Hacking WPA/WPA2 Wi-Fi password with Kali Linux using aircrack-ng step-by-step 2019

PREPARING TO HACK WI-FI

1. Understand when you can legally hack Wi-Fi. In most regions, the only time you can hack a WPA or WPA2 network is when the network either belongs to you or belongs to someone who has given you explicit consent to hack the network.
   • Hacking networks that don’t meet the above criteria is illegal, and may constitute a federal crime.
2. Download the Kali Linux disk image. Kali Linux is the preferred tool for hacking WPA and WPA2. You can download the Kali Linux installation image (ISO) by doing the following:
   • Go to https://www.kali.org/downloads/ in your computer’s web browser.
   • Click HTTP next to the version of Kali you want to use.
   • Wait for the file to finish downloading.
3. Attach a flash drive to your computer. You’ll need to use a flash drive with at least 4 gigabytes of space for this process.
4. Make your flash drive bootable. This is necessary in order to be able to use the USB flash drive as an installation location.
   • You can also use a Mac for this step.
5. Place the Kali Linux ISO file on the flash drive. Open the flash drive, then drag the downloaded Kali Linux ISO file into the flash drive’s window.
   • Make sure you leave your USB flash drive plugged in after you finish this process.
6. Install Kali Linux. To install Kali Linux on your computer, do the following:
   • Prompt your Windows computer to restart.
   • Enter the BIOS menu.
   • Set your computer to start from your USB drive by finding the “Boot Options” (or similar) section, selecting your USB drive’s name, and moving it to the top of the list.
   • Save and exit, then wait for the Kali Linux installation window to appear (you may have to restart your computer one more time).
   • Follow the Kali Linux installation prompts.
7. Buy a Wi-Fi card that supports monitoring. You can find Wi-Fi cards online or in tech department stores. Make sure that your Wi-Fi card allows monitoring (RFMON), or you won’t be able to hack a network.
   • Many computers have built-in RFMON Wi-Fi cards, so you might want to try the first four steps of the next part before buying one.
   • If you’re using Kali Linux in a virtual machine, you will need a Wi-Fi card regardless of your computer’s card.
8. Log into your Kali Linux computer as root. Enter your root username and password when logging in.
   • You will need to be on your root account at all times during the hacking process.
9. Plug your Wi-Fi card into your Kali Linux computer. Doing so will immediately prompt the card to begin setting up and downloading drivers for itself; if prompted, follow the on-screen instructions to complete the setup. Once you’re done with this step, you can proceed with hacking your selected network.
   • If you’ve already set up the card on your computer before, you’ll still have to set it up for Kali Linux here by plugging it in.
   • In most cases, simply attaching the card to your computer will be enough to set it up.

PART2 HACKING WI-FI

1. Open your Kali Linux computer’s Terminal. Find and click the Terminal app icon, which resembles a black box with a white “>_” on it.
   • You can also just press Alt+Ctrl+T to open the Terminal.
2. Enter the Aircrack-ng installation command. Type in the following command, then press ↵ Enter: sudo apt-get install aircrack-ng
3. Enter your password when prompted. Type in the password you use to log into your computer, then press ↵ Enter. This enables root access for any other commands executed in Terminal.
   • If you open another Terminal window (as you may later in this article), you may have to run a command with the sudo prefix and/or enter your password again.
4. Install Aircrack-ng. Press Y when prompted, then wait for the program to finish installing.
5. Turn on airmon-ng. Type in the following command, then press ↵ Enter. airmon-ng
6. Find the monitor name. You’ll find this in the “Interface” column.
   • If you’re hacking your own network, it will usually be named “wlan0”.
   • If you don’t see a monitor name, your Wi-Fi card doesn’t support monitoring.
7. Begin monitoring the network. You can do so by typing in the following command and pressing ↵ Enter: airmon-ng start wlan0
   • Make sure you replace “wlan0” with the name of your target network if it’s different.
8. Enable a monitor mode interface. Enter the following command: iwconfig
9. Kill any processes that return errors. In some cases, your Wi-Fi card will conflict with running services on your computer. You can kill these processes by entering the following command: airmon-ng check kill
10. Review the monitor interface name. In most cases, the name will be something like “mon0” or “wlan0mon”.
11. Tell your computer to listen to nearby routers. To get a list of all routers in range, enter the following command: airodump-ng mon0
    • Make sure you replace “mon0” with whatever your monitor interface name was in the last step.
12. Find the router you want to hack. At the end of each string of text, you’ll see a name; find the one belonging to the network you want to hack into.
13. Make sure the router is using WPA or WPA2 security. If you see “WPA” or “WPA2” immediately to the left of the network’s name, you can proceed; otherwise, you cannot hack the network.
14. Note the MAC address and channel number of the router. These pieces of information are to the left of the network’s name:
    • MAC address — This is the line of numbers on the far-left side of your router’s line.
    • Channel — This is the number (e.g., 0, 1, 2, etc.) directly to the left of the WPA or WPA2 tag.
15. Monitor your selected network for a handshake. A “handshake” occurs when an item connects to a network (e.g., when your computer connects to a router). Enter the following code, making sure to replace the necessary components of the command with your network’s information: airodump-ng -c channel —bssid MAC -w /root/Desktop/ mon0
    • Replace “channel” with the channel number you found in the last step.
    • Replace “MAC” with the MAC address you found in the last step.
    • Remember to replace “mon0” with whatever your interface name was.
    • Here’s an example address: airodump-ng -c 3 —bssid 1C:1C:1E:C1:AB:C1 -w /root/Desktop/ wlan0mon
16. Wait for a handshake to appear. Once you see a line with the tag “WPA handshake:” followed by a MAC address in the upper-right corner of the screen, you can proceed.
    • If you’re not in a waiting mood, you can force a handshake using a deauth attackbefore continuing with this part.
17. Exit airodump-ng, then open the desktop. Press Ctrl+C to quit, then make sure you can see the “.cap” file on your computer’s desktop.
18. Rename your “.cap” file. While not strictly necessary, this will make it easier to work with later. Enter the following command to change the name, making sure to replace “name” with whatever you want to name the file: mv ./-01.cap name.cap
    • If your “.cap” file isn’t named “-01.cap”, replace “-01.cap” with whatever your “.cap” file’s name is.
19. Convert the “.cap” file into “.hccapx” format. You can do this by using Kali Linux’s converter. Enter the following command, making sure to replace “name” with your file’s name: cap2hccapx.bin name.cap name.hccapx
    • You can also go to https://hashcat.net/cap2hccapx/ and upload the “.cap” file to the converter by clicking Choose File and selecting your file. Once the file is uploaded, click Convert to convert it and then download it back onto your desktop before proceeding.
20. Install naive-hashcat. This is the service you’ll use to crack the password. Enter the following commands in order: sudo git clone https://github.com/brannondorsey/naive-hashcat cd naive-hashcat curl -L -o dicts/rockyou.txt https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
    • If your computer doesn’t have a GPU, you’ll need to use aircrack-ng instead.
21. Run naive-hashcat. Once it finishes installing, enter the following command (making sure to replace any instance of “name” with your “.cap” file’s name): HASH_FILE=name.hccapx POT_FILE=name.pot HASH_TYPE=2500 ./naive-hashcat.sh
22. Wait for the network password to be cracked. Once the password is cracked, its string will be added to the “name.pot” file found in the “naive-hashcat” directory; the word or phrase after the last colon in the string is the password.
    • It can take anywhere from a few hours to a few months for the password to be cracked.

PART 3 USING AIRCRACK-NG FOR NON-GPU COMPUTERS

1. Download a dictionary file. The most commonly used dictionary file is “Rock You”. You can download it by entering the following command: curl -L -o rockyou.txt https://github.com/brannondorsey/naive-hashcat/releases/download/data/rockyou.txt
   • Keep in mind that aircrack-ng will not be able to crack the WPA or WPA2 password if the password isn’t in the word list.
2. Tell aircrack-ng to begin cracking the password. Enter the following command, making sure to use the necessary network information when doing so: aircrack-ng -a2 -b MAC -w rockyou.txt name.cap
   • If you’re cracking a WPA network instead of a WPA2 network, replace “-a2” with -a.
   • Replace “MAC” with the MAC address you found in the last section.
   • Replace “name” with your “.cap” file’s name.
3. Wait for Terminal to display the results. When you see a “KEY FOUND!” heading appear, aircrack-ng has found the password. You’ll see the password displayed in brackets to the right of the “KEY FOUND!” heading.

PART 4 USING DEAUTH ATTACKS TO FORCE A HANDSHAKE

1. Understand what a deauth attack does. Deauth attacks send malicious deauthentication packets to the router you’re trying to break into, causing the Internet to disconnect and ask the Internet user to log back in. Once the user logs back in, you will be provided with a handshake.
2. Monitor your network. Enter the following command, making sure to enter your network’s information where necessary: airodump-ng -c channel —bssid MAC
   • For example: airodump-ng -c 1 —bssid 9C:5C:8E:C9:AB:C0
3. Wait for something to connect to the network. Once you see two MAC addresses appear next to each other (and a string of text that includes a manufacturer name next to them), you can proceed.
   • This indicates that a client (e.g., a computer) is now connected to the network.
4. Open a new Terminal window. You can just press Alt+Ctrl+T to do this. Make sure airodump-ng is still running in the background Terminal window.
5. Send the deauth packets. Enter the following command, making sure to substitute your network’s information: aireplay-ng -0 2 -a MAC1 -c MAC2 mon0
   • The “2” refers to the number of packets to send. You can increase or decrease this number, but keep in mind that sending more than two packets can cause a noticeable security breach.
   • Replace “MAC1” with the left-most MAC address at the bottom of the background Terminal window.
   • Replace “MAC2” with the right-most MAC address at the bottom of the background Terminal window.
   • Remember to replace “mon0” with your interface name that you found when your computer initially looked for routers.
   • An example command looks like this: aireplay-ng -0 3 -a 9C:5C:8E:C9:AB:C0 -c 64:BC:0C:48:97:F7 mon0
6. Re-open the original Terminal window. Go back to the background Terminal window when you’re done sending the deauth packets.
7. Look for a handshake. Once you see the “WPA handshake:” tag and the address next to it, you can proceed with hacking your network.

Hack a WiFi Network In 8 Easy Steps..( Using Windows)

Hack a WiFi Network In 8 Easy Steps.( Using Windows)

It takes about 5-6 hours if the password is weak a high signal of the WiFi network you are going to hack and you have sometimes 10-12 for more complicated passwords and if the WiFi signal of the Network is weak .The time taken also changes if the WiFi network you are going to hack has many other clients already accessing it . 





Tools needed :

Packet sniffer:
* Commview for WiFi ( check it website and see if ur wifi card is supported https://www.tamos.com/

products/commwifi/adapterlist.php )
{ get the 30 day trial or use the free full version available on net from other sites.) (i recomment the 30 day trial because it will be the latest ) after it expires y can always go to other means.

You will use this tool for capturing the packets sent and recieved through the Access Point you are going to hack .The more packets you capture the better chances of cracking the password .You will need more than 1,00,000 minium packets to crack the password .The packets will be captured in the .ncp format .You will use this tool to convert the .ncp to .cap .

NOT MANY NETWORK CARDS ARE SUPPORTED SO PLEASE CHECK YOUR NETWORK ADAPTER IN DEVICE MANAGER. IF it is not supported then there is no other option then to use backtrack with extra hardware.

Decrypter :

* Aircrack suite (http://www.aircrack-ng.org/)
You will use this tool to crack the password of the Access Point using the . Cap files you obtained from the Commview application .

NOTE  :
You will need a packet sniffing program (we will use Commview for WiFi) and not airodump-ng ( already integrated in aircrack suite).

Or if YOU can get another packet sniffer that support your card then use it instead of commonview.

Now Get Ready to Hack :

Step 1 : Install CommView for WiFi . It doesnt matter whether you install it in VoIP mode or Standard mode . I used VoIP . It automatically installs the necessary drivers . Allow it to install .

Note :- You will not be able to connect to any Network using WiFi when using CommView .

Step 2 : Click on the PLAY ICON in the Left First .

Step 3 : (Choosing the Network (a) ) : A new window should pop up now. Click on the START SCANNING button .

Step 4 : (Choosing the Network (b) ) : Click on the WiFi network you want to hack in the Right Coulumn and Click on CAPTURE.

Note :- This tutorial is only for WEP protected networks .

Step 5 : (Capturing the Packets) : The windows should close now and you should see that CommView has started Capturing Packets .

Step 6 : (Saving the Packets ) : Now that the Packets are getting captured you need to Save them. Click on Settings->Options->Memory Usage Change Maximum Packets in buffer to 20000.

Click on the LOGGING Tab .

Check AUTO-SAVING
In the Maximum Directory Size : 5000
Average Log File Size : 50

Now CommView will automatically Start Saving packets in the .ncp format at a size of 20MB each in the specified directory .

Step 7 : ( Concatenating the Logs ) : Since you are capturing a lot of logs you will need to concatenate them into once file . To do this go to Logging and click on CONCATENATE LOGS Choose all the files that have been saved in your specified folder and Concatenate them .

Now you will have one .ncf file .

Step 8 : (Converting .ncf to .cap ) : Now that you have one file with all the packets you need to Convert it into .cap file for AIRCRACK to crack .

Click on File->Log Viewer->Load Commview Logs-> Choose the .ncf file. Now File->Export->Wireshark/TCP dump format .

Aircrack Part :

Now for the Second Part Cracking this is very simple . Just open the Aircrack Folder->Bin->Aircrack-ng GUI.exe Choose the .cap file and you should be able to do the others .

 Also select the encryption(WEP or others) and Key size (64). Press launch and the key will be revealed.

or try other settings if not working.

How To Hack WI-FI WEP With Back|Track 5

What you need for this crack are a few simple things, a copy of backtrack 5 booting off a DVD or a flash drive and a compatible wireless card that supports packet injection. Now if you can't get to this screen, and you are stuck at the terminal you get when booting into backtrack, you need to type startx and wait a couple of minutes for the desktop to show. Okay so let's begin, so first we need to open a terminal. To do that, just click the little icon that's on the right side from System. Please see the image below:



Now type airmon-ng and that command displays our interfaces. In my case I have wlan0, and now we are going to put it into monitor mode. To do that, type airmon-ng start wlan0. As you can see on the picture below it says (monitor mode enabled on mon0), and we are going to be using mon0 instead of wlan0 as our interface.




Type airodump-ng mon0 and that will start scanning for wi-fi networks. As you can see, there is a network called SKIDHACKER. Take a note of the BSSID the DATA, the CHANNEL and the type of ENCRYPTION. Please refer to the image below, if you have any trouble getting to that point.




Now we are going to set it to lock on a specific network named SKIDHACKER. To do that, type airodump-ng -c (channel) -w WEPcrack --bssid (bssid of the network) mon0. Replace (channel) with the channel of the network you are trying to crack, and replace (bssid of the network) with the bssid of the network you want to crack.




Okay so as you can probably see the data is going really slow, and we need to boost that up. We are going to need a lot more data, so let's preform one of the aireplay commands that will boost that data. Firstly, open up a new terminal and type aireplay-ng -1 0 -a (bsisd) mon0 where (bssid) is the bssid of the network. Now if your wi-fi card is supported, you should see Association successful :-), if you don't see that then your card is not supported.




Now we are going to type in aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b (bssid) mon0. And now when the question Use this packet ? pops up, just push the letter y. And now as you can see in the image below, the data went high drastically.




Okay so now lets open a new terminal and we are going to attempt to crack it with the amount of data we have. I recommend getting over 20000 data before trying to crack it. So let's type aircrack-ng WEPcrack*.cap. Replace WEPcrack with the filename you chose before when capturing the data, and don't forget to add that asterisk after the file and the extension which is .cap.




And now it will attempt to crack the password. Just wait a couple of minutes for it to complete, and once it did it will say KEY FOUND! [ XX:XX:XX:XX:XX ] where the X's will be random numbers and/or letters. That's not it, now to connect you will need to remove the semicolumns. For an example, if we were to have 12:34:52:66:59, the password would be 1232526659. Just log in to your Windows OS, and connect using that password.

So lets begin. What you will need for this crack is a dictionary file that we are going to use to crack the WPA/WPA2 password. Remember, the bigger the dictionary file is the greater the chance you have in cracking the password. So now you are probably wondering, where do I get a dictionary file? Well, I don't know if this is allowed or not but I recently downloaded a 1.9GB dictionary file.

To get the file please PM me, I can't risk getting this tutorial taken down. Okay, so firstly open up a terminal and once we have the terminal open we are going to type in airmon-ng which will display our wireless interfaces. In my case I have wlan0, and now we are going to put it into monitor mode. To do that, type airmon-ng start wlan0. As you can see on the picture below it says (monitor mode enabled on mon0), and we are going to be using mon0 instead of wlan0 as our interface.


Lets type in airodump-ng mon0 and this command is going to initiate the scanning process for Wi-Fi networks. As you can see in the picture below, a few WPA encrypted networks should pop up. I'm going to attempt to crack the network under the essid SKIDHАCKER. Take a note of the channel, and you want to copy the BSSID for later use.



Now we are going to type in airodump-ng -c (channel) -w (filename) --bssid (bssid) mon0, and replace the values to fit what you got from the last step. Don't forget to remember what filename you chose, because we are going to need that at the end.



What is needed to crack a WPA or WPA2 key is something called a WPA Handshake. You can obtain a handshake by kicking someone off the network, and those computers will automatically reconnect which will give you the handshake. This means, if there is no one on the network, you can't get a handshake, and you can't crack the WPA network. So how do we know if someone is connected? Well look at the lower part of the airodump command, and you will notice something as STATION, and underneath that if someone is connected it wil show you their mac address.



Once you get a handshake, airodump will alert you in the top screen, and the handshake will be located right from the time stamp. Okay, so lets open up a new terminal and we are going to kick off the computers connected. Lets type in aireplay-ng -1 0 -a (bssid) mon0. replace bssid with the network you are trying to crack and hit enter. It is going to attempt to kick off a client, and if it succeeds you will see the wpa handshake at the top right corner, if you don't run the aireplay command a couple of times.



So now that we have a wpa handshake file, we are going to attempt to crack it. Lets stop the scan by pressing CONTROL + C on the terminal where airodump is running. Now in order to find the handshake file, you need to go in the top menu and chose Places > Home Folder. Okay, so lets open up a terminal and we are going to type in aircrack-ng -w (dictionary) /root/(filename). Where filename is the filename you specified when capturing the wpa handshake and the dictionary is the path of the wordlist you downloaded. This can be done by dragging in the handshake file into the terminal after the aircrack-ng -w (dictionary) command and it will parse in it's directory. All you need to do is hit enter. The password needs to be in the dictionary file, so the bigger the wordlist is the bigger are the chances of you getting the password.



If the password is in the wordlist, it will give you a success message and the key in brackets. Happy hacking, hackers!

---

•