arsenal/wifite

wifite

wireless attack automation · GPL-2.0

The automation layer over the whole wireless toolkit. It scans, picks targets, and runs the right attack for each, driving aircrack-ng, hcxdumptool, and reaver for you.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01One command, the whole workflow

Everything in the other wireless guides, monitor mode, scanning, capturing PMKIDs and handshakes, deauthing a client, trying WPS, converting and handing off to a cracker, wifite strings together automatically. You run one command, it shows you the networks in range, you choose which of yours to test, and it works through the best attacks for each in turn. It is the fastest way to audit several of your own networks in one sitting, and a good way to learn the order the underlying tools run in.

» Captures PMKIDs with hcxdumptool and handshakes with the aircrack-ng suite.

» Tries WPS Pixie Dust and PIN attacks via reaver and bully where applicable.

» Converts captures and can crack with a wordlist automatically.

» Records every recovered key so you have a clear result at the end.

02Install and dependencies

wifite is a wrapper, so it is only as capable as the tools behind it. Install it alongside the suites it drives; on a security distro they are already present. It checks for its dependencies at startup and tells you what is missing.

$ sudo apt install wifite # Debian / Kali

$ sudo dnf install wifite # Fedora

$ # Gentoo / any: git clone https://github.com/kimocoder/wifite2

» If wifite reports a tool as missing at launch, install that one; it will skip the attacks that need it rather than fail outright.

↑ contents

03Scan and choose your targets

Run wifite as root. It puts your card into monitor mode (use --kill to stop interfering services), scans, and builds a live numbered list. Let it run until your networks appear with clients, then press ctrl+c to stop scanning and pick.

$ sudo wifite --kill

» Select only the number for a network you own. Here that is 1, HomeLab. Never type all unless every network listed is yours, which in the open air it will not be.

04Let it work the target

Once you choose, wifite runs each applicable attack in order and reports as it goes. For a WPA2 network with a client it will try PMKID, then handshake capture with a deauth, then WPS if present. You can skip the current attack with ctrl+c without quitting the whole run.

» wifite captured the PMKID client-free, saved the hash, and cracked it against the default wordlist, all without you typing another command. Point it at a bigger wordlist with --dict when you want a tougher test.

$ sudo wifite --kill --dict /usr/share/wordlists/rockyou.txt

05Read the results

At the end wifite prints a summary and stores every recovered key, so you have a record of exactly which of your networks fell and to what. The saved captures stay on disk for cracking later with a stronger setup if the quick attempt failed.

$ sudo wifite --cracked

» A key in that table for your own network is the finding. The captures wifite could not crack are still in the hs/ folder as 22000 files, ready for hashcat with rules and masks.

↑ contents

06If wifite cracks it, so can anyone

wifite is the attacker's convenience, so passing its test is a meaningful bar. The fixes are the combined lessons of the whole wireless group.

» A long random passphrase defeats the PMKID and handshake cracking that wifite automates.

» Disable WPS so the reaver and bully stage finds nothing (see the reaver guide).

» Retire any WEP network wifite lists; it will crack those almost instantly.

» Move to WPA3 where you can, which blunts the offline attacks at the protocol level.

» Re-run wifite against your own networks after each change until the summary comes back empty.

The goal is a clean run: wifite lists your network, works every attack it has, and recovers nothing. Get there and you have beaten the easy attacker, which is most of them.

↑ contents