derv82 / wifite2

Rewrite of the popular wireless network auditor, "wifite"
GNU General Public License v2.0
6.36k stars 1.3k forks source link

Pmkid function #144

Open usaflees opened 6 years ago

usaflees commented 6 years ago

Hello awesome developers of this marvelous tool, I am very grateful you decided to continue this awesome program and continue to do so! I have a quick question about t he PMKID capture option. I installed the libraries neccessary to operate correctly, but I have yet to be able to successfully capture any PMKID handshakes. I have tried running it solely in this mode and also extending the timeout to 360 seconds but haven't had any luck. Are there any tips or tricks you could teach me that could increase the success? I have also tried targeting specific ssids without luck. Thanks again for your continued work on this program!

Mirdinus commented 6 years ago

Hey, how many networks did you tried ? Not every network is sending the necessary data for this kind of testing. You problem might be caused by updated firmware on the testing network.

nbctcp commented 5 years ago

I got this error when using pmkid TypeError: expected string or buffer

wifite

. . .´ · . . · . wifite 2.2.5 : : : (¯) : : : automated wireless auditor . · /¯\ ´ · .´ https://github.com/derv82/wifite2 /¯¯¯\ ´

[+] Using wlan0mon already in monitor mode

NUM ESSID CH ENCR POWER WPS? CLIENT


 1       (E4:8D:8C:41:CA:E1)     7   WPA   59db    no    1

[+] select target(s) (1-2) separated by commas, dashes or all: 1

[+] (1/1) Starting attacks against E4:8D:8C:41:CA:E1 (ESSID unknown) [+] unknown (59db) PMKID CAPTURE: Captured PMKID [!] Error: expected string or buffer

[!] Full stack trace below

[!] Traceback (most recent call last): [!] File "/usr/local/lib/python2.7/dist-packages/wifite/attack/all.py", line 86, in attack_single [!] result = attack.run() [!] File "/usr/local/lib/python2.7/dist-packages/wifite/attack/pmkid.py", line 88, in run [!] pmkid_file = self.capture_pmkid() [!] File "/usr/local/lib/python2.7/dist-packages/wifite/attack/pmkid.py", line 139, in capture_pmkid [!] pmkid_file = self.save_pmkid(pmkid_hash) [!] File "/usr/local/lib/python2.7/dist-packages/wifite/attack/pmkid.py", line 201, in save_pmkid [!] essid_safe = re.sub('[^a-zA-Z0-9]', '', self.target.essid) [!] File "/usr/lib/python2.7/re.py", line 155, in sub [!] return _compile(pattern, flags).sub(repl, string, count) [!] TypeError: expected string or buffer

RaduNico commented 5 years ago

This is caused by the fact that the ESSID, the name of the Wifi, is not known. Wifite should usually decloak (find the name of the network) automatically if you let it run for a while. Wifite not decloaking an access point could mean a few things

Wifite crashing because it does not know the name of the network should not happen nevertheless, I can create a bugfix for this later this week.

nbctcp commented 5 years ago

This is caused by the fact that the ESSID, the name of the Wifi, is not known. Wifite should usually decloak (find the name of the network) automatically if you let it run for a while. Wifite not decloaking an access point could mean a few things

  • you are not letting it scan for long enough, it should however happen pretty fast (some 5-10 seconds)
  • your wifi card might not be injection capable. I am not very sure how wifite runs in case a wifi card is capable of using monitor mode, but is not capable of injection. If Wifite is not checking for injection capabilities, I think it should. You could manually test by running aireplay -9 wlan0mon, after putting the network card in monitor mode. It should output: 09:18:04 Trying broadcast probe requests... 09:18:04 Injection is working! After this it will try to send some directed probe requests to nearby access point, you can stop it.

Wifite crashing because it does not know the name of the network should not happen nevertheless, I can create a bugfix for this later this week.

Actually this caused by hidden AP, that's why only mac address appeared. When I test with non hidden AP, pmkid work perfectly after around 1 minute Hope you can add feature to attack hidden AP tq