View Issue Details

IDProjectCategoryView StatusLast Update
0000976Kali LinuxKali Package Bugpublic2014-01-27 21:04
Reporterfalcon111 Assigned Tomuts  
PrioritynormalSeverityminorReproducibilitysometimes
Status closedResolutionno change required 
Platformx64OSKaliOS Version1.0
Product Version1.0.6 
Summary0000976: besside-ng collecting BAD WPA Handshakes
Description

besside-ng collect crappy handshakes. The worse receive signal, the more chances that handshake will be crappy and uncrackable, because of missed steps, that were not received correctly.
For handshake to be good, all WPA handshake steps must be received within several milliseconds from each other. If some step received even one full second (not to mention dosens of seconds) after previous step, it means that these steps are from the different handshakes. And, it seems to me, besside doen not check amount of time passed between received steps:
[13:21:48] Got WPA handshake step 1 (have 1) for kxxxxxxr-46
[13:21:49] Got WPA handshake step 1 (have 1) for kxxxxxxr-46
[13:21:50] Sending deauth to ff:ff:ff:ff:ff:ff
[13:21:50] Sending deauth to 08:xx:xx:xx:xx:9c
[13:21:50] Sending deauth to 14:xx:xx:xx:xx:65
[13:21:50] Sending deauth to 1c:xx:xx:xx:xx:60
[... skipped]
[13:22:00] Sending deauth to ff:ff:ff:ff:ff:ff
[13:22:00] Sending deauth to 08:xx:xx:xx:xx:9c
[13:22:00] Sending deauth to 14:xx:xx:xx:xx:65
[13:22:00] Sending deauth to 1c:xx:xx:xx:xx:60
[13:22:00] Got WPA handshake step 2 (have 7) for kxxxxxxr-46
[13:22:00] Got necessary WPA handshake info for kxxxxxxr-46
[13:22:00] Run aircrack on wpa.cap for WPA key
[13:22:00] Pwned network kxxxxxxr-46 in 365:17 mins:sec
[13:22:00] TO-OWN [] OWNED [kxxxxxxr-46] UNREACH []
[13:22:00] All neighbors owned

Second step received ELEVEN seconds after the first-one. And still, besside puts these steps into one WPA handshake.
I'm deleting such "handshakes" without even looking at them. There's no point in trying to crack such handshakes, as they're crappy.

I've tried to look into cap file and check packet's capture time (time difference between packets). But all three packets, forming each handshake, are marked with the same time, so it's impossible to check handshake validity by looking at them in wireshark.

Because of this bug, i can't run besside in auto-mode, because i can't check every captured handshake, if it's good or bad. I have to waste my time, to run besside explicitly for every AP, so that i can check if all steps was received at the same time or not. If not - i'm deleting wpa.cap and running besside again and again, until the handshake will be captured correctly.

Annoying.

Activities

muts

muts

2014-01-27 21:04

reporter   ~0001458

Thanks for the report. Is this a Kali bug? perhaps you're better off reporting this to the tool authors directly.

Issue History

Date Modified Username Field Change
2014-01-22 18:03 falcon111 New Issue
2014-01-27 21:04 muts Note Added: 0001458
2014-01-27 21:04 muts Status new => closed
2014-01-27 21:04 muts Assigned To => muts
2014-01-27 21:04 muts Resolution open => no change required