Documentation

Description

It focuses on different areas of WiFi security:

• Monitoring: Packet capture and export of data to text files for further processing by third party tools
• Attacking: Replay attacks, deauthentication, fake access points and others via packet injection
• Testing: Checking WiFi cards and driver capabilities (capture and injection)
• Cracking: WEP and WPA PSK (WPA 1 and 2)

All tools are command line which allows for heavy scripting. A lot of GUIs have taken advantage of this feature. It works primarily Linux but also Windows, OS X, FreeBSD, OpenBSD, NetBSD, as well as Solaris and even eComStation 2.

Fresh news

This release brings a ton of improvements. Along with bug fixes and improvements for a lot of tools, we have huge improvements under the hood thanks to code cleanup, deduplication, and reorganization of the source code. We also improved our buildbot, and addedd integration tests.

The most notable changes are in Airodump-ng, it now sees WPA3 and OWE. Its rates now takes into account 802.11n/ac and aren’t limited to 54Mbit anymore. It has PMKID detection, and some basic UTF-8 among other things.

Many more details can be found in our blog post.

Fourth and last release of the year. It is smaller than the previous one but we did want to release the fixes and improvements before the holidays so it will be available for Shmoocon next month in your favorite distro. Small issues were found in 1.5 and then in 1.5.1, which is why we ended up with 1.5.2.

It brings fixes, a new feature and lots of improvements. More details in our blog post.

Under the spotlights

If you are having issues injecting or if you are receiving an error message talking about channel -1 or fixed channel in airodump-ng (top right of the screen) or aireplay-ng, kill the network managers using airmon-ng check kill before putting the wireless card in monitor mode.

Aircrack-ng

User Tools

Site Tools

Table of Contents

Airodump-ng

Description

Airodump-ng is used for packet capturing of raw 802.11 frames and is particularly suitable for collecting WEP IVs (Initialization Vector) for the intent of using them with aircrack-ng. If you have a GPS receiver connected to the computer, airodump-ng is capable of logging the coordinates of the found access points.

Additionally, airodump-ng writes out several files containing the details of all access points and clients seen.

Usage

Before running airodump-ng, you may start the airmon-ng script to list the detected wireless interfaces. It is possible, but not recommended, to run Kismet and airodump-ng at the same time.

You can convert .cap / .dump file to .ivs format or merge them.

Usage Tips

What’s the meaning of the fields displayed by airodump-ng ?

airodump-ng will display a list of detected access points, and also a list of connected clients (“stations”). Here’s an example screenshot:

The first line shows the current channel, elapsed running time, current date and optionally if a WPA/WPA2 handshake was detected. In the example above, “WPA handshake: 00:14:6C:7E:40:80” indicates that a WPA/WPA2 handshake was successfully captured for the BSSID.

In the example above the client rate of “36-24” means:

Field	Description
BSSID	MAC address of the access point. In the Client section, a BSSID of “(not associated)” means that the client is not associated with any AP. In this unassociated state, it is searching for an AP to connect with.
PWR	Signal level reported by the card. Its signification depends on the driver, but as the signal gets higher you get closer to the AP or the station. If the BSSID PWR is -1, then the driver doesn’t support signal level reporting. If the PWR is -1 for a limited number of stations then this is for a packet which came from the AP to the client but the client transmissions are out of range for your card. Meaning you are hearing only 1/2 of the communication. If all clients have PWR as -1 then the driver doesn’t support signal level reporting.
RXQ	Receive Quality as measured by the percentage of packets (management and data frames) successfully received over the last 10 seconds. See note below for a more detailed explanation.
Beacons	Number of announcements packets sent by the AP. Each access point sends about ten beacons per second at the lowest rate (1M), so they can usually be picked up from very far.
# Data	Number of captured data packets (if WEP, unique IV count), including data broadcast packets.
#/s	Number of data packets per second measure over the last 10 seconds.
CH	Channel number (taken from beacon packets). Note: sometimes packets from other channels are captured even if airodump-ng is not hopping, because of radio interference or overlapping channels.
MB	Maximum speed supported by the AP. If MB = 11, it’s 802.11b, if MB = 22 it’s 802.11b+ and up to 54 are 802.11g. Anything higher is 802.11n or 802.11ac. The dot (after 54 above) indicates short preamble is supported. Displays “e” following the MB speed value if the network has QoS enabled.
ENC	Encryption algorithm in use. OPN = no encryption,“WEP?” = WEP or higher (not enough data to choose between WEP and WPA/WPA2), WEP (without the question mark) indicates static or dynamic WEP, and WPA, WPA2 or WPA3 if TKIP or CCMP is present (WPA3 with TKIP allows WPA or WPA2 association, pure WPA3 only allows CCMP). OWE is for Opportunistic Wireless Encryption, aka Enhanced Open.
CIPHER	The cipher detected. One of CCMP, WRAP, TKIP, WEP, WEP40, or WEP104. Not mandatory, but TKIP is typically used with WPA and CCMP is typically used with WPA2. WEP40 is displayed when the key index is greater then 0. The standard states that the index can be 0-3 for 40bit and should be 0 for 104 bit.
AUTH	The authentication protocol used. One of MGT (WPA/WPA2 using a separate authentication server), SKA (shared key for WEP), PSK (pre-shared key for WPA/WPA2), or OPN (open for WEP).
ESSID	Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated. In this case, airodump-ng will try to recover the SSID from probe responses and association requests. See this section for more information concerning hidden ESSIDs.
STATION	MAC address of each associated station or stations searching for an AP to connect with. Clients not currently associated with an AP have a BSSID of “(not associated)”.
Rate	Station’s receive rate, followed by transmit rate. Displays “e” following each rate if the network has QoS enabled.
Lost	The number of data packets lost over the last 10 seconds based on the sequence number. See note below for a more detailed explanation.
Packets	The number of data packets sent by the client.
Notes	Additional information about the client, such as captured EAPOL or PMKID.
Probes	The ESSIDs probed by the client. These are the networks the client is trying to connect to if it is not currently connected.

RXQ expanded:
Its measured over all management and data frames. The received frames contain a sequence number which is added by the sending access point. RXQ = 100 means that all packets were received from the access point in numerical sequence and none were missing. That’s the clue, this allows you to read more things out of this value. Lets say you got 100 percent RXQ and all 10 (or whatever the rate) beacons per second coming in. Now all of a sudden the RXQ drops below 90, but you still capture all sent beacons. Thus you know that the AP is sending frames to a client but you can’t hear the client nor the AP sending to the client (need to get closer). Another thing would be, that you got a 11MB card to monitor and capture frames (say a prism2.5) and you have a very good position to the AP. The AP is set to 54MBit and then again the RXQ drops, so you know that there is at least one 54MBit client connected to the AP.

N.B.: RXQ column will only be shown if you are locked on a single channel, not channel hopping.

Lost expanded:
It means lost packets coming from the client. To determine the number of packets lost, there is a sequence field on every non-control frame, so you can subtract the second last sequence number from the last sequence number and you know how many packets you have lost.

Possible reasons for lost packets:

To minimize the number of lost packets, vary your physical position, type of antenna used, channel, data rate and/or injection rate.

Run aircrack-ng while capturing data

To speed up the cracking process, run aircrack-ng while you are running airodump-ng. You can capture and crack at the same time. Aircrack-ng will periodically reread the captured data so it is always working with all the available IVs.

Limiting Data Capture to a Single AP

To limit the data capture to a single AP you are interested in, include the “- -bssid” option and specify the AP MAC address. For example: “airodump-ng -c 8 — -bssid 00:14:6C:7A:41:20 -w capture ath0”.

How to Minimize Disk Space for Captures

To minimize disk space used by the capture, include the “- -ivs” option. For example: “airodump-ng -c 8 — -bssid 00:14:6C:7A:41:20 -w capture — -ivs ath0”. This only stores the initialization vectors and not the full packet. This cannot be used if you are trying to capture the WPA/WPA2 handshake or if you want to use PTW attack on WEP.

How to Select All APs Starting With Similar BSSIDs

Lets say, for example, you wish to capture packets for all Cisco-Linksys APs where the BSSID starts with “00:1C:10”.

You specify that starting bytes you wish to match with the “-d” / “–bssid” option and pad with zeroes to a full MAC. Then use “-m” / “–netmask” option to specify which part of the BSSID you wish to match via “F”s and pad with zeroes to a full MAC.

So since you want to match “00:1C:10”, you use “FF:FF:FF”.

How to Select Specific Channels or a Single Channel

The “–channel” (-c) option allows a single or specific channels to be selected.

Example of a single channel:

For cards which needs to be reset when on a single channel:

Example of selected channels:

Text Files Containing Access Points and Clients

Each time airodump-ng is run with the option to write IVs or full packets, a few text files are also generated and written to disk. They have the same name and a suffix of “.csv” (CSV file), “.kismet.csv” (Kismet CSV file) and “.kismet.netxml” (Kismet newcore netxml file).

The CSV file contains the details of all access points and clients seen. See kismet documentation for more details about the kismet CSV and netxml.

Here is an example:

Usage Troubleshooting

I am getting no APs or clients shown

If you have a laptop with a builtin wireless card, ensure it is “turned on / enabled” in the bios

Does your card works in managed mode? If not, the problem is not with airodump-ng. You need to get this working first.

See if this madwifi-ng web page has information that may be helpful.

Although it is not very “scientific”, sometimes simply unloading then reloading the driver will get it working. This is done with the rmmod and modprobe commands.

Also see the next troubleshooting tip.

I am getting little or no data

Note for madwifi-ng

Make sure there are no other VAPs running. There can be issues when creating a new VAP in monitor mode and there was an existing VAP in managed mode.

You should first stop ath0 then start wifi0:

Airodump-ng keeps switching between WEP and WPA

This is happening because your driver doesn’t discard corrupted packets (that have an invalid CRC). If it’s a ipw2100 (Centrino b), it just can’t be helped; go buy a better card. If it’s a Prism2, try upgrading the firmware.

Airodump-ng stops capturing data after a short period of time

The most common cause is that a connection manager is running on your system and takes the card out of monitor mode. Be sure to stop all connection managers prior to using the aircrack-ng suite. In general, disabling “Wireless” in your network manager should be enough but sometimes you have to stop them completely. It can be done with airmon-ng:

Recent linux distributions use upstart; it automatically restarts the network manager. In order to stop it, see the following entry.

As well, make sure that wpa_supplicant is not running. Another potential cause is the PC going to sleep due to power saving options. Check your power saving options.

The madwifi-ng driver for the atheros chipset contains a bug in releases up to r2830 which causes airodump-ng in channel hopping mode to stop capturing data after a few minutes. The fix is to use r2834 or above of the madwifi-ng drivers.

See also this entry for recent

Hidden SSIDs » «

You will sometimes see “ ” as the SSID on the airodump-ng display. This means the SSID is hidden. The “?” is normally the length of the SSID. For example, if the SSID was “test123” then it would show up as “ ” where 7 is the number of characters. When the length is 0 or 1, it means the AP does not reveal the actual length and the real length could be any value.

To obtain the hidden SSID there are a few options:

Как Пользоваться AirCrack-NG — Взлом WiFi — Инструкция

Если вы хотите узнать, как взломать WiFi роутер — просто прочтите эту пошаговую инструкцию по использованию aircrack-ng , выполните ряд проверенных команд и с легкостью взломайте пароль от WiFi.

С помощью этих команд вы сможете взломать WiFi роутер с WPA/WPA2-PSK (pre-shared key) шифрованием.

Основа этого способа взлома WiFi заключается в перехвате WPA/WPA2 рукопожатия во время аутентификации и взломе PSK с помощью aircrack-ng .

Как взломать WiFi — основные шаги:

1. Установите последнюю версии aircrack-ng
2. Переведите беспроводной сетевой интерфейс в режим мониторинга с помощью airmon-ng
3. Запустите airodump-ng для перехвата рукопожатия на канале точки доступа с фильтрацией по BSSID
4. [Опционально] Используйте aireplay-ng для де-аутентификации клиента
5. Запустите aircrack-ng для взлома WPA/WPA2-PSK с помощью перехваченного рукопожатия

1. Aircrack-ng: Скачать и Установить

Только Последняя Версия: Если вы действительно хотите взломать WiFi — не стоит устанавливать устаревший aircrack-ng из репозитория ваше операционной системы. Скачайте и скомпилируйте последнюю версию самостоятельно.

Установите необходимы зависимости:

Скачайте и установите последнюю версию aircrack-ng (текущая версия):

Убедитесь что установлена именно последняя версия aircrack-ng :

2. Airmon-ng: Режим Мониторинга

Режим мониторинга позволяет компьютеру с беспроводным сетевым интерфейсом мониторить весь трафик в беспроводной сети.

Что особенно для нас важно, так это то, что режим мониторинга позволяет перехватывать все передающиеся пакеты без непосредственного подключения к какому-либо WiFi роутеру.

Найдите и остановите все процессы, которые могут помешать:

Запустите беспроводной интерфейс в режиме мониторинга:

В приведенном выше примере, airmon-ng создал новый беспроводной интерфейс mon0 и переключил его в режим мониторинга.

Таким образом, mon0 — это правильное имя интерфейса, которое мы будем использовать далее в этом руководстве.

3. Airodump-ng: Перехват Рукопожатия

Дельный Совет: Хотите немного «развлечься»? Создайте форк-бомбу в Linux! Одна маленькая строчка, способная повесить всю систему! Читать далее →

Теперь, когда беспроводной адаптер переведен в режим мониторинга, у нас появилась возможность видеть весь проходящий мимо нас трафик.

Это можно сделать с помощью команды airodump-ng :

Все видимые точки доступа показаны в верхней части экрана, а подключенные клиенты в нижней:

Для того, чтобы поймать рукопожатие, определите интересующую вас точку доступа и запустите airodump-ng на том же канале с фильтром по BSSID:

Опция	Описание
-c	Канал беспроводной сети
—bssid	MAC адрес точки доступа
-w	Префикс файла в который будет записано рукопожатие
mon0	Сетевой интерфейс
—ignore-negative-one	Убирает сообщение ‘fixed channel : -1’

Если вы хотите ускорить этот процесс — перейдите к шагу #4 и попытайтесь заставить подключенного беспроводного клиента переподключиться к роутеру.

По прошествию некоторого времени вы должны увидеть сообщение WPA handshake: 00:11:22:33:44:55 в правом верхнем углу экрана.

Это сообщение означает, что airodump-ng успешно перехватил рукопожатие:

4. Aireplay-ng: Деаутентификации Клиента

Дельный Совет: Хотите сохранить анонимность? Узнайте как использовать ПРОКСИ из командной строки в Linux. Читать далее →

Если вы не хотите ждать пока airodump-ng перехватит рукопожатие, вы можете сами попробовать отправить сообщение клиенту, сказав что он больше не подключен к точке доступа.

После этого есть вероятность того, что беспроводной клиент попробует переподключиться и мы сможем перехватил рукопожатие.

Отправить широковещательное deauth сообщение:

Отправить направленное deauth сообщение (атака более эффективна когда направленна на конкретного клиента):

Опция	Описание
—deauth 100	Сколько deauth сообщений отправить (0 — без ограничений)
-a	MAC адрес точки доступа
-c	MAC адрес клиента
mon0	Сетевой интерфейс
—ignore-negative-one	Убирает сообщение ‘fixed channel : -1’

Дельный Совет: Нужно взломать пароль от WiFi? Не тратьте свое время попусту! Используйте «John the Ripper» — самый быстрый взломщик паролей! Читать далее →

5. Aircrack-ng: Взлом WiFi Пароля

Для взлома WiFi необходим словарь с паролями для перебора.

Главное помните, что этот способ взлома настолько хорош, насколько хорош ваш словарь с паролями.

Некоторые словари можно скачать отсюда.

Выполните следующую команду, чтобы взломать WPA/WPA2-PSK:

Опция	Описание
-w	Путь к словарю с паролями
-b	MAC адрес точки доступа
WPAcrack.cap	Файл, содержащий перехваченное рукопожатие

Дельный Совет: Взлом пароля часто занимает много времени. Объедините aircrack-ng с «John The Ripper», чтобы иметь возможность ставить перебор на паузу без потери текущего прогресса! Читать далее →