10 Steps to Hack a Wi-Fi Password

Introduction:

Aircrack-ng is an 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets have been captured.

It executes the standard FMS attack alongside a few enhancements like KoreK attack, and in addition, the all-new PTW attack, accordingly making the attack considerably speedier contrasted with other WEP cracking devices.

With the help these commands you will be able to hack WPA2/WPA Wi-Fi Access Points which use PSK (Pre-Shared Key) encryption.

The objective is to capture the WPA/WPA2 authentication handshake and then crack the PSK using aircrack-ng.

Here are the basic steps we will be going through:

Install the latest aircrack-ng
Start the wireless interface in monitor mode using airmon-ng
Start airodump-ng on AP channel with filter for BSSID to collect authentication handshake
[Optional] Use aireplay-ng to de-authenticate the wireless client
Run aircrack-ng to crack the WPA/WPA2-PSK using the authentication handshake

How it Works

Start Kali Linux and log in, preferably as root.

Step 1:

• Disconnect from all wireless networks, open a Terminal and type airmon-ng
• This will list all of the wireless cards that support monitor (not injection) mode. If no cards are listed, try disconnecting and reconnecting the adapter (if you’re using one) and check that it supports monitor mode.
• You can see here that my card supports monitor mode and that it’s listed as wlan0.

Step 2:

• Type airmon-ng start followed by the interface name of your wireless card. mine is wlan0,
• So my command would be airmon-ng start wlan0
• The “(monitor mode enabled)” message means that the card has successfully been put into monitor mode. Note the name of the new monitor interface, mon0.
  Type: config [interface of wireless card] down and hit Enter.
• Replace [interface of wireless card] with the name of the interface that you enabled mon0 on; probably called wlan0.
• This disables the wireless card from connecting to the internet, allowing it to focus on monitor mode instead.
• After you have disabled mon0 (completed the wireless section of the tutorial), you’ll need to enable wlan0 (or the name of the wireless interface), by typing: ifconfig [interface of wireless card] up and pressing Enter.
• Type: ifconfig [interface of wireless card] down and hit Enter.
• Replace [interface of wireless card] with the name of the interface that you enabled mon0 on; probably called wlan0.
• This disables the wireless card from connecting to the internet, allowing it to focus on monitor mode instead.
• After you have disabled mon0 (completed the wireless section of the tutorial), you’ll need to enable wlan0 (or the name of the wireless interface), by typing: ifconfig [interface of wireless card] up and pressing Enter.

STEP 3:

Type airodump-ng followed by the name of the new monitor interface, which is probably mon0.

Step 4:

• Airodump will now list all of the wireless networks in your area and a lot of useful information about them.
• Locate your network or the network that you have permission to the penetration test.
• Once you’ve spotted your network on the ever-populating list, hit Ctrl + C on your keyboard to stop the process. Note the channel of your target network.

Step 5:

• Copy the BSSID of the target network
• Now type this command: airodump-ng -c [channel] –bssid [bssid] -w /root/Desktop/ [monitor interface]
• Now type this command:
• airodump-ng -c [channel] –bssid [bssid] -w /root/Desktop/ [monitor interface]
• A complete command should look similar like this:
• airodump-ng -c 10 –bssid 00:14:BF:E0:E8:D5 -w /root/Desktop/ mon0
• Now press enter.

Step 6:

• Airodump with now monitor only the target network, allowing us to capture more specific information about it.
• What we’re really doing now is waiting for a device to connect or reconnect to the network, forcing the router to send out the four-way handshake that we need to capture in order to crack the password.
• Also, four files should show up on your desktop, this is where the handshake will be saved when captured, so don’t delete them!
• But we’re not really going to wait for a device to connect, no, that’s not what impatient hackers do.
• We’re actually going to use another cool-tool that belongs to the aircrack suite called aireplay-ng, to speed up the process.
• Instead of waiting for a device to connect, hackers can use this tool to force a device to reconnect by sending de-authentication (deauth) packets to one of the devices of the network, making it think that it has to reconnect with the network.
• in order for this tool to work, there has to be someone else connected to the network first, so watch the airodump-ng and wait for a client to show up. It might take a long time, or it might only take a second before the first one shows.
• If none show up after a lengthy wait, then the network might be empty right now, or you’re too far away from the network.

Step 7:

• Leave airodump-ng running and open a second terminal. In this terminal, type this command: aireplay-ng –0 2 –a [router bssid] –c [client bssid] mon0
• The –0 is a short cut for the deauth mode 2 is the number of deauth packets to send.
• -a indicates the access point/router’s BSSID
• -c indicates the client’s BSSID
• mon0 merely means the monitor interface

My complete command looks like this:

aireplay-ng –0 2 –a 00:14:BF:E0:E8:D5 –c 4C:EB:42:59:DE:31 mon0

Step 8:

• Upon hitting Enter, you’ll see aireplay-ng send the packets.
• If you were close enough to the target client, and the de-authentication process works, this message will appear on the airodump screen (which you left open):
• This means that the handshake has been captured, the password is in the hacker’s hands, in some form or another.
• You can close the aireplay-ng terminal and hit Ctrl + C on the airodump-ng terminal to stop monitoring the network, but don’t close it yet just in case you need some of the information later.

Step 9:

This concludes the external part of this tutorial.

• Open a new Terminal, and type in this command:
  aircrack-ng -a2 -b [router bssid] -w [path to wordlist] /root/Desktop/*.cap
• -a is the method aircrack will use to crack the handshake.
• -b stands for bssid, replace [router bssid] with the BSSID of the target router
• -w stands for wordlist
• /root/Desktop/*.cap is the path to the .cap file containing the password.

My complete command looks like this:

aircrack-ng –a2 –b 00:14:BF:E0:E8:D5 –w /root/wpa.txt /root/Desktop/*.cap

Step 10:

• Aircrack-ng will now launch into the process of cracking the password.
• Crack it if the password happens to be in the wordlist that you’ve selected. Sometimes, it’s not.
• If this is the case, you can try other wordlists.
• If you simply cannot find the password no matter how many wordlists you try, then it appears your penetration test has failed, and the network is at least safe from basic brute-force attacks.
• If the phrase is in the wordlist, then aircrack-ng will show it to you like this