WIFI Hacking : Cracking WPA/WPA2 using Aircrack-ng

Welcome Back my blooming Hackers !  :)

Today i'll show you how to hack WPA/WPA-2 wifi pass phrases using aircrack-ng suite. Aircrack-ng suite comes pr-installed in Kali Linux. You can see my extensive guide on how to set up Kali Linux.

In this attack we try to capture the 4-WAY HANDSHAKE which takes place during the authentication of any user when they try to connect to WPA/WPA2 secured AP. And, then perform a BRUTEFORCE attack on this captured 4-WAY HANDSHAKE.

So lets get started now and get our hands DiRtY ! XD

STEP #1

First of all, we have to put our wireless card in monitor mode. This will enable our wireless card to capture packets coming to and from all the AP's (Access Points) in our proximity.

We will use airmon-ng to put our wireless card in monitor mode.

Type iwconfig to know the name of the your wireless interface.

Mine's is wlan0.

Now type airmon-ng start wlan0  (in my case)  in the terminal. This will put wireless interface card in monitor mode.

Take note of your wireless interface name, mine is wlan0mon (highlighted in the image above) .

STEP #2

Now we need to find all the AP's in our proximity. For this purpose we will use airodump-ng.

Type airodump-ng <monitor mode interface name>  (Without <> ).
In my case :-  airodump-ng wlan0mon 
You will get an output something like this.










Take note of the BSSID and the Channel (CH) of the target AP.

STEP #3

Now we will capture the packets sent to and from the our target AP.

Type :- airodump-ng --bssid <BSSID of tagret AP> -c <Channel on which your AP is working on> --write <Name of the file you want to save 4-WAY HANDSHAKE to> <monitor mode interface name>

For eg:- airodump-ng --bssid **:**:**:**:**:** -c 1 --write tutorial wlan0mon

STEP #4

In this step we will perform a De-authentication attack on the AP and try to capture the 4-WAY HANDSHAKE between the AP and the user when it tries to reconnect to the AP after the De-auth. attack.

Open a new terminal window **DO NOT CLOSE THE CURRENT TERMINAL WINDOW** and type :

aireplay-ng --deauth 100 -a <BSSID OF TARGET> <MONITOR MODE INTERFACE NAME> 

After hitting enter your wireless card will send DE-authentication packets to the AP. 

STEP #5

Switch back to the first terminal in which we ran the airodump-ng command.

At the top right corner you will get the message if you are successful in capturing the 4-WAY HANDSHAKE.

STEP #6

Now we will do a brute force attack on the handshake we have captured.

For this we will use aircrack-ng. Type:

aircrack-ng -w <Wordlist Location> <.cap file in which handshake is saved>

There are some wordlists which come in Kali Linux in the directory :- /usr/share/wordlists


For eg:-

aircrack-ng -w /usr/share/wordlists/rockyou tutorial-01.cap

Now sit back, Relax and let aircrack do rest of the work. :P

This attack may take as much time as days weeks or even months to crack a pass phrase depending upon the complexity of the pass phrase used.

That's all for this tutorial.

Keep coming back for more.

And yes, Keep Hacking Keep Defending. XD XD