If you want to know how to hack WiFi access point – just read this step by step aircrack-ng tutorial, run the verified commands and hack WiFi password easily.

1. Aircrack To Hack Wifi
2. Aircrack Wifi Hacker
3. Download Aircrack App
4. Aircrack Ng 1.2
5. Download Aircrack Wifi Hack

With the help a these commands you will be able to hack WiFi AP (access points) that use WPA/WPA2-PSK (pre-shared key) encryption.

The basis of this method of hacking WiFi lies in capturing of the WPA/WPA2 authentication handshake and then cracking the PSK using aircrack-ng.

How to hack WiFi – the action plan:

PASS WIFI is the only application for computers and mobile allowing to hack a WiFi. Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: Monitoring: Packet capture and expo.

1. Download and install the latest aircrack-ng
2. Start the wireless interface in monitor mode using the airmon-ng
3. Start the airodump-ng on AP channel with filter for BSSID to collect authentication handshake
4. [Optional] Use the aireplay-ng to deauthenticate the wireless client
5. Run the aircrack-ng to hack the WiFi password by cracking the authentication handshake

1. Aircrack-ng: Download and Install

The Latest Version Only: If you really want to hack WiFi – do not install the old aircrack-ng from your OS repositories. Download and compile the latest version manually.

Install the required dependencies:

Download and install the latest aircrack-ng (current version):

Ensure that you have installed the latest version of aircrack-ng:

2. Airmon-ng: Monitor Mode

Now it is required to start the wireless interface in monitor mode.

Monitor mode allows a computer with a wireless network interface to monitor all traffic received from the wireless network.

What is especially important for us – monitor mode allows packets to be captured without having to associate with an access point.

Find and stop all the processes that use the wireless interface and may cause troubles:

Start the wireless interface in monitor mode:

In the example above the airmon-ng has created a new wireless interface called mon0 and enabled on it monitor mode.

So the correct interface name to use in the next parts of this tutorial is the mon0.

3. Airodump-ng: Authentication Handshake

Cool Tip: Want to have some “fun”? Create a Linux fork bomb! One small string that is able to hang the whole system! Read more →

Now, when our wireless adapter is in monitor mode, we have a capability to see all the wireless traffic that passes by in the air.

This can be done with the airodump-ng command:

All of the visible APs are listed in the upper part of the screen and the clients are listed in the lower part of the screen:

Start the airodump-ng on AP channel with the filter for BSSID to collect the authentication handshake for the access point we are interested in:

Option	Description
-c	The channel for the wireless network
--bssid	The MAC address of the access point
-w	The file name prefix for the file which will contain authentication handshake
mon0	The wireless interface
--ignore-negative-one	Fixes the ‘fixed channel : -1’ error message

Now wait until airodump-ng captures a handshake.

If you want to speed up this process – go to the step #4 and try to force wireless client reauthentication.

After some time you should see the WPA handshake: 00:11:22:33:44:55 in the top right-hand corner of the screen.

This means that the airodump-ng has successfully captured the handshake:

4. Aireplay-ng: Deauthenticate Client

Cool Tip: Want to stay anonymous? Learn how to use PROXY on the Linux command line. Read more →

If you can’t wait till airodump-ng captures a handshake, you can send a message to the wireless client saying that it is no longer associated with the AP.

The wireless client will then hopefully reauthenticate with the AP and we’ll capture the authentication handshake.

Send deauth to broadcast:

Send directed deauth (attack is more effective when it is targeted):

Option	Description
--deauth 100	The number of de-authenticate frames you want to send (0 for unlimited)
-a	The MAC address of the access point
-c	The MAC address of the client
mon0	The wireless interface
--ignore-negative-one	Fixes the ‘fixed channel : -1’ error message

Cool Tip: Need to hack WiFi password? Don’t wast your time! Use “John the Ripper” – the fastest password cracker! Read more →

5. Aircrack-ng: Hack WiFi Password

Unfortunately there is no way except brute force to break WPA/WPA2-PSK encryption.

To hack WiFi password, you need a password dictionary.

And remember that this type of attack is only as good as your password dictionary.

You can download some dictionaries from here.

Crack the WPA/WPA2-PSK with the following command:

Option	Description
-w	The name of the dictionary file
-b	The MAC address of the access point
WPAcrack.cap	The name of the file that contains the authentication handshake

Cool Tip: Password cracking often takes time. Combine aircrack-ng with “John The Ripper” to pause/resume cracking whenever you want without loosing the progress! Read more →

WPA/WPA2 cracking has been a focus point in the community since many years. And we have tools to aim that focus like aircrack and hashcat . Some new advancements have been made to aid that focus in the past couple of years.

So, Cracking WPA/WPA2 has been quite a topic now. In this tutorial, we are going to cover one of the infamous tools 'hashcat' for cracking WPA/WPA2.

Hashcat which is primarily built for brute forcing different kind of hashes using different kind of attack vectors, supports cracking for two of badly known WPA/WPA2 attacks. Well, for the list of available hashes, you can check the hash modes section in the manual:

Aircrack To Hack Wifi

In previous, you might have seen or even worked with aircrack to crack WPA/WPA2 by capturing a 4-way handshake. But that was not anywhere close to how perfect could this tool be for the purpose. Besides, hashcat is a GPU + CPU maintained tool which makes it a lot more faster.

In short, if you own a GPU, always go for hashcat or else you could use an online service or buy out some GPU based server on Internet.

We will cover up with two famous WPA/WPA attacks, precisely the cracking of MIC (4-way handshake) and PMKID (1st packet/handshake). So, let's begin.

Installation

Hashcat is built to work on Windows, Linux and as well as on Mac. You can go to hashcat.net and download the binaries and follow the instruction for your operating system. What we are going to do here is clone a fresh copy of hashcat from github and manually install it on a debain based linux.

Preferably, you should use Kali Or Parrot but a similar distro like Ubuntu will work as well.

Update Your Repo's and install the following dependencies:

Clone hashcat from github and move to directory:

Finally, compile the binaries and we are all set with hashcat.

You may try printing the help manual for hashcat to check whether you have it installed perfectly or not.

Hcxtools:

Now, let's clone and compile hcxtools from github. It is basically a set of various files to convert and generate another version of the supplied input. We will use it to convert the captured traffic into a format understandable by hashcat.

First, clone the repo and move the hcxtools directory:

And finally, run the make command to compile binaries and make necessary changes in path.

After having the requirements installed, we move to the cracking part. Below this, i am dividing the tutorial into two parts, first we will crack the WPA/WPA2 using MIC aka 4-way handshake. While in second, i'll do cracking using PMKID.

PART A

Let's clear how the MIC cracking actually works. So, in this case, we need a valid 4-way handshake. The handshake consists of many keys that are interchanged during the authentication between the client and access point.

These independent keys are used to generate a common key named 'Message Integrity Code (MIC)'. This generated MIC is used to validate the given password by cracker.

STEP 1

Conversion to hccapx format

Supposing you already have a captured 4-way handshake using some tool like airodump, but you still need the proper format to supply it to hashcat. To convert it to a proper format (hccapx), you need another tool.

There are already some online services that you may use: https://hashcat.net/cap2hccapx/

But still in case you are wondering to do it locally, clone the hashcat-utils repo from github:

Finally, compile the binaries. After compiling, you will have the binaries under same directory. The binary file that we need is cap2hccapx.bin. To make sure, you have it correctly compiled, try to execute the file, it will throw you back the syntax:

So, after having it installed, use the below given syntax to convert the .cap file to .hccapx hashcat capture format.

So, this will generate a file by the name 'hashfile.hccapx', which is what we are going to use with hashcat. Now, you may move to whatever directory you want, since will be cracking the final format now.

STEP 2

Cracking WPA/WPA2 (handshake) with hashcat

With hashcat, there is a possibily of various attack vectors. We could do a straight dictionary attack, brute-force attack, combinator attack or even masks attack, i.e. making rules to find various possibilities of trying different characters at different positions.

Anyhow, let's study the actual cracking of WPA/WPA2 handshake with hashcat.

Dictionary Attack:

As named, you need a wordlist for it to work. Considering you have solid list of possible wifi passphrases, or if not, you can download the famous ones: https://www.wirelesshack.org/wpa-wpa2-word-list-dictionaries.html

Launch the following command for dictionary attack:

-a: specifies cracking mode. In our case it's dictionary mode and '/path/to/dict.txt' is complete path to the wordlist.

• m: hash mode. Specifies what type of hash we are dealing with.

In Case You Receive issues regarding Intel CPU or 'No devices found/left', use --force argument to force the usage of your device.

Brute-Force Attack:

The Brute-force is different than the dictionary attack. Here, we try to replace every character at every possible position in a specified length from a given charset. For example, in a string of length 8, we can try every character from A-Z at every postion in this string.

That's how brute-forcing works and hence very time-consuming. Launch the following command to start your first attempt for brute-forcing:

-a: specifies the cracking mode and here the value 3 indicates, we are running a brute-force attack.
?d?d?d?d?d?d?d?d: is the brute-forcing rule here. It specifies what kind of values to check, where to replace and also assumes how much time could it take to crack the key.

The above mask i.e. '?d?d?d?d?d?d?d?d' states to check a string of length 8 with a digit at every position. You can study about mask attack here: Hashcat Mask Attack .

PART B

Part A was about the handshake cracking. Whilst now, we are going to crack PMKID with hashcat. The PMKID is located in the 1st packet of 4-way handshake and hence it's kind of more useful because we don't need a complete handshake.

The algorithm to compute PMKID is given which is quite easier than that of MIC.

Let the cracking begin for PMKID.

STEP 1

Getting the PMKID hash

The first thing to proceed with PMKID cracking is the pmkid hash. To generate it we need the first packet of the 4-way handshake. Considering you already have that, we will extract the hash from the captured file.

Let's do the conversion. Execute the below command

This will generate a file by the name pmkid.hash that we will use with hashcat to do the cracking.

STEP 2

Cracking WPA/WPA2 (PMKID) with hashcat

Aircrack Wifi Hacker

Just like previous part, we will apply the same rules here except for the hash mode argument. The hash mode value for PMKID cracking is 16800.

Dictionary Attack:

As per syntax we have back in the PART A section for dictionary attack, we will use that very same syntax except for the -m argument which defines what kind of hash we want to crack. We will be cracking pmkid (16800) this time.

While this would crack the key by looping through each line given in the wordlist.

Brute-Force Attack:

We will do same here as last section i.e. providing a mask to crack the hash. This time, just to show how powerful these masks could be, i'll use a different one. So, execute the command for brute-force attack:

The above mask will create combinations of string of length 8 with every alphabet at every possible position. And this sounds like a huge combination that may take a lot of time to complete. To make the attack more faster, we can use the GPU.

CPU/GPU

Now, getting into CPU/GPU thing, we just need to know that GPU is a lot more faster than CPU and hashcat have the ability to do cracking on your GPU. Hashcat has following three device modes which can be changed via -d argument:

• 1: CPU which is by default, selected.

• 2: GPU

Download Aircrack App

• 3: DSP, Co-processor.

You can use one of these devices according to what's more suitable for you. For example,

Aircrack Ng 1.2

To accomplish PMKID attack on GPU. That's it, i.e. cracking WPA/WPA2 via hashcat.

Conclusion

The conclusion that can be drawn out of all above is that hashcat is not just limited for a number of hashes, infact it's applicable to a wide range of hashes and other possibilities including mixes and concatenated strings. We learned to crack WPA/WPA2 using hashcat.

Download Aircrack Wifi Hack

Besides, hashcat is known of it's power, stability and speed by operating on GPU. It also gives us the possibility of mask attack which let us play with possibilities of testing thousand of thousands strings against the hash.