Welcome back.
So we have cracked the password with our air crack tool, we noticed that the speed was around three
to four hundred keys or passwords per second.
We saw that it works once we added the correct password to our file.
And we also saw some of the other options, such as time left, the percentage and the amount of passwords
that have been tested.
But right now, let's see how we can crack the password even faster using the hash get to.
So let me clear the screen from the previous video.
And what I got on my desktop right now is I got the rock you the text password list and I got the rock
you with our correct password.
Now, these are the two exact same lists from the previous video.
Just this one contains the correct password for our wireless access point.
We're going to run the first one first just to see the speed that we get and whether it is any faster
than with our aircraft at all, and then just to prove that it works, we're going to run this list
the next.
So let's get straight into it to run the hash cut health menu, you can simply just type Haskett and
to get even more options onto how you can use Haskett, you can type Haskett and then dash, dash help.
And here is the help menu down here.
We got some basic examples of how we can use hash and if I scroll a little bit up here.
We can see all of our available options and you might be asking what was the thing that was scrolling
through so much?
Well, these are just different types, password dashes that you can track.
You have one shot, two shot, five hundred twelve.
You got get çok, you got sparse, you got five different types of empty, five hashes with salt without
salt.
That goes for Shabaan as well.
And for any other password list that we can find.
Now you might be wondering, well which one are we going to use in our case we want to find the WPA
pass Firtash and it will be under these network protocols.
And if I go right here, here it is.
We want to use the WPA people, PBC, KDAF to and this has a code of two five hundred.
Remember that, because that is the number that we are going to specify in our command.
And up here we got something under the Dash eight option, which is called the attack mode.
And you simply just specify dash a and then different attack mode down here at the lower part of the
health menu we get which attack modes have.
Let me just find where it is.
I believe it's somewhere around here and here at this.
I believe these are the attack modes.
So we got dilo, which is specified with zero, even though it says one right here, the low attack
mode is specified with zero and the four, which is nightmare, is specified with dash a three.
Now we're going to be running the lowest attack mode just so we can see how the total works.
So the first thing that we must do is we must type hash cat dash eight and then the attack mode.
We are going to use that lowest one, which is zero, and then dash them for the password.
Hash remembered code for the WPA password hash is going to be two five oh oh.
After that comes our cap file, but if you were to try to run this program with our dot cap file, it
would not work.
Hashmat works with different cap faults.
We must convert this cap file to X, C, cap X.
How can we do that?
Well, we do not have any tool that we can use in our clinic, so we must go and do that online.
What I'm going to do is I'm going to open up my Firefox and I'm just going to search for cap to XY cap
x converter.
Let's wait for this to open, open a new tab and type cap to XY cap and then X Press enter.
The proxies are refusing connections, this could be due to our berp suit being the proxy, so we're
just going to remove it real quick instead of actually opening it.
I'm just going to go to network settings and click right here.
No proxy, great novel.
Refresh this page and I'm going to go to this first link right here, which is picked up and kept file
convertor to exi cap ex.
Let's click on that.
Let's select our file, I will click on Browse.
And I will find my daughter Capful, here it is, will select that one and I will click on upload.
This will upload the file for me, and as soon as it finishes, I should be able to download the XY
cap ex file that we can use with our hash, get to it.
So let's wait for this to finish.
And here it is.
I can click down here, download my file, and I want to save my file.
It will be under here in the download section, as we can see, it has some weird name nonetheless.
Let's go to our desktop for that.
I'm going to open another terminal, navigate to downloads, and I'm going to copy our exit cap ex file
to Mr. Hacker and then desktop.
Then I can exit this out.
And the next thing that we specify right here is that file.
So I believe it is called like this.
You can rename it if you want to.
I'm just going to leave it with this long name.
And the last parameter to this function is going to be the word list that we're going to use in our
case.
This is going to be RockYou Dot the first.
This is the list without our password.
So let's go through the options once again.
The attack mode is going to be the lowest.
The dash and option specifies which password are cracking.
We're cracking a password, so we specify two five oh oh.
Then we specified our capful that is converted for hash cat and the last thing we specify is the password
list.
So I'm going to run this.
It will tell me that this has been started, it will initialise this back and runtime for our device
one and it will probably start brute force with my CPU.
And the reason it does that is probably because we are running these sort of virtual machines so it
can only detect the CPU.
However, even with CPU cracking, we should still get faster cracking time.
Then with air crack, all we need to do is we need to wait for this to finish.
And as soon as that's done, we should start cracking the password.
And here it is.
It started cracking the password.
It will not write anything right here.
However, if we type as for status, we can check out what progress it currently has so we can see some
information right here.
And any time you press, as you will see the current progress of this cracking of the password.
It will tell us which file are we using to crack, which hash name are we using?
The progress and the speed is down here.
It says six hundred hashes per second and this is equal to six hundred passwords per second.
So we can see it is almost double the amount that we had with our crack down here.
We can see the progress as to what amount of passwords have recovered from 14 million passwords that
we have inside of our program.
And we can see we already passed 100000 passwords in the candidates.
It tells you between which passwords it is currently at.
Now, you can wait for this to finish.
However, even though it is currently at one percent, we're not going to be waiting for all of this
to finish.
It would take hours.
We're just going to quit this with queue comment and then we're going to run the same comment just with
our correct file.
So I'm going to use RockYou with password data and I'm going to run this once again.
Just make sure that you add the correct password to the password list and let's see whether it will
manage to find it.
And keep in mind that if you didn't run this on a virtual machine and you actually used the GPU to brute
force the password, you could have up to tens of thousands of passwords per second and the faster the
better.
However, even with this small speed, we managed to find the password while I was talking so we can
see it printed it out right here.
Here is the hash.
Here is the name of the actual wireless access point.
And here is the password that it managed to find.
So we can see it.
Also did this in less than one second.
While I talked, we got all of these results output.
And this is a second option as to how you can crack the password of wireless access points.
Now you can use the hash, get to crack some other passwords as well.
We saw that they are a bunch of different hash values that you can use.
However, we learned hash cat through wireless password cracking.
Great.
And that's about it for wireless cracking.
So thank you for watching this video and this section.
And I will see you in the next lecture.