home/wardriving kit

wardriving kit

Wi-Fi reconnaissance, mapping, and hardening · for your own networks

The tools, the hardware, and the workflow to see your wireless estate the way an attacker would, then close what you find. Built for IT officers and network admins who would rather discover their own weak Wi-Fi before a criminal does.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01What wardriving is

Wardriving is moving through an area, by car, on foot, or on a bike, while a device passively logs the wireless networks it hears: their names, channels, signal strength, encryption, and, with a GPS attached, where each one was heard. It was named in 2001, a nod to the film WarGames, and WarFi takes its name from the same root. Done passively, it only listens to the beacons access points already broadcast to everyone in range.

02Why a defender wardrives

Criminals wardrive to find soft targets. A systems or network administrator should wardrive their own estate for the same reason a locksmith walks the building: to see exactly what an attacker sees. A drive around your own offices reveals rogue access points someone plugged in, Wi-Fi bleeding out into the car park, forgotten gear still on WEP, and WPS left switched on. You cannot harden what you have not measured.

» The whole of this kit points one way: find your wireless weaknesses before someone else does, then close them.

03The line that matters

Passively listening to beacons and mapping them is generally lawful. Connecting to, deauthenticating, or cracking a network you do not own is illegal access. Everything active in this kit is for your own networks, or an engagement with written scope.

↑ contents

04The wireless adapter

Software is only as good as the radio under it. You need a USB Wi-Fi adapter that supports monitor mode, listening to all traffic rather than just your own, and ideally packet injection. The common, well-supported chipsets are the Atheros AR9271 for 2.4 GHz and the Realtek RTL8812AU for dual-band, sold in Alfa cards among others. A laptop's built-in card usually cannot do monitor mode well, if at all.

$ sudo airmon-ng start wlan0

$ iw dev

» airmon-ng puts the adapter into monitor mode and names the monitor interface, often wlan0mon. iw dev lists your interfaces and their modes. If monitor mode fails, the chipset or driver is the problem, not the software.

05Antennas

The antenna decides how far you hear. An omnidirectional antenna listens in every direction, which suits driving. A directional antenna, a yagi or a panel, hears much farther in one direction, which suits checking how far a specific network leaks. Higher gain is not simply better; it narrows the pattern.

» For a first wardrive, a modest omni on the roof of the car is plenty. Reach for a directional only when you are measuring one target's signal bleed.

06GPS

Without position, a wardrive is just a list; with it, every network gets a location and your logs become a map. A cheap USB GPS dongle feeding gpsd is the standard setup.

$ sudo apt install gpsd gpsd-clients

$ sudo gpsd /dev/ttyUSB0 -F /var/run/gpsd.sock

$ cgps -s

» gpsd reads the dongle, and cgps confirms you have a satellite fix before you start driving. Kismet and the others then pull position straight from gpsd.

07The rig

The computer can be a laptop or a Raspberry Pi. A Pi with the adapter, a GPS, and a power bank makes a small headless wardriving box you can leave running on a shelf or in the boot of a car.

» Mind the power. Monitor mode and a couple of radios draw more than a phone charger expects, so size the battery for the length of the drive.

↑ contents

08What to put in the bag

A wardriving kit is mostly hardware. Here is the gear that complements the software, from a bare-minimum starter to a fuller rig.

» A laptop running Linux; Kali bundles most of the tools. Or a Raspberry Pi for a small headless box.

» A monitor-mode, injection-capable USB Wi-Fi adapter. An Alfa AWUS036NHA (Atheros AR9271, 2.4 GHz) or AWUS036ACM (dual-band) are the safe, well-supported picks.

» Antennas: a magnetic-mount omni for driving, and optionally a directional yagi or panel to measure one network's reach.

» A USB GPS dongle that gpsd supports; u-blox based ones are reliable.

» A powered USB hub if you run more than one radio, so the ports do not brown out.

» A power bank sized for the drive, plus a car charger.

» For a Pi build: a microSD card with the OS flashed, and a small case.

» Starter kit: a laptop, one Alfa adapter, a magnetic omni, and a GPS dongle. That alone does a real wardrive. Add the second radio, the directional antenna, and the Pi when you want more range and a hands-free box.

09Install the software

Get the whole toolset on in one go before you touch the radio.

$ sudo apt install kismet aircrack-ng hcxdumptool hcxtools gpsd gpsd-clients reaver wifite

» Kali ships most of these already. On Debian or Ubuntu the line above covers it. On Gentoo, emerge the equivalents; a few live in the GURU overlay. Confirm each landed with which kismet, which hcxdumptool, and so on.

10Plug in and enable monitor mode

Monitor mode is what lets the adapter hear every nearby network, not just one it has joined. A few commands get you there.

$ lsusb

$ sudo airmon-ng check kill

$ sudo airmon-ng start wlan0

$ iw dev

» lsusb confirms the system sees the adapter. airmon-ng check kill stops the processes that fight for the radio, and it will drop your normal Wi-Fi, so run it on a wired or spare connection. airmon-ng start puts the card into monitor mode and names the interface, usually wlan0mon, which iw dev then shows as type monitor.

11Your first capture

Now bring the pieces together for a first capture while parked, before you drive.

$ sudo gpsd /dev/ttyUSB0 -F /var/run/gpsd.sock

$ cgps -s

$ sudo kismet -c wlan0mon

» Start gpsd and wait for cgps to show a fix. Then start Kismet on the monitor interface and open localhost:2501 in a browser. Networks should appear within seconds, each with a location once the GPS has locked. If you see networks and coordinates, the kit works, and you can drive.

12When something does not work

» Adapter will not enter monitor mode: usually the wrong chipset or a missing driver. Check lsusb against the known-good chipsets, and install the driver for Realtek cards.

» No GPS fix: the dongle needs open sky and a minute or two on a cold start. cgps should show the satellite count climbing.

» Kismet sees nothing: confirm you pointed it at the monitor interface (wlan0mon), not the plain one, and that airmon-ng check kill actually ran.

» Interface name keeps changing: some systems rename to wlan0mon, others keep wlan0 in monitor mode. Always check iw dev for the real name before starting a tool.

↑ contents

13Kismet, the core scanner

Kismet is the heart of the kit. It passively captures Wi-Fi, and with plugins Bluetooth and more, logs every access point and client it hears, and records channel, encryption, and signal over time.

$ sudo kismet -c wlan0mon

» Point it at your monitor interface. Kismet serves a web interface on localhost:2501 where you watch networks appear live, and it writes a .kismet log you analyse or map later.

14Geotagging in Kismet

With gpsd running, Kismet tags every detection with a location automatically.

» Start gpsd first, confirm a fix with cgps, then start Kismet. In the web interface each network now carries coordinates, which is what makes the later map possible. No GPS, no map.

15Reading what Kismet shows

» Encryption: open and WEP networks jump out as immediate problems.

» WPS: a network advertising WPS is a PIN-attack target.

» Clients: devices probing for old network names reveal where they have connected before.

» Signal: strong signal far from the building means your Wi-Fi is bleeding into public space.

16bettercap for live recon

bettercap is the modern complement: a live, scriptable view of Wi-Fi and Bluetooth LE, better for a stationary sweep of one site than for a drive.

$ sudo bettercap -iface wlan0mon

$ wifi.recon on

$ ble.recon on

» Inside bettercap, wifi.recon on starts listening and wifi.show lists what it finds. ble.recon on does the same for Bluetooth LE, which matters as more devices speak Bluetooth every year.

↑ contents

17Capturing with hcxdumptool

To test your own Wi-Fi passphrase strength you first need a handshake or a PMKID. hcxdumptool is the current standard, and it can grab a PMKID from an access point without any client being connected.

$ sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

» It writes a pcapng capture. Let it run near the target access point until it reports a PMKID or handshake. On your own network, this is how you collect the material to measure your passphrase.

Run this only against access points you own or are authorized to test.

18Converting with hcxtools

hashcat cannot read a raw capture directly. hcxtools converts it into hashcat's format.

$ hcxpcapngtool -o hash.hc22000 capture.pcapng

» The .hc22000 file is what hashcat cracks, using mode 22000, the modern WPA format. If the tool reports no usable hashes, the capture did not yet contain a full handshake or a PMKID.

19Capturing with aircrack-ng

The classic alternative: airodump-ng captures handshakes, and you can prompt one by waiting for a device to reconnect.

$ sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

» It writes cap-01.cap, which both aircrack-ng and hashcat can read. On your own network, reconnecting one of your own devices produces the handshake you need.

↑ contents

20Measuring your passphrase

Now the point: how strong is your Wi-Fi passphrase, really? Crack your own captured hash and find out.

$ hashcat -m 22000 hash.hc22000 wordlist.txt

$ hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

» The first tries a wordlist, the second a pure eight-digit mask, which is common for default or lazy passphrases. If your own passphrase falls in minutes, so would it for anyone else. That result is the argument for a long, random passphrase.

Only your own hashes. Cracking someone else's is a crime.

21Testing WPS

WPS lets a device join with an eight-digit PIN, and that PIN is brute-forceable, sometimes in seconds through the Pixie Dust flaw. reaver and bully test it.

$ sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K

» -K runs the Pixie Dust attack. If your own router falls to it, the fix is simple and important: turn WPS off. That one setting closes a whole class of attack.

22Automation

Typing each step per network is slow, especially in the field. wifite and airgeddon wrap the whole flow.

$ sudo wifite

» wifite scans, lets you pick targets, and runs capture, PMKID, and WPS attempts in order. airgeddon is a menu-driven alternative. Both are convenience over the tools above, not magic; know what they are doing underneath before you trust the output.

↑ contents

23Getting a map out of Kismet

A wardrive's value is the map. Modern Kismet logs to a .kismet database and ships helper tools to convert it, and giskismet turns the older XML logs into KML for Google Earth.

$ kismetdb_to_wiglecsv --in log.kismet --out drive.wiglecsv

$ giskismet -x Kismet.netxml -o map.kml

» kismetdb_to_wiglecsv makes a file you can upload to WiGLE; giskismet makes a KML you open in Google Earth, every network pinned where you heard it and coloured by encryption. Either way you go from a log to a picture of your coverage, your rogue access points, and your weak spots.

24WiGLE

WiGLE.net is a global, crowd-sourced wardriving database with its own Android app. You can log a drive on a phone and upload it, or compare your area against what others have already mapped.

» Useful for seeing your own footprint the way the wider world can, and for a quick drive when you do not want to carry the full rig. Upload only what you are comfortable sharing.

↑ contents

25What the drive tells you to fix

» Replace WEP and open networks; use WPA2-AES at minimum, WPA3 where it is supported.

» Use a long, random passphrase; your own crack time is the proof of why.

» Turn WPS off everywhere. reaver is the reason.

» Hunt rogue and look-alike access points; an unexpected SSID matching yours is an evil twin.

» Enable management frame protection (802.11w) to blunt deauthentication attacks.

» Separate guest and IoT onto their own network, away from anything that matters.

» Turn transmit power down or reposition access points so coverage does not spill far into public space.

26Make it a routine

A single wardrive is a snapshot. The value compounds when you repeat it.

» Drive your estate on a schedule, keep the Kismet logs and the KML, and compare each time. A new access point, a network that slipped back to WPS, a signal now reaching the street, all of these show up in the diff. Proactive, not reactive, which is the whole point.

Everything here is for networks you own or are cleared to test. Used that way, wardriving is one of the sharpest hardening tools a network admin has.

↑ contents