Aircrack-ng Suite
Before we get started with Aircrack-ng, we need to capture a WPA 4-way handshake
between the AP and a real client.
This is a process that we will use throughout the course.
The 4-way handshake contains the necessary information we need
to crack the passphrase.
For demonstration purposes, our AP has a relatively easy passphrase.
We will put our wlan0 interface in monitor mode with airmon-ng.
And now we have our wlan0mon interface.
We will run Airodump-ng to identify the channel of the target AP
and gather its BSSID to limit our capture.
Our target is the wifu AP, which operates on channel 3.
And it has one client.
The AUTH column shows the AP has an authentication type of PSK.
This is a good sign.
Aircrack-ng does not work when the authentication is Enterprise
and shown as MGT, as it requires a different set of tools.
Let’s update our airodump-ng command to incorporate this information
and save the packets to a capture file.
It is critical that we are on the same channel as the AP.
If we’re not, our attempts to deauthenticate the client
and capture the handshake will likely fail.
We’ll run airodump-ng with -c 3 to set our capture to channel 3,
-w wpa to write the output to a file with a “wpa” prefix,
–essid wifu to filter output to our ESSID,
and the bssid option to filter output to our BSSID.
With airodump-ng now saving packets to a file,
we’ll use aireplay-ng to deauthenticate, or disconnect,
the target AP and its connected client.
We’ll use the -0 1 option to deauthenticate once,
-a to target our BSSID,
-c to identify the associated client,
and finally specify our listening interface.
Aireplay-ng checks that the BSSID exists before sending
the deauthentication packets.
Once the client reconnects with the target AP,
airodump-ng will be able to capture a handshake.
Before terminating airodump-ng with Ctrl C,
let’s continue to capture traffic between the client and the AP.
This additional data will assist us in confirming the key is correct later on.
In some cases, the notification may not appear because a viable handshake
hasn’t been captured.
Most of the time this is because the signal is either too weak or too strong
and only one side, or a portion, of the handshake has been captured.
Or the device simply didn’t reconnect or was already out of range of the AP.
Some wireless drivers ignore directed deauthentication and only respond
to broadcast deauthentication.
We can run the same aireplay-ng deauthentication command
without the -c parameter to send broadcast deauthentication.
This will deauthenticate our target but the output displays a caveat.
Another reason a notification may not appear is if
802.11w Protected management frames are in use,
where unencrypted deauthentication frames are ignored.
Then the only course of action is to wait for a client to connect.
Now that we have captured a handshake,
cracking it is relatively easy with aircrack-ng.
With -w, we’ll specify the path to our wordlist,
a file containing commonly used passwords,
Next, we’ll use -e to indicate which ESSID to target,
-b to specify the BSSID,
and run it against our capture file.
Aircrack-ng successfully cracked our easy passphrase.
However, we should confirm it is correct.
It’s possible that we captured a client’s unsuccessful attempt
to connect to the network.
This is where we make use of the additional traffic we captured
between the client and the AP.
To confirm the key is correct, let’s decrypt our traffic with airdecap-ng.
We’ll run the command with -b to specify the BSSID.
Next we’ll include -e to specify the ESSID,
which is essential in decrypting WPA.
We’ll use -p to specify our cracked passphrase,
and run it against our capture file.
Our results show airdecap-ng successfully decrypted 240 packets.
In some cases, where there is a pause in decryptable traffic,
airdecap-ng may indicate “0” packets decrypted even if
the passphrase is correct.
Another way we can confirm our passphrase is to use Wireshark
and add it to a capture, as described in the Wireshark module.
Another option is to capture another handshake with airodump-ng
and capture more follow-on traffic.
We may be able to just capture traffic between the same client and AP,
then combine both capture files if little time has elapsed.
Rekeying can happen up to a hour after the initial handshake.