events_url":"https://api.github.com/users/jbenden/received_events","type":"User","site_admin":false},"created_at":"2018-02-16T22:34:57Z","updated_at":"2018-02-16T22:34:57Z","author_association":"OWNER","body":"**Comment by latinsud on 11 Jul 2009 18:55 UTC**\n\nshould wpa cleaning be merged somehow into aircrack-ng ?"}}
{"actor":{"display_login":"jbenden"}}