arsenal/aircrack-ng

aircrack-ng

wifi auditing suite · GPL-2.0

The classic wifi security suite: put a card in monitor mode, capture a WPA handshake, and test how long your passphrase would survive an offline attack.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01What aircrack-ng actually is

aircrack-ng is not one program, it is a small toolbox that works together. airmon-ng prepares your wireless card, airodump-ng listens and records, aireplay-ng injects frames, and aircrack-ng does the final cracking. On your own network the point is simple: capture the four-way handshake your devices use to join, then see whether your passphrase can be guessed offline. If it can, so can an attacker sitting in the car park.

» airmon-ng: enable and disable monitor mode on your card.

» airodump-ng: scan for networks and capture packets to a file.

» aireplay-ng: inject frames, most often a deauthentication to force a reconnect.

» aircrack-ng: run a captured handshake against a wordlist.

02Install and check your card

aircrack-ng ships in every security distro and most package managers. The harder part is the card: it must support monitor mode and, for handshake capture, you do not even need injection, but for deauth you do. Atheros (ath9k) and some Ralink and MediaTek chipsets are the safe bets.

$ sudo emerge net-wireless/aircrack-ng # Gentoo

$ sudo apt install aircrack-ng # Debian / Ubuntu / Kali

$ sudo dnf install aircrack-ng # Fedora / RHEL

» If you see monitor in that list, the card and driver can do what you need. If you do not, no amount of command-line effort will fix it; you need a different adapter.

03Put the card in monitor mode

In normal (managed) mode a card only hands you traffic addressed to it. Monitor mode tells the card to report every frame in the air on that channel, which is what capture needs. airmon-ng also kills the background services that would otherwise grab the card back.

$ sudo airmon-ng check kill

$ sudo airmon-ng start wlan0

» Your interface is now wlan0mon. Use that name from here on. When you are done, sudo airmon-ng stop wlan0mon returns the card to normal and you can restart NetworkManager.

↑ contents

04Scan the air with airodump-ng

Run airodump-ng with no filters first to see everything around you. The top half lists access points, the bottom half lists clients. You want three columns: the BSSID (the AP's MAC), the CH (channel), and the ESSID (the network name). Note the channel of your target network, you will lock onto it next.

$ sudo airodump-ng wlan0mon

» Here the target HomeLab is on channel 6 with one client already associated. A connected client is what makes the next step fast: you can nudge it to reconnect and catch the handshake.

05Lock onto one network and record

Now pin airodump-ng to the target's channel and BSSID and write everything to a file. Staying on one channel means you will not miss the handshake while hopping. Leave this window running; it is your capture.

$ sudo airodump-ng -c 6 --bssid AA:BB:CC:11:22:33 -w homelab wlan0mon

» The prize is that top-right line: WPA handshake: AA:BB:CC:11:22:33. Once it appears, you have captured the four-way handshake and can stop. The -w homelab flag has been writing homelab-01.cap the whole time.

06Force a reconnect to catch the handshake

If no device joins while you watch, you can speed things up by deauthenticating a connected client. The client drops for a moment, reconnects automatically, and that reconnection is the handshake. Send only a few frames; a continuous flood is noisy, disruptive, and unnecessary.

$ sudo aireplay-ng --deauth 5 -a AA:BB:CC:11:22:33 -c 66:77:88:99:AA:BB wlan0mon

» Flip back to the airodump-ng window. Within a second or two the WPA handshake banner should appear. Targeting a specific client with -c is cleaner and more reliable than a broadcast deauth, and it only touches the one device you chose.

↑ contents

07Run the handshake against a wordlist

WPA2 cannot be brute-forced in the air; the only offline attack is to guess the passphrase and check it against the captured handshake. That is exactly what aircrack-ng does. Point it at a wordlist and the capture file. Speed depends on your CPU, but this is where you learn whether your passphrase is in a common list.

$ aircrack-ng -w /usr/share/wordlists/rockyou.txt homelab-01.cap

» KEY FOUND means your passphrase was in the list, which is the result you never want to see on your own network. If aircrack-ng exhausts the wordlist without a hit, it prints Passphrase not in dictionary. That is good news, but only as good as the list you tried.

08Hand the capture to hashcat for real speed

aircrack-ng cracks on the CPU. For a serious test against a large wordlist with rules, convert the capture and let a GPU do the work in hashcat, which is far faster. The modern path uses the hcxtools suite to produce a 22000-format hash.

$ hcxpcapngtool -o homelab.22000 homelab-01.cap

$ hashcat -m 22000 homelab.22000 /usr/share/wordlists/rockyou.txt

» See the hcxtools and hashcat guides for the full workflow. For wardriving-scale capture of many networks at once, hcxdumptool replaces the airodump-ng and aireplay-ng steps with a single efficient tool.

09A note on WEP

You will still meet WEP on old cameras, printers, and industrial kit. WEP is broken by design: capture enough data frames (the initialisation vectors) and aircrack-ng recovers the key by statistics, no wordlist needed, often in minutes. If you find WEP anywhere you are responsible for, that is the finding; there is nothing to crack, only something to replace.

$ aircrack-ng homelab-01.cap

» With enough IVs captured, aircrack-ng prints KEY FOUND and the key in hex. The lesson is not the technique, it is that any WEP network should be treated as already compromised.

10Turn the result into hardening

Everything above is a test you run so you can fix what it finds. The defensive takeaways are concrete and worth writing into your own checklist.

» Use WPA2 or WPA3 with a long passphrase that is not a word, a date, or a pattern; aim for a random passphrase of real length rather than something memorable.

» A long random passphrase defeats the offline attack entirely, because it will never be in a wordlist.

» Enable 802.11w (protected management frames) to blunt deauthentication; WPA3 requires it.

» Retire WEP and WPA-TKIP anywhere you find them; replace the device if it supports nothing better.

» Treat the capture-and-crack cycle as a periodic check, not a one-off, especially after anyone shares your wifi password.

If your own handshake cracks in seconds, that is not a failure of the exercise, it is the exercise working. Change the passphrase, enable PMF, and run it again until the wordlist comes up empty.

↑ contents