Wifi Hacking

 How to hack WiFi passwords (using Aircrack-ng, Reaver and Wifite)

If you've ever stumbled upon the question of how to hack WiFi passwords then in this post I'll be explaining you several tools to achieve the same. Before starting I'd like to request you to only perform the following steps in a testing environment or on the networks that you're authorised to do this.

I'll be skipping the basic steps such as choosing the right adaptor to perform these steps along with installing Linux and the tools upon it. Also I'll be explaining in a quick and concise manner thus the video could be vital to your understanding . Also some of these attacks are brute force thus could take anywhere from a minute to several days to crack a password. Keep this in mind before starting with these methods. With this out of the way, lets begin this journey.wifite2

• Using Aircrack-ng

NOTE: The prerequisite condition for this attack to work is that the target wifi network must have atleast one device connected to it.

1. Our first step is to determine the name of our wifi interface. This can be done with ifconfig command and would probably be either wlan0 or wlp3s0.

2. Then we'll put our Wifi card into monitor mode. This is done in order to inject packets into a network. For this we'll require the name of our wifi interface that we obtained in the above step and start it.

sudo airmon-ng start wlan0

3. Now your WiFI card will be put into monitor mode and your interface name would be changed to mon0. You'll also be notified of several running process which could interfere with the following steps. Thus we'll kill those processes now. Note there PID (Process ID) and issue the following command to terminate them.

kill <PID>

4. Now we'll capture packets from every wifi network in our vicinity and decide on our target. This will be done with the airodump-ng command

airodump-ng mon0

5. This command will display a lot of information about the nearby networks (also called Access Points or AP). Make sure that your target AP has ENC (Encryption) as WPA or WPA2 and AUTH (Authentication) as PSK. Note its BSSID and CH (Channel No.).

6. We'll again use airodump-ng now to zero in on the target network and write this information in a file.

airodump-ng --bssid <BSSID> --channel <Channel_no> -w <file_name> mon0

7. Note the MAC address of the client that has to be kicked out. Open another terminal for now we'll be performing a deauthentication attack to kick any device connected to the AP. We'll use the --deauth switch to do this while specifying the number of deauth packets to be sent to it. Here we'll be using 200.

aireplay-ng --deauth 200 -a <BSSID> -c <MAC_ADDRESS> mon0

8. Now the disconnected device will try to reconnect to the AP and this is where we'll capture the handshake and write it in the file mentioned above. You'll be able to see the handshake was captured in the previous terminal window on the top right.

9. Finally we'll use a wordlist to brute force this encrypted password and obtain the decrypted password. Every pentesting distro such as kali, parrot, etc have built in wordlist files which can be used here. They are placed in /usr/share/wordlists. You can use rockyou.txt.

aircrack-ng <file_name> -w <location_of_wordlist>

10. Upon cracking the password it will be displayed on your screen.

• Using Reaver

1. The first step is to put your wifi card in monitor mode just like explained above.

airmon-ng start wlan0

2. Then we'll choose our target AP same as above.

airodump-ng mon0

3. Note its BSSID and kill that process with Ctrl+C.

4. This is when reaver will take command.

reaver -i mon0 -b <BSSID> -vv

5. Now reaver will do its magic and provide you with the wifi's password. However you need to take in consideration the amount of time that this may take. Its official documentation states that this can take anywhere from 4 to 10 hours.

• Wifite

Wifite is an automated tool and would thus take away a lot of hassle and command typing while providing you a simple to follow interface.

1. Start wifite as superuser.

sudo wifite

2. Your wifi card will be automatically be put into monitor mode and the nearyby WiFi access points would be displayed on screen. Press Ctrl+C when you have decided upon your target. 

3. Then you'll be asked to select your target which can be done with its NUM (number) written on the left side.

4. Wifite will deauth the AP and capture the handshake. Then the captured handshake will be saved in a file and the decryption process will begin to crack the password.

5. In the end the wifi password would either be provided to you or the process would terminate stating that it was unable to find the password.

How to get out of monitor mode

Now after using any of these tool your wifi card remains in monitor mode and is thus not able to connect to any wifi network. To resolve this the following commands need to be executed

sudo airmon-ng stop wlan0

sudo ifconfig wlan0 down

sudo iwconfig wlan0 mode managed

sudo ifconfig wlan0 up