Hacking WiFi in Seconds using Rainbow Table

• 14 April, 2022
• No Comments

What is a Rainbow Table?

Rainbow tables are pre-computed tables of hash values that are pre-matched to possible plain text passwords. Rainbow tables are mainly used to crack hashes very quickly.

The 3 main steps to crack WPA/WPA2 password:

1. Information gathering (ESSID, the MAC address of the AP, if there are any clients connected to the AP, etc).
2. Capture the Handshake (by waiting for somebody to connect or disconnect a client and let it connect again).
3. Cracking the password.

Advantages of using Rainbow table:

1. Searching the rainbow table is very fast.
2. Once created, it does not require computing resources.
3. Once created, you can use it on multiple wireless access points.

Disadvantages of using Rainbow table:

1. It takes up a lot of space, much more than just the password file.
2. The process of combining the password and the ESSID to create the PMK takes a good bit of time.

Computing rainbow tables takes exactly the same amount of time as a brute force, but searching the generated rainbow table takes a split second. So, if you want to test one handshake per an Access Point, then there is no difference between brute-force and using rainbow tables.

If you want to generate a rainbow table, I recommend you generate a large one that you can use on multiple handshake files.

In a pre-computed rainbow table, Aircrack-ng will go through the wordlist and combines each password from the wordlist to the wireless access point name to compute what’s called a PMK (Pairwise Master Key) using the pbkdf2 algorithm.

Next, the PMK will be compared to the Handshake.

If the PMK was valid, then the password that was used to create the PMK is the password we are looking for. If it’s not, it just went to the next password and it creates a PMK from it.

Hacking WiFi in Seconds using Rainbow Table Live [Practical]

https://vimeo.com/750891417

Commands used:

crunch [min] [max] [charset] -o [output location]

Generate a wordlist

airolib-ng [db_name] --import passwd [dictionary location]

Create a database and import wordlist

airolib-ng [db_name] --import essid [essid_file]

import the target ESSID

airolib-ng [db_name] --batch

Compute PMK for the wordlist

aircrack-ng -r [db_name] [handshake_file]

Crack the key using the PMK database