How to Hack Wi-Fi: Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking Tools « Null Byte :: WonderHowTo

Welcome back, my fledgling hackers!In the first part of my series onWi-Fi hacking, we discussed thebasic terms and technologiesassociated with Wi-Fi. Now that you have a firm grip on what Wi-Fi is exactly and how it works, we can start diving into more advance topics onhow to hack Wi-Fi.In this article, we'll take a look at the world's best Wi-Fi hacking software,aircrack-ng, which we previously used tobump your annoying neighbor off their own Wi-Fi network. We'll be using aircrack-ng in nearly all of the subsequent hacks, so I think it's wise to start with some basics on what is included and how to use everything.Need a wireless network adapter?Buy the Best Wireless Network Adapter for Wi-Fi Hacking in 2017For this to work, we'll need to use a compatible wireless network adapter. Check out our 2017 list of Kali Linux and Backtrack compatible wireless network adapters in the link above, or you can grabour most popular adapter for beginners here.Check out our post on picking the best adapter for Wi-Fi hacking!Image by SADMIN/Null ByteFirst of all, aircrack-ng is not a single tool, but rather a suite of tools for manipulating and cracking Wi-Fi networks. Within this suite, there is a tool calledaircrackfor cracking passwords, but to get to the cracking we need to do several steps using other tools. In addition, aircrack-ng is capable of doing DOS attacks as well rogue access points, caffe latte, evil twin, and many others.So, let's get started with the aircrack-ng suite!Quick NoteThengstands fornew generation, as aircrack-ng replaces an older suite calledaircrackthat is no longer supported.Step 1: IwconfigBefore we get started with aircrcak-ng, we need to make certain thatBackTrackrecognizesyour wireless adapter. We can do this within any Linux system by typing:bt > iwconfigWe can see here that BackTrack recognizes my USB wireless card, and it tells me that it's capable of 802.11bgn, that the ESSID is off, that the mode is managed, etc.Okay, now we're ready to start using aircrack-ng.Step 2: Airmon-NgThe first tool we will look at and need in nearly ever WiFi hack isairmon-ng, which converts our wireless card into a promiscuous mode wireless card. Yes, that means that our wireless card will hookup with anyone!Well, that's almost correct. When our network card is in promiscuous mode, it means that it can see and receive all network traffic. Generally, network cards will only receive packets intended for them (as determined by the MAC address of the NIC), but with airmon-ng, it will receive all wireless traffic intended for us or not.We can start this tool by typingairmon-ng, theaction(start/stop), and then theinterface(mon0):bt > airmon-ng start wlan1Airmon-ng responds with some key information on our wireless adapter including the chipset and driver. Most importantly, note that it has changed the designation for our wireless adapter from wlan1 to mon0.Step 3: Airodump-NgThe next tool in the aircrack-ng suite that we will need isairodump-ng, which enables us to capture packets of our specification. It's particularly useful in password cracking.We activate this tool by typing theairodump-ngcommand and therenamed monitor interface(mon0):bt >airodump-ng mon0As we can see in the screenshot above, airodump-ng displays all of the APs (access points) within range with their BSSID (MAC address), their power, the number of beacon frames, the number of data packets, the channel, the speed, the encryption method, the type of cipher used, the authentication method used, and finally, the ESSID.For our purposes of hacking WiFi, the most important fields will be the BSSID and the channel.Step 4: Aircrack-NgAircrack-ngis the primary application with the aircrack-ng suite, which is used for password cracking. It's capable of using statistical techniques to crack WEP and dictionary cracks for WPA and WPA2 after capturing the WPA handshake.Step 5: Aireplay-NgAireplay-ngis another powerful tool in our aircrack-ng arsenal, and it can be used to generate or accelerate traffic on the AP. This can be especially useful in attacks like a deauth attack that bumps everyone off the access point, WEP and WPA2 password attacks, as well as ARP injection and replay attacks.Aireplay-ng can obtain packets from two sources:A live stream of packets, orA pre-captured pcap fileThe pcap file is the standard file type associated with packet capture tools like libpcap and winpcap. If you've ever used Wireshark, you've most likely worked with pcap files.We can see in the screenshot above of the first half of the aireplay-ng help screen, that aireplay can filter by the BSSID of the access point, the MAC address of either source or destination, the minimum and maximum packet length, etc. If we scroll down the help screen, we can see some of the attack options using aireplay-ng:These include deauth, fake deauth, interactive, arpreplay (necessary for fast WEP cracking), chopchop (a form of statistical technique for WEP packet decrypting without cracking the password), fragment, caffe latte (attacking the client side), and others.These four tools in the aircrack-ng suite are our Wi-Fi hacking work horses. We'll use each of these in nearly every Wi-Fi hack. Some of our more hack-specific tools include airdecap-ng, airtun-ng, airolib-ng and airbase-ng. Let's take a brief look at each of these.Step 6: Airdecap-NgAirdecap-ngenables us to decrypt wireless traffic once we have cracked the key. In other words, once we have the key on the wireless access point, not only can we use the bandwidth on the access point, but with airdecap-ng we can decrypt everyone's traffic on the AP and watch everything they're doing (the key is used for both access and for encryption).Step 7: Airtun-NgAirtun-ngis a virtual tunnel interface creator. We can use airtun-ng to set up an IDS on the wireless traffic to detect malicious or other traffic on the wireless access point. So, if we're looking to get an alert of a particular type of traffic (see my tutorial oncreating a PRISM-like spy tool), we can use airtun-ng to set up a virtual tunnel that connects to an IDS like Snort to send us alerts.Step 8: Airolib-NgAirolib-ngstores or manages ESSID's (the name of the access point) and password lists that will help speed up WPA/WPA2 password cracking.Step 9: Airbase-NgAirbase-ngenables us to turn our laptop and wireless card into an AP. This can be especially useful when doing a rogue access point or evil twin attacks. Basically, airbase-ng allows us to attack the clients, rather than the AP, and encourages the clients to associate with us rather than the real AP.That's It for NowThese are the primary tools in the aircrack-ng suite that we'll be using as we explore Wi-F hacking. There are other tools, but these are the ones we'll be focusing on. If you're looking for a cheap, handy platform to get started working with aircrack, check out our Kali Linux Raspberry Pi build usingthe $35 Raspberry Pi.Aircrack-ng works great on the Kali Linux Raspberry Pi.Image by SADMIN/Null ByteGet Started Hacking Today:Set Up a Headless Raspberry Pi Hacking Platform Running Kali LinuxIn our next guide, we'll start our exploration of wireless hacking techniques with creating a evil twin access point, so make sure to keep coming back. If you have any questions, please comment below or start a discussion in theNull Byte forumand we'll try to help you out.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseAerial symbolandWireless routerphotos via ShutterstockRelatedHow To:Share Wi-Fi Adapters Across a Network with Airserv-NgHow to Hack Wi-Fi:Choosing a Wireless Adapter for HackingHow to Hack Wi-Fi:Cracking WEP Passwords with Aircrack-NgHow to Hack Wi-Fi:Breaking a WPS PIN to Get the Password with BullyHack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedHow to Hack Wi-Fi:Hunting Down & Cracking WEP NetworksHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords Using Aircrack-NgHow to Hack Wi-Fi:Selecting a Good Wi-Fi Hacking StrategyHow to Hack Wi-Fi:Getting Started with Terms & TechnologiesHow To:Hack 5 GHz Wi-Fi Networks with an Alfa Wi-Fi AdapterHow To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon)How To:Hack Wi-Fi Networks with BettercapHow To:Spy on Network Relationships with Airgraph-NgHow to Hack Wi-Fi:DoSing a Wireless AP ContinuouslyHow to Hack Wi-Fi:Cracking WPA2-PSK Passwords with CowpattyHow To:Crack WPA & WPA2 Wi-Fi Passwords with PyritHow to Hack Wi-Fi:Creating an Evil Twin Wireless Access Point to Eavesdrop on DataHow To:Turn on Google Pixel's Wi-Fi Assistant to Get Secure Access on Open NetworksHow To:Check if Your Wireless Network Adapter Supports Monitor Mode & Packet InjectionHow To:Automate Wi-Fi Hacking with Wifite2How to Hack Wi-Fi:Disabling Security Cameras on Any Wireless Network with Aireplay-NgAndroid Basics:How to Connect to a Wi-Fi NetworkHow To:Identify Antivirus Software Installed on a Target's Windows 10 PCHow To:Hack Open Hotel, Airplane & Coffee Shop Wi-Fi with MAC Address SpoofingNews:Project Zero Finds iPhone & Android Open to Bugs in Broadcom's Wi-Fi ChipsHow To:Hunt Down Wi-Fi Devices with a Directional AntennaHow To:The Beginner's Guide to Defending Against Wi-Fi HackingHow To:This Widget Lets You Open Wi-Fi Settings Faster, Share Passwords & More on Your iPhoneHow To:Hack WiFi Passwords for Free Wireless Internet on Your PS3How to Hack Wi-Fi:Creating an Invisible Rogue Access Point to Siphon Off Data UndetectedHow To:Crack Wi-Fi Passwords—For Beginners!How To:iOS 6 Broke Your Wi-Fi? Here's How to Fix Connection Problems on Your iPhone or iPadHow To:Having Connection Issues on Android Pie? Turn Off 'Turn on Wi-Fi Automatically'How To:Fix the Wi-Fi Roaming Bug on Your Samsung Galaxy S3How To:See Who's Using Your Wi-Fi & Boot Them Off with Your AndroidHow to Hack Wi-Fi:Cracking WPA2 Passwords Using the New PMKID Hashcat AttackHow To:Hack Wi-Fi & Networks More Easily with Lazy ScriptHow To:How Hackers Steal Your Internet & How to Defend Against ItHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android Device