wifi-cracking - Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and

项目说明

Wi-Fi Cracking

Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and Aircrack-ng/Hashcat.

This is a brief walk-through tutorial that illustrates how to crack Wi-Fi networks that are secured using weak passwords. It is not exhaustive, but it should be enough information for you to test your own 网络's security or break into one nearby. The attack outlined below is entirely passi only, nothing is broadcast from your computer) and it is impossible to detect provided that you don't actually use the password that you crack. An optional acti attack can be used to speed up the reconnaissance process and is described at the end of this document.

If you are familiar with this process, you can skip the descriptions and jump to a list of the commands used at the bottom. For a of suggestions and alternati, see the appendix. neal1991 and tiiime have also graciously provided translations to this document and the appendix in Chinese if you prefer those .

__DISCLAIMER: This software/tutorial is for educational purposes only. It should not be used for illegal activity. The author is not responsible for its use. Don't be a dick.__

Getting Started

This tutorial assumes that you:

Cracking a Wi-Fi Network

Monitor Mode

Begin by listing wireless interfaces that support monitor mode with:

If you do not see an interface listed then your wireless card does not support monitor mode 😞

We will assume your wireless interface name is wlan0 but be sure to use the correct name if it differs from this. Next, we will place the interface into monitor mode:

Run iwconfig. You should now see a new monitor mode interface listed (likely mon0 or wlan0mon).

Find Your Target

Start listening to 802.11 Beacon frames broadcast by nearby wireless routers using your monitor interface:

You should see output similar to what is below.

For the purposes of this demo, we will choose to crack the password of my 网络, "hackme". Remember the BSSID MAC address and channel (CH) number as displayed by airodump-ng, as we will need them both for the next step.

Capture a 4-way Handshake

WPA/WPA2 uses a 4-way handshake to authenticate devices to the 网络. You don't have to know anything about what that means, but you do have to capture one of these handshakes in order to crack the 网络 password. These handshakes occur whenever a device connects to the 网络, for instance, when your neighbor returns home from work. We capture this handshake by directing airmon-ng to monitor traffic on the target 网络 using the channel and bssid discovered from the previous command.

Now we wait... Once you' a handshake, you should see something like WPA handshake: bc:d3:c9:ef:d2:67 at the top right of the screen, just right of the current time.

If you are feeling impatient, and are comfortable using an acti, you can force devices connected to the target 网络 to reconnect, by sending malicious deauthentication packets at them. This often results in the capture of a 4-way handshake. See the [deauth attack section below for info on this.

Once you' a handshake, press ctrl-c to quit airodump-ng. You should see a .cap file wherever you told airodump-ng to save the capture (likely called -01.cap). We will use this capture file to crack the 网络 password. I like to rename this file to reflect the 网络 name we are trying to crack:

Crack the Network Password

The final step is to crack the password using the captured handshake. If you ha to a GPU, I highly recommend using hashcat for password cracking. I' a simple 工具 that makes hashcat super easy to use called nai. If you don't ha to a GPU, there are online GPU cracking services that you can use, like GPUHASH.me or OnlineHashCrack. You can also try your hand at CPU cracking with Aircrack-ng.

Note that both attack methods below assume a relatively weak user generated password. Most WPA/WPA2 routers come with strong 12 character random passwords that many users (rightly) lea. If you are attempting to crack one of these passwords, I recommend using the Probable-Wordlists WPA-length dictionary files.

#### Cracking With nai (recommended)

Before we can crack the password using nai, we need to convert our .cap file to the equi hashcat file format .hccapx. You can do this easily by either uploading the .cap file to < or using the cap2hccapx tool directly.

Next, download and run nai:

Nai uses dictionary, rule, combination, and mask (smart brute-force) attacks and it can take days or e to run against mid-strength passwords. The cracked password will be saved to hackme.pot, so check this file periodically. Once you' the password, you should see something like this as the contents of your POT_FILE:

Where the last two fields separated by : are the 网络 name and password respectively.

If you would like to use hashcat without nai see this page for info.

#### Cracking With Aircrack-ng

Aircrack-ng can be used for very basic dictionary attacks running on your CPU. Before you run the attack you need a wordlist. I recommend using the infamous rockyou dictionary file:

Note, that if the 网络 password is not in the wordfile you will not crack the password.

If the password is cracked you will see a KEY FOUND! message in the terminal followed by the plain text of the 网络 password.

Deauth Attack

A deauth attack sends forged deauthentication packets from your machine to a 客户端 connected to the 网络 you are trying to crack. These packets include fake "sender" addresses that make them appear to the 客户端 as if they were sent from the access point themselves. Upon receipt of such packets, most clients disconnect from the 网络 and immediately reconnect, pro you with a 4-way handshake if you are listening with airodump-ng.

Use airodump-ng to monitor a specific access point (using -c channel --bssid MAC) until you see a client (STATION) connected. A connected 客户端 look something like this, where is 64:BC:0C:48:97:F7 the client MAC.

Now, leave airodump-ng running and open a new terminal. We will use the aireplay-ng command to send fake deauth packets to our 客户端, forcing it to reconnect to the 网络 and hopefully grabbing a handshake in the process.

You can optionally broadcast deauth packets to all connected clients with:

Once you've sent the deauth packets, head back over to your airodump-ng process, and with any luck you should now see something like this at the top right: WPA handshake: 9C:5C:8E:C9:AB:C0. Now that you' a handshake you should be ready to [crack the 网络 password.

List of Commands

Below is a list of all of the commands needed to crack a WPA/WPA2 网络, in order, with minimal explanation.

Appendix

The response to this tutorial was so great that I' suggestions and additional material from community members as an appendix. Check it out to learn how to:

A Chinese of the appendix is also a.

Attribution

Much of the information presented here was gleaned from Lewis Encarnacion's awesome tutorial. Thanks also to the awesome authors and maintainers who work on Aircrack-ng and Hashcat.

O thanks to neal1991 and tiiime for translating this tutorial into Chinese. Further shout outs to yizhiheng, hiteshnayak305, enilfodne, DrinkMoreCodeMore, hi, cprogrammer1994, 0XE4, hartzell, zeeshanu, flennic, bhusang, t, gpetrousov, crowchirp and Shark0der who also provided suggestions and typo fixes on Reddit and GitHub. If you are interested in hearing some proposed alternatives to WPA2, check out some of the great discussion on this Hacker News post.

项目信息

开发语言：未知

Star 数：12655

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and Aircrack-ng/Hashcat展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。