KisMAC Resources

KisMAC Resources, Wordlist, Dictionary files

Is there a KisMAC Tutorial?
Yes, a Video tutorial and a written one. Also a troubleshooting one and a debugger in progress.  it's here: http://tinyurl.com/nxdcsd

What injection device should I use?
Definitely this one: 
Best Wifi Card for KisMac  about 20 X more powerful than Airport or Hawking

This card is a winner hands down! 
Mentioning a Hawking or an Edimax as "competition" is a pure act of charity.


Otherwise, The list of “approved” hardware is here: http://trac.kismac-ng.org/wiki/HardwareList
I have tried the Edimax EW-7318 USg, Hawking HWUG1 & HWUG1A (about $40)
I am not really impressed by the sensitivity of the Hawking “as is”, nor by the Edimax.
After few tests and compared to the one mentioned above in "best card" I would not consider buying them again.

Nota Bene:
KisMAC will try every word (from the list provided) to attempt to crack the key, hence it may take a lot of time....if you have a slow machine, be really patient.
I have a not so bad machine, and I run about 170 words per second. You can leave a comment with your config and speed for me to compare.
Mine: MacBook Pro 2.5GHz Intel Core 2 Duo + 4GB DDR2 SDRAM : about 170 Word/sec

Can you find listing or maps of available networks?
-Yes you can, check the Wigle Webpage http://wigle.net

How to uninstall Drivers ? Plist? 
Your best shot at uninstalling Plist is to use the free App called "App Cleaner"
You'll find the link, directions, etc, on the blog (left hand side)
If you have installed the drivers provided with a CD for a specific chipset, you will need:
The Admin Rights, the use of Terminal, and you'll need to unload the driver before removing it. Unloading the driver only works for one session: When you'll reboot, the driver will be loaded again.

How to select a single channel?
Take a look at "Step B", the picture shows "all channel selected"
you just have to click on "none" and the check the single channel wanted
you can also use directly the tab "Channel"

I am a Super Geek, is there something more powerful than KisMAC?
Aircrack-ng (Reserved for Advanced User)
How to install Aircrack on a Mac : http://easymactips.blogspot.com/2010/10/how-to-install-aircrack-on-mac.html
Wireshark is also a powerful one, but no so friendly for the beginner

Passwords Lists

One of the best is here:
http://easymactips.blogspot.com/2009/11/support-donate.html


Worst password list: Please, don't use them .....;-) they are often the first checked ....
http://aloah.free.fr/mactips/Wordlists.html
http://trac.kismac-ng.org/wiki/wordlists

List of Dictionary files or Wordlist / Wordlists
Sometimes called wordkey or word key (as per the results of your queries via Google Analytics
for WPA attack:
http://aloah.free.fr/mactips/Wordlists.html
http://trac.kismac-ng.org/wiki/wordlists
or you can compile your own.
I may suggest you to skip passwords of 1,2,3 & 4 characters, very few people use 3 ch passwords... A bruteforce attack will not take a long time on 3 ch....
WPA:
Minimum 8ch, so you can skip all pswd of less than 8 characters.

Note on dictionary files:
the words are tested "as is" and not in combination.
Example: the password is "I love Kismac"
If your dictionary contains the words "I" + "love" + "Kismac" it will NOT work, your dictionary must contain the exact "I love Kismac" as a word to successfully attempt to crack.

This is the only way to end with a successful attack is to use a dictionary containing the (exact) word(s).
Pure Brute Force attacks do NOT work with KisMAC (trying every single combination starting at "a" then "aa", "aaa", etc) You need to provide KisMAC with a dictionary file, format TXT, with an empty line at the end.

Passwords hints
A Dictionary attack uses a list of existing words. Often those lists are all lowercase or mixed, in English, and use "common" words
the more complex is your password, the greater is the chance that it will take a mind-boggling and un-human length of CPU time to try all the possible combination. (million of years)
If you use Kismac on a WPA attack, the only way to end with a successful attack is to use a dictionary containing the (exact) word.
Brute Force attacks do NOT work with KisMAC
As a possible target of WPA attack, "I", use stupid-strength passwords on full ASCII.
I do not use English words, or any common language, and I use lots of $igns and numbers.
So, how patient is the attacker?

Memotechnic tips
Instead of your "123456" dummy password you can use an HARD TO GUESS word and add numbers to it PLUS a second set of numbers while holding the "Shift" key
Example: the maiden name of your mom is Kismac, her Bday is 07 12 1962
you got a "07121962Kismac)&_!@_!(^@"
You just have a 20 Ch length password that you can easily retain.
As KisMac does not use pure Bruteforce to crack WPA, you are pretty safe with a password like this. finding such a word a in dictionary would be...surprising.
Be aware that you can find list of names, towns, zipcodes, etc . So, using "Smith" or "Boston" is not really foolproof

Even in the improbable case of a very, very tenacious "auditor", a 20 character full ASCII password (255 characters possibility) is up to 20^255 possibilities.
How big is 20^255?
well, that's: 1,351,461,283,755,590,000,000,000,000,000,000,000,000,000,000,000
it's already stupid strong. Unless you are the NSA, it's probably out of your reach:

Update on Oct 6 2009.
You may have heard of the Yahoo! password heist*.
*(Dec 2009: Forget the Yahoo! heist, a bunch of highly educated monkeys running a website have left their entire database of passwords in clear plain text. The result is 32,000,000 passwords and login stolen. More on that later....)


10,000 passwords and emails listed on the web, plus another 30,000 accounts of Gmail and Comcast compromised.
According to serious sources, the list was a possible snippet of 250,000 email and password for resale.
Email? not a big deal, huh? who cares? they just need to go to your online banking, and reset the password. They will get the message. You won't ....
I could not access the list on time, but the excellent Reusable Security Blog did
Here is his (Matt Weir) analysis about what you use

So on to the analysis:

• Total Passwords: 9,845 - This number excludes all the e-mail addresses that had blank passwords
• Average Password Length: 8.7 characters long
• Percentage that contained an UPPERCASE letter: 7.2%
• Percentage that contained a special, (aka !@#$), character: 5.2%
• Percentage that contained a digit: 51.7%
• Percentage that only contained lowercase letters: 43.3%
• Percentage that only contained digits: 17.6%
• Percentage the started with a digit, (aka '1password'): 25.0%
• Percentage that ended with a digit, (aka 'password1'): 44.1%
• Percentage that started with a special character: 0.5%
• Percentage that ended with a special character: 2.2%
• Percentage that started with an uppercase letter: 6.1%

Overall letter frequency analysis:

aeoi1r0ln2st9mc83765u4dbpghyvfkjAzEIOxRLwSNq.MTC_DB-UP*G@H/ZYF+VJK,\$&X!Q=W?'#")(%^][}< {`>

First character, letter frequency analysis:

a1mbc2sp0lterdjfgn3hi6k759vo48yAwMzBSCuqPLExJRTFDGNV*HOZYKI\W@/-+(.$U&?Q^[,#

Last character, letter frequency analysis:

aos01326e57849nrilydzmtuAhbO.gck*SxpfE@+LvjNRw_-I?/$q!ZX)YKH"UPMDCB#GF'&%}T,]\VJ(

As a repeat, the previous is from Matt Weir, from Reusable Security

So, it tells me that there are still a large number of people using password vulnerable to dictionary attacks.
Furthermore:
40% of users are using the same password for everything.
92.7% did not use an UPPERCASE
94.8% did not use a special character
and the best: Only contained digits: 17.6%
Average length 8.7 >> rounded to 9 Characters
For the 18% (of dummies) that only use digit:
Digit only = 10 possibility per Ch. 9Ch long = 10^9 = 1,000,000,000 possible combination
Realistic number of test before cracking: 50% (10^4.5)
Time to crack : 0,015 hour = Joke
For those 18%, Read this carefully:
"Neil O'Neil, a digital forensics investigator at secure payments firm The Logic Group, found that "123456" cropped up on the list 64 times. There were 18 uses of the second most popular password, "123456789",
Big surprise!!! Just like the ones mentioned in the 500 most used password. Can you guess what was the #3 and 4#? probably 1234567 and 12345678.
the 500 most used passwords is 4 or 5 yrs old, but it seems like it was brand new.
#1 to #10: 123456,password, 12345678,1234, pussy , 12345, dragon , qwerty , 696969, mustang

So, if I had to create a password list, guess what ..
First on the list would be 8 or 9 Ch long, all digit, then all lowercase, then adding a digit or 2 first, then adding a digit or 2 last.
That list It should cover about 80% of all password.
That would be a big list of 7,518,774,324,736 possibilities, but it would cover 80% of the general public. Not bad.
So, GET A REAL PASSWORD!

Because it's raining and I am bored:
Let 's assume a cluster of 10,000 Macbook Pro, dual core etc, working all together for you (distributed):
A Mac Book Pro, on intensive uses 263 Watt and generates 894 BTU/h output of heat
Cracking possibilities : up to 10,000,000 pswd /second/computer
If you do the math, you'll realize that cracking by brute force a 20 characters Full ASCII password will cost you up to 40 million dollars worth of electricity, create enough BTU to generate a heat wave the size of Texas and take you hundred of thousands of years.
You could hit the jackpot and find the pswd within minutes, but generally, it will take 50% of the maximum time possible to break a password
This is the reason why Keyloggers, Phishing and Clickjacking were invented. That's were, in my opinion, where the real danger is ...

Kismac for Windows
I am not aware of a Windows version of KisMAC (KisDOWS???) , nevertheless, you can Google NetStumbler, Aircrack, Airsnort, etc..
To the best of my knowledge, NetStumbler does not have cracking capabilities, nor the capabilities to uncloak hidden or deauthenticate networks.
If you want serious power, you'll need to forget about Windows (breaking news, huh?) and move on to Linux with Aircrack-ng
If you download a (working) version of KisMAC for Windows, please let me know.
If you download one, especialy from a torrent, I am suggesting you to be VERY careful and scan the file left, right up and down for viruses or malware. ( hint )