How to hack WiFi passwords (using Aircrack-ng, Reaver and Wifite)
NOTE: The prerequisite condition for this attack to work is that the target wifi network must have atleast one device connected to it.
1. Our first step is to determine the name of our wifi interface. This can be done with ifconfig command and would probably be either wlan0 or wlp3s0.
2. Then we’ll put our Wifi card into monitor mode. This is done in order to inject packets into a network. For this we’ll require the name of our wifi interface that we obtained in the above step and start it.
sudo airmon-ng start wlan0
3. Now your WiFI card will be put into monitor mode and your interface name would be changed to mon0. You’ll also be notified of several running process which could interfere with the following steps. Thus we’ll kill those processes now. Note there PID (Process ID) and issue the following command to terminate them.
4. Now we’ll capture packets from every wifi network in our vicinity and decide on our target. This will be done with the airodump-ng command
5. This command will display a lot of information about the nearby networks (also called Access Points or AP). Make sure that your target AP has ENC (Encryption) as WPA or WPA2 and AUTH (Authentication) as PSK. Note its BSSID and CH (Channel No.).
6. We’ll again use airodump-ng now to zero in on the target network and write this information in a file.
airodump-ng –bssid <BSSID> –channel <Channel_no> -w <file_name> mon0
7. Note the MAC address of the client that has to be kicked out. Open another terminal for now we’ll be performing a deauthentication attack to kick any device connected to the AP. We’ll use the –deauth switch to do this while specifying the number of deauth packets to be sent to it. Here we’ll be using 200.
aireplay-ng –deauth 200 -a <BSSID> -c <MAC_ADDRESS> mon0
8. Now the disconnected device will try to reconnect to the AP and this is where we’ll capture the handshake and write it in the file mentioned above. You’ll be able to see the handshake was captured in the previous terminal window on the top right.
9. Finally we’ll use a wordlist to brute force this encrypted password and obtain the decrypted password. Every pentesting distro such as kali, parrot, etc have built in wordlist files which can be used here. They are placed in /usr/share/wordlists. You can use rockyou.txt.
aircrack-ng <file_name> -w <location_of_wordlist>
10. Upon cracking the password it will be displayed on your screen.
Wifite is an automated tool and would thus take away a lot of hassle and command typing while providing you a simple to follow interface.
1. Start wifite as superuser.
2. Your wifi card will be automatically be put into monitor mode and the nearyby WiFi access points would be displayed on screen. Press Ctrl+C when you have decided upon your target.
3. Then you’ll be asked to select your target which can be done with its NUM (number) written on the left side.
4. Wifite will deauth the AP and capture the handshake. Then the captured handshake will be saved in a file and the decryption process will begin to crack the password.
5. In the end the wifi password would either be provided to you or the process would terminate stating that it was unable to find the password.
How To Get Out Of Monitor Mode
Now after using any of these tool your wifi card remains in monitor mode and is thus not able to connect to any wifi network. To resolve this the following commands need to be executed
1. sudo airmon-ng stop wlan0
2. sudo ifconfig wlan0 down
3. sudo iwconfig wlan0 mode managed
4. sudo ifconfig wlan0 up