The basic idea is to capture enough packets. Each
WEP data
packet has an associated 3-byte IV (Initialization Vector). With enough packets captured (usually between 20k and 40k packets), cracking
WEP is a non-issue.
First, you'd need to monitor traffic on the network by putting your network card in monitor mode and capture 20K+ data frames. This process can be very fast if your network card supports
packet injection with a tool like aireplay-ng and an
ARP replay attack.
Once the packets are captured, it is an easy task with a tool like aircrack-ng.
WEP can be easily cracked within minutes to a couple of hours, using
WPA/WPA2 with a strong passprhase is much more secure (it can take days).
Note that cracking
WEP requires simply capturing data.
WPA/WPA2-PSK, on the other hand, requires capturing a handshake between a client and the access point, and then applying brute force dictionary attack.
