tutorial:
http://www.goarticles.com/cgi-bin/showa.cgi?C=1662237
dlm tu ada gambar, tapi 3 pic kebawah dlm tu hilang, ni link gambar:
3. Actually cracking the WEP password
Now leave this Konsole window up and running and open up a 2nd Konsole window. In this one type:
aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:55 ath0
http://i574.photobucket.com/albums/ss184/kumalynx/aireplay1.jpg
This will send some commands to the router that basically cause it to associate with your computer even though you are not officially connected with the password. If this command is successful, you should see about 4 lines of text print out with the last one saying something similar to "Association Successful

" If this happens, then good! You are almost there. Now type:
aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:55 ath0
http://i574.photobucket.com/albums/ss184/kumalynx/aireplay2.jpg
Remember the filename you made up earlier? Mine was "wepkey". Don't put a space in between it and -01.cap here. Type it as you see it. So for me, I would type wepkey-01.cap Once you have done this you will see aircrack fire up and begin to crack the password. typically you have to wait for more like 10,000 to 20,000 IV's before it will crack. If this is the case, aircrack will test what you've got so far and then it will say something like "not enough IV's. Retry at 10,000." DON'T DO ANYTHING! It will stay running...it is just letting you know that it is on pause until more IV's are gathered. Once you pass the 10,000 mark it will automatically fire up again and try to crack it. If this fails it will say "not enough IV's. Retry at 15,000." and so on until it finally gets it.
http://i574.photobucket.com/albums/ss184/kumalynx/aircrack1.jpg