How to Hack Wi-Fi: Cracking WPA2-PSK Passwords Using Aircrack-Ng « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers.When Wi-Fi was first developed in the late 1990s, Wired Equivalent Privacy was created to give wireless communications confidentiality. WEP, as it became known, proved terribly flawed and easily cracked. You can read more about that in mybeginner's guide to hacking Wi-Fi.As a replacement, most wireless access points now use Wi-Fi Protected Access II with a pre-shared key for wireless security, known as WPA2-PSK. WPA2 uses a stronger encryption algorithm, AES, that's very difficult to crack—but not impossible. Mybeginner's Wi-Fi hacking guidealso gives more information on this.The weakness in the WPA2-PSK system is that the encrypted password is shared in what is known as the 4-way handshake. When a client authenticates to the access point (AP), the client and the AP go through a 4-step process to authenticate the user to the AP. If we can grab the password at that time, we can then attempt to crack it.Image viaShutterstockIn this tutorial from ourWi-Fi Hacking series, we'll look at usingaircrack-ngand adictionary attackon the encrypted password after grabbing it in the 4-way handshake. If you're looking for a faster way, I suggest you also check out my article onhacking WPA2-PSK passwords using coWPAtty.Step 1: Put Wi-Fi Adapter in Monitor Mode with Airmon-NgLet's start by putting our wireless adapter in monitor mode.Need a wireless network adapter?Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2017For this to work, we'll need to use a compatible wireless network adapter. Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grabour most popular adapter for beginners here.A roundup of Kali Linux compatible wireless network adapters.Image by SADMIN/Null ByteThis is similar to putting a wired adapter into promiscuous mode. It allows us to see all of the wireless traffic that passes by us in the air. Let's open a terminal and type:airmon-ng start wlan0Note that airmon-ng has renamed yourwlan0adapter tomon0.Step 2: Capture Traffic with Airodump-NgNow that our wireless adapter is in monitor mode, we have the capability to see all the wireless traffic that passes by in the air. We can grab that traffic by simply using theairodump-ngcommand.This command grabs all the traffic that your wireless adapter can see and displays critical information about it, including the BSSID (the MAC address of the AP), power, number of beacon frames, number of data frames, channel, speed, encryption (if any), and finally, the ESSID (what most of us refer to as the SSID). Let's do this by typing:airodump-ng mon0Note all of the visible APs are listed in the upper part of the screen and the clients are listed in the lower part of the screen.Step 3: Focus Airodump-Ng on One AP on One ChannelOur next step is to focus our efforts on one AP, on one channel, and capture critical data from it. We need the BSSID and channel to do this. Let's open another terminal and type:airodump-ng --bssid 08:86:30:74:22:76 -c 6 --write WPAcrack mon008:86:30:74:22:76is the BSSID of the AP-c 6is the channel the AP is operating onWPAcrackis the file you want to write tomon0is the monitoring wireless adapter*As you can see in the screenshot above, we're now focusing on capturing data from one AP with a ESSID of Belkin276 on channel 6. The Belkin276 is probably a default SSID, which are prime targets for wireless hacking as the users that leave the default ESSID usually don't spend much effort securing their AP.Step 4: Aireplay-Ng DeauthIn order to capture the encrypted password, we need to have the client authenticate against the AP. If they're already authenticated, we can de-authenticate them (kick them off) and their system will automatically re-authenticate, whereby we can grab their encrypted password in the process. Let's open another terminal and type:aireplay-ng --deauth 100 -a 08:86:30:74:22:76 mon0100is the number of de-authenticate frames you want to send08:86:30:74:22:76is the BSSID of the APmon0is the monitoring wireless adapterStep 5: Capture the HandshakeIn the previous step, we bounced the user off their own AP, and now when they re-authenticate, airodump-ng will attempt to grab their password in the new 4-way handshake. Let's go back to our airodump-ng terminal and check to see whether or not we've been successful.Notice in the top line to the far right, airodump-ng says "WPA handshake." This is the way it tells us we were successful in grabbing the encrypted password! That is the first step to success!Step 6: Let's Aircrack-Ng That Password!Now that we have the encrypted password in our fileWPAcrack, we can run that file against aircrack-ng using a password file of our choice. Remember that this type of attack is only as good as your password file. I'll be using the default password list included with aircrack-ng onBackTracknameddarkcOde.We'll now attempt to crack the password by opening another terminal and typing:aircrack-ng WPAcrack-01.cap -w /pentest/passwords/wordlists/darkc0deWPAcrack-01.capis the name of the file we wrote to in the airodump-ng command/pentest/passwords/wordlist/darkc0deis the absolute path to your password fileHow Long Will It Take?This process can be relatively slow and tedious. Depending upon the length of your password list, you could be waiting a few minutes to a few days. On my dual core 2.8 gig Intel processor, it's capable of testing a little over 500 passwords per second. That works out to about 1.8 million passwords per hour. Your results will vary.When the password is found, it'll appear on your screen. Remember, the password file is critical. Try the default password file first and if it's not successful, advance to a larger, more complete password file such as one of these.CrackStation's Password Cracking DictionarySkullSecurity's Password DictionariesStay Tuned for More Wireless Hacking GuidesKeep coming back, as I promise more advanced methods of hacking wireless in future tutorials. If you haven't seen the other Wi-Fi hacking guides yet, check them outhere. Particularly the one onhacking WEP using aircrack-ngandhacking WPA2-PSK passwords using coWPAtty.If you're looking for a cheap, handy platform to get started working with aircrack, check out our Kali Linux Raspberry Pi build usingthe $35 Raspberry Pi.A beginner Wi-Fi hacking kit.Image by SADMIN/Null ByteGet Started Hacking Today:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxAnd as always, if you have questions on any of this, please ask away in the comments below. If it's something unrelated, try asking in theNull Byte forum.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover image viaShutterstockRelatedHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Crack Wi-Fi Passwords—For Beginners!How To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedHack Like a Pro:How to Crack Passwords, Part 1 (Principles & Technologies)How to Hack Wi-Fi:Capturing WPA Passwords by Targeting Users with a Fluxion AttackHow To:Brute-Force WPA/WPA2 via GPUHow To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)Video:How to Crack Weak Wi-Fi Passwords in Seconds with Airgeddon on Parrot OSHow To:Hack Wi-Fi Networks with BettercapHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow to Hack Wi-Fi:DoSing a Wireless AP ContinuouslyHow To:Spy on Traffic from a Smartphone with WiresharkHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Automate Wi-Fi Hacking with Wifite2How To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3Hack Like a Pro:How to Hack into Your Suspicious, Creepy Neighbor's Computer & Spy on HimHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Bypass a Local Network Proxy for Free InternetHow To:Fix the Channel -1 Glitch in Airodump on the Latest Kernel