[Req]PPC Wireless Hacking Tools

[honeychea]

i knew this is not new topic,but may i know any PPC wireless hacking tools,easy function,n hack into network to access to internet?i try airsniffer,but i dun know how to use it.i search entire 203page,cant find any usefull tools bout hack Wlan.thx ^^

[eurorpeen]

This is not a hacker forum !

There is 2 parts in what you want :

- intercepting network traffic, easy with one or another tool
- finding network keys (wep) wich is not the goal of this forum and require much power than usual windows mobile devices are able to show

[Antzor]

and require much power than usual windows mobile devices are able to show

Not true. This can actually be done with a PSP. Very, very slow. But possible.

also as a side note i dont like the notion of "THIS IS NOT A HACKER FORUM"
No, it isnt. Its also not a forum where ideas are declared bad because they CAN be used in ways they aren't meant to be used.

[Gho57]

I do not think that the internal wireless support injection mode:rolleyes:

[Ikari]

ignoring the fact that its illegal, i can give some hints

A ppc (at lest on WM and whit the current wifi drivers) cant sniff traffic, and even if it could plus more improbable inject (something most wifi cards cant over windows xp vista etc), the cpu couldn't get even a 64bit wep key in any useful time.

So if you could get monitor(not so improbable) and injection over WM(really improbable) you would need several hours to get the data(at lest 2hours for 200.000 ivs)

After that cranking whit a 500mhz almost no cache and very few MB free e could say at least 15hours.

something that my eee could monitor and inject (15min = 1.000.000 ivs) and crack (5secounds).

ppc are only useful to wardriving.

[Monsterchef]

yes, that seems logical: you also cannot record 32bit audio (btw i'm an audio pro) with current os (win/mac os) because you need more than 32bit for it: you need REAL 64bit programs, that current pro audio doesn't solve.
remember win95? early 32bit-system, compare to vista 32: late 32bit system: you see the range?
can you remember what potential 64bit has now for audio etc. in future? :) (of course everything's meant in REALTIME!)

maybe a bit offtopic - sorry for that- but i think it marks the point with wm6-devices and decoding 32-bit and above with a 32bit mobile cpu a little bit: even if it was legal, it's not a good idea ;)
have a nice day, greetz, m.

[JoeRW]

I dont think the cracking of 64 bit key is a limitation since you could easily farm that off from your phone to a pc on the net.
But since the wifi chips in the phones cant sniff traffic, its not really possible :( would be fun though .

[eurorpeen]

The chips in the ppc can snif and inject the datas, there is enough "how to" and softs to do that, look on google but as you said, you need much more power to decrypt a wep key that it is not practicable.
OK, send the data to another computer to decrypt, but so, why not use this computer by default from the beginning ?
There is also a linux bootcd that come with all the tools already packed in.
So yes, you can do it in a lot lot time and it's illegal so I will not give more informations about it but I tried on my own network and it works.

[Monsterchef]

that's the point. suppose the "real" hackers use small netbooks which have more power. ppc's are most likely not designed for such things - and i am glad about that. :) but if you ask me- in these days it's in general useless to do things like that, because the internet (and related issues!) is not a justice-free playground...

[honeychea]

isit that mean,i cant get any app,with easy connect to Wlan without key,n access to internet?

[shi3ld]

isit that mean,i cant get any app,with easy connect to Wlan without key,n access to internet?

Yeah windows mobile lets you use the code (hex pairs)

5U CY 5U KY 2D 0L LA R5

[arcanehacker]

Time and device battery isn't gonna make it.. just forget about the idea.. You can sniff out packets is one thing.. which I already done it before many years back on a Pocket PC 2003SE.

The other thing is have enough juice in your device to last long enought to gather enough packets..

Then enough Juice again and CPU power (which obviously is nto powerful or quick enough yet) to decrypt the packets for the WEP keys.. that is if its only 64bit WEP.. 128bits I dun think it ever makes sense on the current processor..

[Mandragore]

Yeah windows mobile lets you use the code (hex pairs)

5U CY 5U KY 2D 0L LA R5
Me love you long time :D

[honeychea]

Yeah windows mobile lets you use the code (hex pairs)

5U CY 5U KY 2D 0L LA R5

how to use this ? any guide?

[Sandeman1976]

ROFL, loving this thread :D

[clown]

so you think a tiny pda can do the same work as a workstation with dual gtx280 using backtrack4?

yes it can. but first you need to find a mage to cast a +5 equipment upgrade spell on it.

[xavierdemon]

how to use this ? any guide?

PMSL lol :D:D:D:D:D:D:D:D:D:D

[codybear]

that's the point. suppose the "real" hackers use small netbooks which have more power. ppc's are most likely not designed for such things - and i am glad about that. :) but if you ask me- in these days it's in general useless to do things like that, because the internet (and related issues!) is not a justice-free playground...
haha.
wait till snapdragon and processors after that come into play.
then it will start to become even more probable.

so you think a tiny pda can do the same work as a workstation with dual gtx280 using backtrack4?

yes it can. but first you need to find a mage to cast a +5 equipment upgrade spell on it.
lmfao.

[streetglowcruiser]

how to use this ? any guide?

oh my god i'm wetting myself haha

[benko286]

so is there any wep cracking tool for wm 6.1/6.5???

[yetep]

"this isnt a hacker forum"

maybe so.. but surely redistributing Windows Mobile is the same as redistributing Windows XP/Vista?

Maybe im totally wrong and it does nothing to our licenses but just getting a point out there! :-P

[fclage]

isit that mean,i cant get any app,with easy connect to Wlan without key,n access to internet?

I've made a Pocket PC app that provides the WPA keys for the default SpeedTouchXXXXX wireless passwords.
Doesn't need to capture any data... Just a bunch of SHA1 calculations to match the SSID and then you get the WPA key.

If you want, I can post it.

Note: This should only be used for password recovery on your own access point, or for learning purposes.

// FCLage

[triakom]

Post it please!
It will be fun to try.

[triakom]

Double post.
Please delete it.

[rocky50]

I've made a Pocket PC app that provides the WPA keys for the default SpeedTouchXXXXX wireless passwords.
Doesn't need to capture any data... Just a bunch of SHA1 calculations to match the SSID and then you get the WPA key.

If you want, I can post it.

Note: This should only be used for password recovery on your own access point, or for learning purposes.

// FCLage

Wow man,post the PPC app PLS :):D

[fclage]

I've called the project ThomSun (stupid name for "enlight the thomson" routers and access points)

It an early alpha, kind of slow, but it gets the job done.
I'm currently using Microsoft's .NET's sha's encryption and that's (one of) the reason behind the slow performance.

It saves the found keys in a text file for reference.

If you want to know how this is done, then uou should check this page (http://forum.darkc0de.com/index.php?action=vthread&forum=18&topic=8966) .

Snapshots:
http://img219.imageshack.us/img219/139/thomsun1.th.jpg (http://img219.imageshack.us/i/thomsun1.jpg/) http://img89.imageshack.us/img89/7361/thomsun2.th.jpg (http://img89.imageshack.us/i/thomsun2.jpg/)

Requires WM 6.0 and up.

Anyway, here it is (attached)

Please remember... this is not to be used in any illegal activity!

[eranyanay]

I've called the project ThomSun (stupid name for "enlight the thomson" routers and access points)

It an early alpha, kind of slow, but it gets the job done.
I'm currently using Microsoft's .NET's sha's encryption and that's (one of) the reason behind the slow performance.

It saves the found keys in a text file for reference.

If you want to know how this is done, then uou should check this page (http://forum.darkc0de.com/index.php?action=vthread&forum=18&topic=8966) .

Snapshots:
http://img219.imageshack.us/img219/139/thomsun1.th.jpg (http://img219.imageshack.us/i/thomsun1.jpg/) http://img89.imageshack.us/img89/7361/thomsun2.th.jpg (http://img89.imageshack.us/i/thomsun2.jpg/)

Requires WM 6.0 and up.

Anyway, here it is (attached)

Please remember... this is not to be used in any illegal activity!

You're behind its development?
Can it actually find a WEP key?
What about WPA\WPA2? Its extremely difficult, especially with PPC, right?

[triakom]

The program crashes by me when I click "about" and "get it"

[fclage]

The program crashes by me when I click "about" and "get it"

Can you please provide more information?
(Windows Mobile version, PDA model, and the crash information should provide some information useful for me to debug it). The strange thing is that the about menu just displays a msgbox... that's odd.

[eranyanay]

You should try and catch exceptions like when I enter wrong SSID it immediately crashes.
Same for pressing the ok button with no SSID or without WIFI.
The About cause it to close also.

Can it work for various routers also?

[benko286]

ok so what i have done i added to my speedtouch wep(128bit) password, also changed ssid to SpeedTouch, and than i in your program added ssid:SpeedTouch and tapped do it, after it passed whole 2008year i stopped,why? well i got this router in 2009, so i thoought that it has been maden in 2008, but app found nothing...i will check 2009 year in options but later i dont want to kill battery, first anybody tell me did you managed to get any wep key from this program, is it working????

[triakom]

Can you please provide more information?
(Windows Mobile version, PDA model, and the crash information should provide some information useful for me to debug it). The strange thing is that the about menu just displays a msgbox... that's odd.

HTC Diamond 2.03 wwe official rom. WM 6.1
When I click on Do it! or about I receive a pop up window with sound and the program immediately disappears. I have not enough time to read the message.

[fclage]

Thomsun

Application purpose: Calculates default WEP/WPA passwords from Thompson WiFi routers, using their broadcast ID code.

Snapshots:
http://img219.imageshack.us/img219/139/thomsun1.th.jpg (http://img219.imageshack.us/i/thomsun1.jpg/) http://img89.imageshack.us/img89/7361/thomsun2.th.jpg (http://img89.imageshack.us/i/thomsun2.jpg/)
If you want to know how this is done, then uou should check this page (http://forum.darkc0de.com/index.php?action=vthread&forum=18&topic=8966) .

Requirements: WM 6.0 and up / .NET libs installed.

Notes:
First of all... You don't need to change SSID's of your router. It will NOT discover your current password.
Second, this application doesn't capture any wireless packets, so you DO NOT have to have wireless on.
Third, to avoid that message you need to enter 6 HEXADECIMAL DIGITS that correspond to the speedtouch last part of the SSID.

Let me try to explain better... This just makes mathematical brute force calculations of SHA1 encryption of the DEFAULT FACTORY WEP/WPA password that comes with speedtouch access points. If you changed your SSID to (ex: "My Wireless") or your password different from the factory default, it WILL NOT give you your current password.

USAGE:
if BY DEFAULT, your SSID is "Thomson62F47F" you just enter the "62F47F" and click "Do It" (no msgbox will appear since data is valid)
HASH calculations will begin from week 1 to week 52 on the selected MANUFACTURE years (if you have brand new wireless AP, it doesn't mean that the manufactured year is 2009... its probably 2008 or lower). By default, i left 2008 to 2006 selected... You can Check/Uncheck those you want.
Also, if you activate the option to stop calculations once first key is discovered, it doesn't mean that THAT one will be your password (odds are that it is), but there could be others.

By comparison, if you use the example I've provided in this post ("62F47F") it will report that the access manufactured point dated 2006, week 32 has the WEP/WPA key of "797DDA13C1". Test it and enter those 6 digits, uncheck all years except 2006 and it should report that password (will take about 10 mins to process all weeks until it hitsweek 32 and provides the pass).

Once again, you do NOT need to have the wireless ON on the mobile device.

I'm now uploading version 0.0.0.3
Changes:
* Fixes from 0.0.0.2 (crash)
* Added: Speed up - about 30% to 40% faster than previous version
(I'm still using microsoft's sha1 - i want the final version to be much faster)
* Added: MultiThreaded - application is now responsive while calculating
* Added: ResumeCache - avoids double calculations
* Added: Instruction / How To page
* Added: Stop function
* Added: More detailed stats (with HPS - Hashes Per Second).

Give me feedback ppl! :)

Cheers

[benko286]

now i got it, but what about if i put 128bit wep enycription, than speedtouch wont automaticly type pass, i need it, than thomsun wont work?

also is there any app that can capture any wireless packets, so that it at least can crack wep enycription?

[vegaz]

I have a problem with framework.

[fclage]

I have a problem with framework.

What problem do you have?
(Btw, the required framework is .NET CF 3.5 - just google it)
It's pre-installed in many roms already

[honeychea]

when i launch the application it show problem,my HTc diamond have framework 3.5...

[dieselboy]

this is not illegal, its only illegal if you use this in the wrong way - ie breaking into random networks and using their network.

if you need to hack your own network for penetration testing / security checks then its not illegal at all - in england.

i think in at least one country, having the ability to perform this is illegal, so i have read online.

best thing to do is to get the equipment which allows this, and download a boot cd rom to boot your laptop or pc into linux from the cd, and use that OS as an application to perform what you need to do.
very steep learning curve here but the majority of the people on this forum would be capable.

[Weeziana]

IT WORKSSS!!!! TO ME I'M NOT LYING OR ANYTHING, first i tried someone else is and it worked and then i tried my one and surely the wep key came out!!!

[fclage]

Thanks for reporting...

I'm still new to pocket development, but i'm trying to improve this utility to include automatic ssid listing of available networks (or external XML file list from WiFiFoFum) and (if you have an active Internet connection) provide the password result in an almost immediate response (like in some seconds).

Available time is not much though.

// FCLage

[elamodelmerol]

i just needed to confirm it...

IT DOES WORK.


i tested it with my thomsom t585 router manufactured in 2009 and it worked like a charm, even though it didn't figure out the whole serial number [just the first digits] the WEP key was 100% correct


keep up the good work

[elamodelmerol]

just for the record...
i'm using a touch diamond [DIAM100] running winmo 6.1, and a daily getting better android rev, what do you think about porting it? :p

[ArtieQ]

So basically you need the SSID of the actual router to get into the network which means it's impossible to crack a networks WEP if you are like at a random place in the city?

[krbo]

another positive report from Touch HD (WM6.5) , tested on two routers.

Working keys found quickly (in about 5-10 minutes) but for curiosity I left it search to the end (default years only) .

I think it took some 3 hours to finish.

[fclage]

another positive report from Touch HD (WM6.5) , tested on two routers.

Working keys found quickly (in about 5-10 minutes) but for curiosity I left it search to the end (default years only) .

I think it took some 3 hours to finish.


Yeah, unfortunately many calculations are done and it takes time to do them.
Activate the option to stop calculations when key found.
Battery drain is also an issue since the cpu hits 100% usage to do those calculations...
The best way would be to either:
a) Switch to a faster SHA1 algorithm (instead of .net's built in)
b) Use webservices to handle the calculations remotely on a faster cpu.

Should I post the sourcecode to sourceforge?

// FCLage

[Xzibitt]

Ive installed the latest version of .NET (3.5)
And im running wm 6.5 on a HTC Snap.

I keep on getting this message:

"ERROR
Thomsun.exe InvalidOperationExceptionMessage text unavailable. Resource file 'Microsoft.VisualBasic resources' not found.
at
Thomsun.My.MyProject.MyForms.Create__Instance__[T](Form1Instance)
at
Thomsun.My.MyProject.MyForms.get_Form1()
at
Thomsun.Form1.Main()"


Can somebody help me? I really need this program!

[SonicFlare]

There was a special linux distro for this :)
google it by wifi hacking linux distro

[Xzibitt]

Yeah, but i really need a app like this on my phone..

[Willis111]

so you think a tiny pda can do the same work as a workstation with dual gtx280 using backtrack4?

yes it can. but first you need to find a mage to cast a +5 equipment upgrade spell on it.

... I use a p3 800mhz laptop and the backtrack 3 live cd to break my 128 bit wep key in 10 minutes (of course being able to inject when capturing is key ...). Has 128-256 megs of ram, 10gig hd and a 2 mb rage mobile video card. Pretty much the same setup as a touch diamond lol. If you really want to get this working it's going to be a little research, someone on these forums claims to have gotten debian and aircrack installed and working on their phone, at least I think it was these forums... thank god for google.

[Xzibitt]

has there been an updated version yet?

[fclage]

has there been an updated version yet?

Don't have enough time to continue development of this app.
Do you want me to post source code in sourceforge.net?

// FCLage

[wapvirus]

Hi found your thread interesting and see that many people want to monitor WiFi Packet traffic I posted this tool a while back that forces Promiscuous Mode for tnetwln based devices

Original Post Here:
http://forum.xda-developers.com/showpost.php?p=2570686&postcount=1

[Wratholix]

The chips in the ppc can snif and inject the datas, there is enough "how to" and softs to do that, look on google but as you said, you need much more power to decrypt a wep key that it is not practicable.
OK, send the data to another computer to decrypt, but so, why not use this computer by default from the beginning ?
There is also a linux bootcd that come with all the tools already packed in.
So yes, you can do it in a lot lot time and it's illegal so I will not give more informations about it but I tried on my own network and it works.

how about setup a little sftp batch to upload the key to your box that monitors a directory and in return dumps the decrypt into another folder which you just download again.
should be rather simple

power wise.. drive around in your car ? :P anyway.. all of this would only be useful if you didnt have a laptop