CyberCode Academy

Course 14 - Wi-Fi Pentesting | Episode 4: Cracking WEP Encryption: Gaining Network Access

Listen Later
In this lesson, you’ll learn about:
  • What WEP encryption is and why it is weak
  • How the RC4 algorithm is used (and broken) in WEP
  • How Initialization Vectors (IVs) cause WEP to fail
  • Capturing WEP traffic using Airodump-ng
  • Cracking WEP keys using Aircrack-ng
  • Speeding up WEP cracking on idle networks
  • Using fake authentication and packet injection
  • Preparing for post-connection attacks after cracking WEP
Cracking WEP Encryption Why WEP Is Weak WEP (Wired Equivalent Privacy) is an old Wi-Fi encryption method that uses:
  • RC4 encryption algorithm
  • A shared secret key for encryption and decryption
How WEP works:
  • The access point generates a 24-bit Initialization Vector (IV)
  • The IV is combined with the network password
  • Together they generate a keystream
  • This keystream encrypts the packets
  • The IV is sent in plain text with every encrypted packet
Why this is dangerous:
  • A 24-bit IV is very small
  • On busy networks:
    • IVs repeat very quickly
  • Repeated IVs allow:
    • Statistical attacks
    • Tools like Aircrack-ng to recover the keystream
    • The WEP password to be cracked
Cracking WEP in Practice The attack process consists of two main stages: 1. Capturing Data (IV Collection)
  • Use Airodump-ng to capture packets
  • Packets are saved into a capture file
  • The “data” counter represents:
    • The number of unique IVs collected
  • The higher the data count:
    • The higher the success rate
  • On busy networks:
    • IVs increase very fast
    • Cracking can take only minutes
2. Cracking the Key
  • Use Aircrack-ng on the captured file
  • Aircrack-ng performs:
    • Statistical analysis
    • RC4 weaknesses exploitation
  • Once the key is recovered:
    • You can connect to the network
    • You gain full network access
Handling Idle Networks If the network is not busy:
  • IV collection becomes extremely slow
  • Cracking may take many hours or longer
To solve this, attackers force packet generation 1. Fake Authentication (Association) Before injecting packets, the attacker must:
  • Associate with the target network
  • Association means:
    • The access point accepts your device
    • Even though you are not fully connected
This is done using:
  • aireplay-ng fake authentication attack
  • This tells the access point:
    • “I am a valid client”
Association is required so:
  • The access point does not ignore injected packets
2. Packet Injection After successful association:
  • The attacker injects packets into the network
  • This forces the access point to:
    • Generate large numbers of new packets
    • Create new IVs very quickly
  • The IV count rises:
    • From a few hundred
    • To tens of thousands in minutes
  • This allows:
    • Very fast WEP cracking
    • Even on a completely idle network
After Cracking the Key Once the WEP key is recovered:
  • You can:
    • Connect to the Wi-Fi network normally
    • Intercept traffic
    • Gather sensitive information
    • Perform man-in-the-middle attacks
    • Modify data in transit
  • This prepares you for:
    • All post-connection attacks
    • Covered in later lessons


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy