Skip to content
Get packs

Guide · Open source

How to use wifi-cracking: capture a WPA2 handshake safely

Updated · written with AI from the project's own documentation and checked against our catalogue data

wifi-cracking is a short tutorial, not a software program, that explains how a WPA/WPA2 Wi-Fi handshake can be captured passively with Airodump-ng and then checked against guessed passwords offline using Aircrack-ng or Hashcat. It is aimed at security students and people testing the strength of their own network password. After reading it you will understand each stage of the process and the tools it names, and why weak, user-chosen passwords are the weak point.

Wi-Fi Crackingbrannondorsey/wifi-cracking · ★ 12.7k · MIT

Quick start

  1. 1Install Aircrack-ng. On a Debian-based system such as Kali Linux, install Aircrack-ng with apt-get. Confirm your wireless card supports monitor mode.
  2. 2Enable monitor mode. List interfaces with airmon-ng, then start monitor mode on your wireless interface, which the guide assumes is wlan0.
  3. 3Find the target. Run airodump-ng on the monitor interface and note the BSSID and channel of the network you are authorised to test.
  4. 4Capture a handshake. Point airodump-ng at that channel and BSSID with -w to save the capture, then wait for a WPA handshake notice.
  5. 5Convert the capture. Convert the .cap file to .hccapx with cap2hccapx if you plan to use Hashcat.
  6. 6Run the crack. Use Hashcat, or Aircrack-ng on the CPU, with a wordlist to test candidate passwords against the handshake.

What you need before you start

The tutorial assumes you are comfortable with the command line and are running a Debian-based Linux distribution, preferably Kali Linux. OS X users are pointed to the appendix instead.

You also need Aircrack-ng installed and a wireless card that supports monitor mode. The README links to a list of supported adapters.

  • Comfort using the command line
  • A Debian-based Linux distro, preferably Kali Linux
  • Aircrack-ng installed
  • A wireless card that supports monitor mode
  • Hashcat, if you have a GPU and want the GPU method
sudo apt-get install aircrack-ng

How do you put the wireless card into monitor mode?

First list the wireless interfaces that support monitor mode. If your interface does not appear, your card does not support monitor mode. The guide assumes the interface is named wlan0; use your actual name if it differs. Then start monitor mode on that interface.

After that, run iwconfig. You should see a new monitor interface, likely named mon0 or wlan0mon.

airmon-ng airmon-ng start wlan0 iwconfig

How do you find your target network?

Listen to the 802.11 Beacon frames that nearby routers broadcast, using your monitor interface. The output lists each network's BSSID (MAC address), channel (CH) and encryption (ENC). Note the BSSID and channel of the network you are authorised to test, because you need both in the next step.

The README's demo targets a network the author owns. Only use this on networks you own or have explicit permission to test.

airodump-ng mon0

How do you capture a WPA2 4-way handshake?

WPA/WPA2 uses a 4-way handshake to authenticate devices. A handshake occurs whenever a device connects, so you wait until one happens while airodump-ng listens on the target's channel and BSSID. Once a handshake is captured, airodump-ng shows a WPA handshake notice at the top of the screen.

Stop with ctrl-c. The capture is saved as a .cap file in the directory you specified, usually named -01.cap. The README suggests renaming it to match the network.

  • The attack is passive: nothing is broadcast from your computer, per the README.
  • An optional deauthentication attack can speed this up, but it is an active attack and is described separately at the end of the README.
airodump-ng -c 3 --bssid 9C:5C:8E:C9:AB:C0 -w . mon0 mv ./-01.cap hackme.cap

How do you crack the password from the capture?

Cracking happens offline, using a dictionary of candidate passwords. The README recommends Hashcat if you have a GPU and suggests the author's naive-hashcat tool to make it easier. Without a GPU it lists online cracking services, or you can try CPU cracking with Aircrack-ng.

Before using Hashcat, convert the .cap file to the .hccapx format, either by uploading it to the hashcat site or using the cap2hccapx tool. The README also notes that these methods assume a relatively weak, user-generated password. Most routers ship with strong random passwords that are much harder to crack this way.

  • Hashcat is recommended with a GPU; naive-hashcat is the author's wrapper.
  • Online services are listed as options if you have no GPU. Review their terms before uploading any capture.
  • For strong random router passwords, the README points to the Probable-Wordlists WPA-length dictionaries.
cap2hccapx.bin hackme.cap hackme.hccapx git clone https://github.com/brannondorsey/naive-hashcat cd naive-hashcat

What is the optional deauthentication attack?

The README describes an optional active deauthentication attack. It sends deauth packets to connected devices to make them reconnect, which often produces a handshake faster. Unlike the passive method, this transmits from your computer and is therefore not undetectable.

The README says the guide is not exhaustive. Its appendix holds further suggestions and alternative methods.

What people use it for

  • Security students learning how WPA2 handshake attacks work
  • Testing whether your own Wi-Fi password is weak enough to be guessed from a dictionary
  • Comparing a home router's default-style password against a dictionary of common passwords
  • Practising the monitor mode and capture workflow on a lab network you control

Frequently asked questions

Is wifi-cracking free and what is its licence?

wifi-cracking is published under the MIT licence. It is a tutorial rather than a software program, so there is nothing to install from the project itself beyond the tools it describes.

What do I need to use wifi-cracking?

You need a Debian-based Linux system, preferably Kali Linux, Aircrack-ng, and a wireless card that supports monitor mode. Hashcat is needed only for the GPU method. The guide assumes you are comfortable with the command line.

Does wifi-cracking work on strong Wi-Fi passwords?

The README says the methods assume a relatively weak, user-generated password. Routers with strong random passwords are much harder to crack this way, and the author points to specialised wordlists for those cases.

Can I use wifi-cracking on a network I don't own?

No. The README states the tutorial is for educational purposes and for testing your own network, and it says it should not be used for illegal activity. Only test networks you own or have written permission to test.

What are alternatives to wifi-cracking?

The README's comparable projects are Aircrack-ng, Hashcat and Wifite. Aircrack-ng and Hashcat are the tools this tutorial uses, while Wifite is listed as a related project.

Why does the guide use Hashcat instead of Aircrack-ng?

The README highly recommends Hashcat when you have a GPU, because GPU cracking is faster. Aircrack-ng is presented as a CPU option. Both are used to test guessed passwords against a captured handshake.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

wifi-cracking suits security students and people checking the strength of their own Wi-Fi password who already use a Linux command line and a compatible wireless card. It is not for beginners or for anyone who wants to access networks they do not have permission to test. If you want a guided tool rather than a tutorial, look at Wifite, or use Aircrack-ng and Hashcat directly.

Install options & downloads