Hacking WEP (on an Orange Livebox)

Hack WEP using Backtrack 5 and gerix

So, you forgot your WEP key and you can’t recover it or you simply wanna hack into your neighbor’s WiFi :P. In short the situation is – your terminal can detect the “secured” WiFi network but it can’t connect to it because you need the key. WEP (and WPA too) has already been hacked long ago, yet people still use it! There already exists tons of ways on how to do it, just google it. I am just going to explain the way i did, which i found to be the simplest one yet. All you need is to download BackTrack 5. You can install it on your PC, but it is simpler to just create a bootable Live USB using UNetbootin. I assume you booted Backtrack 5 (from USB or otherwise) successfully at this point.

The following worked for an Orange MyT livebox that has WEP enabled.
Unfortunately i could not take screenshot in the live cd mode…

1. Launch gerix (Applications -> BackTrack -> Exploitation tools -> Wireless exploitation -> WLAN exploitation -> gerix-wif-cracker-ng)
2. Click on configuration tab, click on your interface then click on Enable/Disable monitor mode button. This will create a new interface. Select it.
3. Click on rescan networks button. The victim’s network should show up in the list. Select it.
4. Click on WEP tab. Click on start sniffing and logging. (This will open up a terminal).
5. Click on WEP Attacks (no-client). You will see 2 types: ChopChop attack and fragmentation. Fragmentation did not work for me because of poor signal strength. Chop chop is best for low signal, so i used it.
6. Click on “start false access point authentication on victim” button.
7. Click on “start ChopChop attack” button. A new terminal will show up, type y. Wait for it to become 100%.
8. Click on “Create the ARP packet to be injected …” button.
9. Click on “Inject the created packet on victim access point”. A new terminal will show up, type y. You will see ‘Sent [a number] packets’. Wait till you reach about 10,000 packets.
10. Now in gerix, click on the Cracking tab. Click on Aircrack-ng – Decrypt WEP password button.
11. You should see the WEP key! It will be something like HI:G4:I9:…. It was 38 in length for me. Actually when you enter the WEP key (i tried it on windows XP), drop all the “:”.

Voila. Now you can access the “secured” wireless network. Enjoy! 🙂

//roshans89