WEP Cracking Basics

Understanding the Process of Ethical WEP Security Assessment

Introduction to WEP Cracking

Wired Equivalent Privacy (WEP) was one of the first security protocols developed for WiFi networks. Despite its intended purpose, WEP has significant security vulnerabilities that ethical hackers should understand to properly assess network security.

Educational Note: This content is provided for educational purposes only. Performing these techniques on networks without explicit permission is illegal and unethical. Always practice in controlled, authorized environments.

To crack WEP encryption, we need to capture a large number of packets containing different Initialization Vectors (IVs). Due to their short length, IVs will eventually repeat, creating a statistical vulnerability that tools like aircrack-ng can exploit to recover the encryption key.

WEP Cracking Process Overview

The WEP Cracking Process

1

Preparation - Monitor Mode

First, ensure your wireless adapter is in monitor mode. This allows you to capture packets without being associated with any network.

airmon-ng start wlan0

This creates a monitoring interface (typically named mon0) that we'll use for capturing traffic.

2

Network Discovery

Run airodump-ng to discover WEP networks in range:

airodump-ng mon0

Look for networks with "WEP" listed in the encryption column. Note the BSSID (MAC address) and channel of your target network.

3

Targeted Packet Capture

Focus your capture on the specific target network to collect IVs:

airodump-ng --bssid [TARGET_BSSID] --channel [CHANNEL] --write basic_wep mon0

Replace [TARGET_BSSID] with the MAC address of the target and [CHANNEL] with the channel number.

The captured data will be saved to files with the prefix "basic_wep".

4

Monitoring Data Collection

Watch the "Data" column in airodump-ng. This shows the number of useful packets (containing IVs) you've captured. For successful cracking, you typically need:

  • 64-bit WEP: ~20,000-50,000 IVs
  • 128-bit WEP: ~40,000-85,000 IVs

On a busy network, this number increases rapidly. If not, additional techniques may be needed (covered in advanced topics).

5

Cracking the WEP Key

Once you've captured sufficient data, use aircrack-ng to recover the WEP key:

aircrack-ng basic_wep-01.cap

If successful, aircrack-ng will display the key in both hexadecimal and ASCII format (if possible).

WEP Vulnerability Visualization

Using the Recovered Key

After recovering the WEP key, you can connect to the network using either:

ASCII Password

If aircrack-ng provides an ASCII representation, you can use it directly in network connection dialogs.

Hexadecimal Key

For the hexadecimal key:

  1. Copy the key displayed by aircrack-ng
  2. Remove all colons between the numbers
  3. Use this clean hexadecimal string as the key when connecting

Potential Issues

If you attempt to connect from the same machine running monitor mode, you may encounter connection issues. This happens because monitor mode disables normal network functionality. Consider these options:

Key Takeaways