← retour aux outils back to tools

# asleap

Craqueur LEAP/ASLEAP pour WPA/WPA2-Enterprise. Attaque l'authentification Cisco LEAP et MS-CHAPv2 en capturant les paires défi/réponse et en menant des attaques par dictionnaire hors ligne. LEAP/ASLEAP WPA/WPA2-Enterprise cracker. Attacks Cisco LEAP and MS-CHAPv2 authentication by capturing challenge/response pairs and performing offline dictionary attacks.

↗ https://github.com/joswr1ght/asleap

## Overview

asleap is a cracking tool targeting Cisco LEAP (Lightweight Extensible Authentication Protocol) and MS-CHAPv2, commonly used in WPA/WPA2-Enterprise environments. It captures the challenge/response exchange and performs offline dictionary attacks — LEAP is cryptographically weak and vulnerable to this approach.

## Basic Usage

Attack from live capture (monitor mode interface)

    asleap -i wlan0mon -f wordlist.txt -r wordlist.idx

Attack from pcap file

    asleap -r capture.pcap -f wordlist.txt -W wordlist.idx

Generate index for wordlist

    genkeys -r wordlist.txt -f wordlist.dat -n wordlist.idx

Specify SSID filter

    asleap -i wlan0mon -f wordlist.dat -r wordlist.idx -s "TargetSSID"

## Workflow

Step 1: Put interface in monitor mode

    airmon-ng start wlan0

Step 2: Capture LEAP handshakes

    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Step 3: Generate dictionary index

    genkeys -r /usr/share/wordlists/rockyou.txt -f rockyou.dat -n rockyou.idx

Step 4: Run asleap against capture

    asleap -r capture-01.cap -f rockyou.dat -W rockyou.idx

## Options

    -i IFACE    Live capture interface (monitor mode)
    -r FILE     Input pcap file
    -f FILE     Dictionary data file (.dat)
    -W FILE     Dictionary index file (.idx)
    -n FILE     Alternative: specify just the base name
    -s SSID     Filter by SSID
    -b BSSID    Filter by BSSID
    -V          Verbose output

## Tips

- LEAP is considered cryptographically broken — dictionary attacks are highly effective
- MS-CHAPv2 (used in PEAP) is also vulnerable but requires capturing the right exchange
- Use with WPA Enterprise targets; for WPA-PSK use hashcat/aircrack-ng instead
- genkeys must be run before asleap — the index significantly speeds up the attack
- Combine with hostapd-wpe for evil twin attacks to capture LEAP credentials

Help / Man page

    asleap [options]

    -i IFACE    Capture interface (monitor mode)
    -r FILE     Read from pcap file
    -f FILE     Dictionary data file
    -W FILE     Dictionary index file
    -n FILE     Base name for dict files
    -s SSID     Target SSID
    -b BSSID    Target BSSID
    -V          Verbose

## Vue d’ensemble

asleap est un outil de crack ciblant Cisco LEAP (Lightweight Extensible Authentication Protocol) et MS-CHAPv2, couramment utilisés dans les environnements WPA/WPA2-Enterprise. Il capture l’échange défi/réponse et mène des attaques par dictionnaire hors ligne : LEAP est cryptographiquement faible et vulnérable à cette approche.

## Utilisation de base

    # Attaquer depuis une capture live (interface en mode monitor)
    asleap -i wlan0mon -f wordlist.txt -r wordlist.idx

    # Attaquer depuis un fichier pcap
    asleap -r capture.pcap -f wordlist.txt -W wordlist.idx

    # Générer l'index d'une wordlist
    genkeys -r wordlist.txt -f wordlist.dat -n wordlist.idx

    # Spécifier un filtre SSID
    asleap -i wlan0mon -f wordlist.dat -r wordlist.idx -s "TargetSSID"

## Workflow

    # Étape 1 : passer l'interface en mode monitor
    airmon-ng start wlan0

    # Étape 2 : capturer les handshakes LEAP
    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

    # Étape 3 : générer l'index du dictionnaire
    genkeys -r /usr/share/wordlists/rockyou.txt -f rockyou.dat -n rockyou.idx

    # Étape 4 : lancer asleap contre la capture
    asleap -r capture-01.cap -f rockyou.dat -W rockyou.idx

## Options

    -i IFACE    Live capture interface (monitor mode)
    -r FILE     Input pcap file
    -f FILE     Dictionary data file (.dat)
    -W FILE     Dictionary index file (.idx)
    -n FILE     Alternative: specify just the base name
    -s SSID     Filter by SSID
    -b BSSID    Filter by BSSID
    -V          Verbose output

## Conseils

- LEAP est considéré comme cryptographiquement cassé : les attaques par dictionnaire sont très efficaces
- MS-CHAPv2 (utilisé dans PEAP) est aussi vulnérable mais nécessite de capturer le bon échange
- À utiliser sur des cibles WPA Enterprise ; pour du WPA-PSK, utilisez plutôt hashcat/aircrack-ng
- genkeys doit être lancé avant asleap : l’index accélère significativement l’attaque
- Combinez avec hostapd-wpe pour des attaques evil twin afin de capturer des identifiants LEAP

Aide / Page de manuel

    asleap [options]

    -i IFACE    Capture interface (monitor mode)
    -r FILE     Read from pcap file
    -f FILE     Dictionary data file
    -W FILE     Dictionary index file
    -n FILE     Base name for dict files
    -s SSID     Target SSID
    -b BSSID    Target BSSID
    -V          Verbose