{"id":5015,"date":"2018-05-10T18:25:56","date_gmt":"2018-05-10T10:25:56","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=5015"},"modified":"2018-05-10T18:26:51","modified_gmt":"2018-05-10T10:26:51","slug":"airbash-fully-automated-wpa-psk-handshake-capture-script","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2018\/05\/airbash-fully-automated-wpa-psk-handshake-capture-script\/","title":{"rendered":"Airbash &#8211; Fully Automated WPA PSK Handshake Capture Script"},"content":{"rendered":"<p>Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell (tested on Kali Linux and Cyanogenmod 10.2) and uses <a href=\"https:\/\/www.darknet.org.uk\/2007\/10\/aircrack-ng-wep-and-wpa-psk-key-cracking-program\/\">aircrack-ng<\/a> to scan for clients that are currently connected to access points (AP).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/05\/Airbash-Fully-Automated-WPA-PSK-Handshake-Capture-Script-640x328.png\" alt=\"Airbash - Fully Automated WPA PSK Handshake Capture Script\" width=\"640\" height=\"328\" class=\"aligncenter size-medium wp-image-5023\" srcset=\"https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/05\/Airbash-Fully-Automated-WPA-PSK-Handshake-Capture-Script-640x328.png 640w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/05\/Airbash-Fully-Automated-WPA-PSK-Handshake-Capture-Script-1024x525.png 1024w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/05\/Airbash-Fully-Automated-WPA-PSK-Handshake-Capture-Script-1536x788.png 1536w, https:\/\/www.darknet.org.uk\/wp-content\/uploads\/2018\/05\/Airbash-Fully-Automated-WPA-PSK-Handshake-Capture-Script.png 2039w\" sizes=\"(max-width: 640px) 100vw, 640px\" \/><\/p>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>Those clients are then deauthenticated in order to capture the handshake when attempting to reconnect to the AP. Verification of a captured handshake is done using aircrack-ng. If one or more handshakes are captured, they are entered into an SQLite3 database, along with the time of capture and current GPS data (if properly configured).<\/p>\n<p>After capture, the database can be tested for vulnerable router models using crackdefault.sh. It will search for entries that match the implemented modules, which currently include algorithms to compute default keys for Speedport 500-700 series, Thomson\/SpeedTouch and UPC 7 digits (UPC1234567) routers.<\/p>\n<h2>Calculating Default WPA PSK Keys<\/h2>\n<p>After capturing a new handshake, the database can be queried for vulnerable router models. If a module applies, the default keys for this router series are calculated and used as input for aircrack-ng to try and recover the passphrase.<\/p>\n<h2>Airbash WPA PSK Handshake Capture Tool Usage<\/h2>\n<p>Running <code>install.sh<\/code> will create the database, prepare the folder structure and create shortlinks to both scripts which can be moved to a directory that is on <code>$PATH<\/code> to allow execution from any location.<\/p>\n<p>After installation, you may need to manually adjust <code>INTERFACE<\/code> on line 46 in <code>airba.sh<\/code>. This will later be determined automatically, but for now the default is set to <code>wlan0<\/code>, to allow out of the box compatibility with bcmon on Android.<\/p>\n<p>&#8211; <code>.\/airba.sh<\/code> starts the script, automatically scanning and attacking targets that are not found in the database.<br \/>\n&#8211; <code>.\/crackdefault.sh<\/code> attempts to break known default key algorithms.<\/p>\n<p>To view the database contents, <code>run sqlite3 .db.sqlite3 \"SELECT * FROM hs\"<\/code> in the main directory.<\/p>\n<p>You can download Airbash here:<\/p>\n<p><a href=\"https:\/\/github.com\/tehw0lf\/airbash\/archive\/master.zip\">airbash-master.zip<\/a><\/p>\n<p>Or read more <a href=\"https:\/\/github.com\/tehw0lf\/airbash\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing. It is compatible with Bash and Android Shell (tested on Kali Linux and Cyanogenmod 10.2) and uses aircrack-ng to scan for clients that are currently connected to access points (AP). Those clients are then deauthenticated in order to capture the [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"Airbash is a POSIX-compliant, fully automated WPA PSK handshake capture script aimed at penetration testing, it is compatible with Bash and Android Shell.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9],"tags":[10663],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5015"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=5015"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/5015\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=5015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=5015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=5015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}