Generate 10 Digit Phone Numbers using Crunch in Backtrack

Phone numbers are some of the most commonly used passwords for WEP/WPA encrypted wireless networks. Several ISP’s use them as default passwords for their routers for easy to remember access.  By creating a list of every possible phone number combination with a specific area code, generally your own area code, it will give you quick access to most wireless networks using a dictionary attack. Using crunch built into Backtrack 5R2, you can quickly generate every possible number combination beginning with a specified area code.

Applications > BackTrack > Privilege Escalation > Password Attacks > Offline Attacks > crunch

Use the following command

./crunch 10 10 -t 123%%%%%%% -o /root/123.txt

Explanation of command.  10 refers to the number of characters. The -t command allows you to specify a pattern where only the @’%^ characters will change, in this case the %. The 123 is where the area code will go followed by 7 % characters. The -o is for output and can be saved anywhere. Make sure to save it as a .txt file. This will only take a few seconds and will say 100% when finished. Now you can load these in Gerix and bruteforce WPA.

Note: Most cities have multiple area codes. To combine multiple files into one just do a ‘cat 123.txt 456.txt 789.txt >> all.txt’


WEP Cracking in Backtrack 5 using Gerix

I’m creating several posts at once, and I’ll be adding screen shots shortly, bear with me.

Boot up to Backtrack 5 R2. You’ll need a laptop with a wireless card that supports monitor mode and packet injection.

Applications >BackTrack > Exploitation Tools > Wireless Exploitation Tools > WLAN Exploitation > gerix-wifi-cracker-ng

Note [At the bottom of Gerix, you will see the current actions taking place, so if something goes wrong you can see exactly what it is]

With Gerix open, go to the Configuration Tab.

You should see your interface marked as wlan0. Select it, and click the button below labeled Enable/Disable Monitor Mode.  The card will now be in Monitor mode.

At this point, you can also click the Set random MAC address to spoof your MAC address.

Click on the interface labeled mon0 so it’s highlighted.  Underneath that, you will see a button to Rescan Networks. Click this to search for SSID’s.

Select the desired WEP network SSID.

Click the WEP tab. Click Start Sniffing and Logging. You should see the BSSID MAC loaded as well as the PWR (Signal Strength) and other data.  Keep this window open.

Click Performs a test of injection AP to ensure your card is able to inject packets. You will get a message stating “Injection is working!”. You can close this window.

For this demonstration we will use WEP Attacks (no-client). Click the button labeled as such.

Under Fragmentation attack, click Associate with AP using fake auth. In the bottom data viewer window, you will see it read “Fake authentication with mon0”

Click Fragmentation attack button. Once it finds a packet, it will prompt to “Use this packet ?” Type Y for yes.

Click Create the ARP packet to be injected on the victim access point.

Click Inject the created packet on victim access point. Type Y in this box also.  Keep this window open.

Go to the Cracking tab, and under WEP Cracking, click the Aircrack-ng – Decrypt WEP password button. You will be watching here for the number of IV’s. (got 10,000 IVs)

You will generally need about 10,000 – 20,000 IVs to decrypt the password and sometimes less. This can take 30 seconds to a couple minutes depending on the amount of wireless traffic. You can safely close this window, and click the button again to reopen it when it has enough IV’s.

The key will be displayed in this window when complete.

Damn Vulnerable Web App Install on Fedora 16

Getting DVWA up and running takes some effort if you’ve never installed it before. The documentation is decent, but it’s spread out and not entirely complete. This is a quick install tutorial for installing DVWA with XAMPP on Fedora 16.


Download XAMPP. Open a shell, and su to root.

Extract the downloaded archive file to /opt:

tar xvfz xampp-linux-1.7.7.tar.gz -C /opt

XAMPP is now installed below the /opt/lampp directory.  Use ‘/opt/lampp/lampp start' to start

You should now see something like this on your screen:

Starting XAMPP 1.7.7...
LAMPP: Starting Apache...
LAMPP: Starting MySQL...
LAMPP started.

Test if it’s working by going to http://localhost.


Download DVWA. Unzip, and place the unzipped files in your public html folder. In this case it will be placed in ‘/opt/lampp/htdocs/’

Navigate to to test if it’s working properly. The default user/pass is admin:password.

Database Setup

To set up the database, simply click on the Setup button in the main menu, then click on the ‘Create / Reset Database’ button. This will create / reset the database for you with some data in.

If you receive an error while trying to create your database, make sure your database credentials are correct within /opt/lampp/htdocs/config/

The variables are set to the following by default:

$_DVWA['db_user']='root'; $_DVWA['db_password']=''; $_DVWA['db_database']='dvwa';

If you are still getting an error message when trying to create the database, it’s most likely due to your $PATH. Follow these instructions to fix it.

export PATH=$PATH:/opt/lampp/bin

ech $PATH (to verify)

mysql -u root

UPDATE mysql.user SET Password=PASSWORD(‘password’) WHERE User=’root’;

flush privileges;


mysql -u root -p [enter password to confim change]


Accessing the DVWA remotely

If you are trying to access the DVWA setup remotely from another computer on the network, you will need to delete or rename the file ‘.htaccess’. It’s located in ‘/opt/lampp/htdocs/dvwa/’. You will need to do an ls -la to view it, as it’s a hidden file. This is a known issue and should be included in future documentation. DVWA: Issue 16