Aircrack/WEP Cracking - Revision history

Admin: Add AircrackFlag template for consistency with other Aircrack pages (via update-page on MediaWiki MCP Server)

2026-06-19T05:50:37Z

Add AircrackFlag template for consistency with other Aircrack pages (via update-page on MediaWiki MCP Server)

← Older revision		Revision as of 05:50, 19 June 2026
Line 224:		Line 224:
	[[Category:Aircrack]]		[[Category:Aircrack]]
	[[Category:Wireless]]		[[Category:Wireless]]

			{{AircrackFlag}}

Admin at 04:20, 16 August 2015

2015-08-16T04:20:06Z

← Older revision		Revision as of 04:20, 16 August 2015
Line 1:		Line 1:
	This page will walk through a WEP attack procedure using [[Aircrack]] on Kali Linux. I tested this out on my home router by switching its encryption to WEP, and I had cracked the WEP passkey a whopping 3 minutes later. Here's how.		This page will walk through a WEP attack procedure using [[Aircrack]] on Kali Linux. I tested this out on my home router by switching its encryption to WEP, and I had cracked the WEP passkey a whopping 3 minutes later. Here's how.

			Related: WEP cracking without any connected clients [[Aircrack/WEP Cracking No Clients]]

	First I'll walk you through the need-to-know basics. Then we'll dive into some command line on Kali and see how to do this.		First I'll walk you through the need-to-know basics. Then we'll dive into some command line on Kali and see how to do this.

Admin: /* Kali */

2015-08-16T04:18:51Z

Kali

← Older revision		Revision as of 04:18, 16 August 2015
Line 29:		Line 29:
	==Kali==		==Kali==

	As mentioned above, for this attack you'll need a device running Kali Linux.		As mentioned above, for this attack you'll need a device running [[Kali]] Linux. The steps for putting your wireless card in monitoring mode are slightly different between Kali 1 and Kali 2.

	==Wireless==		==Wireless==

Admin: /* Window 1: Monitor Traffic on Network */

2015-08-16T04:16:55Z

Window 1: Monitor Traffic on Network

← Older revision		Revision as of 04:16, 16 August 2015
Line 118:		Line 118:

	<pre>		<pre>
	$ airodump-ng --bssid AA:BB:CC:DD:EE -c XX -w aircrack_output wlan2mon		$ airodump-ng -d AA:BB:CC:DD:EE -c XX -w aircrack_output wlan2mon
			</pre>

			alternatively,

			<pre>
			$ airodump-ng --bssid AA:BB:CC:DD:EE --channel XX -w aircrack_output wlan2mon
	</pre>		</pre>

Line 131:		Line 137:
	</pre>		</pre>

	This program listens to packet traffic on the network and dumps it all into a <code>.cap</code> capture file. This is the raw packet dump that you'll use to crack the WEP passphrase.		This program listens to packet traffic on the network and dumps it all into a <code>.cap</code> capture file. This is the raw packet dump that you'll use to crack the WEP passphrase. Type <code>man airodump-ng</code> for help.

	<pre>		<pre>
			-d AA:BB:CC:DD:EE
	--bssid AA:BB:CC:DD:EE		--bssid AA:BB:CC:DD:EE
	</pre>		</pre>
Line 141:		Line 148:
	<pre>		<pre>
	-c XX		-c XX
			--channel XX
	</pre>		</pre>

	Here we specify the channel number that we found using <code>airmon-ng</code>.		Here we specify the channel number that we found using <code>airmon-ng</code>. Should be an integer from 1-12.

	<pre>		<pre>
Line 155:		Line 163:
	</pre>		</pre>

	~~Remember that Aircrack renamed~~ our wireless device ~~from <code>wlan2</code> to <code>wlan2mon</code>~~.		This is the name of our wireless device.

	The output of this command is refreshed every few seconds. As new devices join the network, they'll show up on this screen, as will statistics about their packet traffic.		The output of this command is refreshed every few seconds. As new devices join the network, they'll show up on this screen, as will statistics about their packet traffic.

Admin: /* Switch Wireless Device to Monitor Mode */

2015-08-16T04:12:01Z

Switch Wireless Device to Monitor Mode

← Older revision		Revision as of 04:12, 16 August 2015
Line 59:		Line 59:
	==Switch Wireless Device to Monitor Mode==		==Switch Wireless Device to Monitor Mode==

	The next step is to use Aircrack to put your wireless ~~device~~ into monitoring mode:		The next step is to use Aircrack to put your wireless card into monitoring mode. You can also change your MAC before bringing the device online.

			===Kali 2.x===

			<pre>
			$ iwconfig
			$ ifconfig wlan0 down
			$ macchanger -r wlan0 # optional
			$ iwconfig wlan0 mode monitor
			$ ifconfig wlan0 up
			$ airodump-ng wlan0
			</pre>

			Your monitoring device will still be named <code>wlan0</code> (you can change the last command to call it <code>wlan0mon</code> if you want).

			Now we can scan available networks and find our WEP router.

			===Kali 1.x===
	<pre>		<pre>
			$ airmon-ng
			$ ifconfig wlan2 down
			$ macchanger -r wlan2 # optional
			$ ifconfig wlan2 up
	$ airmon-ng start wlan2		$ airmon-ng start wlan2
			$ airodump-ng wlan2
	</pre>		</pre>

	This may issue some warnings. What this command will do is drop your <code>wlan2</code> device and replace it with a <code>wlan2mon</code> device. From this point forward, we'll be issuing commands using that <code>wlan2mon</code> device.		This may issue some warnings. What this command will do is drop your <code>wlan2</code> device and replace it with a <code>wlan2mon</code> device. From this point forward, we'll be issuing commands using that <code>wlan2mon</code> device.

	~~What~~ we~~'ll do now is~~ scan available ~~wireless~~ networks ~~with Aircrack~~ and ~~look for~~ our WEP router.		Now we can scan available networks and find our WEP router.

	==Scan Networks==		==Scan Networks==

Admin: /* The Hardware */

2015-08-16T04:06:17Z

The Hardware

← Older revision		Revision as of 04:06, 16 August 2015
Line 23:		Line 23:
	=The Hardware=		=The Hardware=

	You'll need three components for this attack: a router running WEP encryption, a laptop running the attack on Kali, and a third (~~unsuspecting~~) ~~client~~ that will connect to the WEP network and make this attack possible.		You'll need three components for this attack: a target router running WEP encryption, a laptop running the attack on Kali, and a third party sheep (client) that will connect to the WEP network and make this attack possible.

	=The Software=		=The Software=

Admin: /* Start the Attack */

2015-08-13T17:34:37Z

Start the Attack

← Older revision		Revision as of 17:34, 13 August 2015
Line 87:		Line 87:

	Now you've got your target router's MAC address and channel number, and you have someone on the network sending packets. You're ready to perform the attack.		Now you've got your target router's MAC address and channel number, and you have someone on the network sending packets. You're ready to perform the attack.

			The attack will consist of packets sent to the sheep who joined the network and is listening to some music. These packets will be fake deauthorization packets. The sheep will think it has been kicked off the network and will re-send its credentials to anyone listening.

	You'll be opening a couple of windows on your Kali box.		You'll be opening a couple of windows on your Kali box.
Line 92:		Line 94:
	===Window 1: Monitor Traffic on Network===		===Window 1: Monitor Traffic on Network===

	In window number 1, start monitoring traffic ~~that's~~ on the ~~network~~:		In window number 1, start monitoring the traffic happening on the router with BSSID AA:BB:CC:DD:EE on channel XX:

	<pre>		<pre>

Admin: /* New Node Connects to the Network */

2015-08-13T17:32:46Z

New Node Connects to the Network

← Older revision		Revision as of 17:32, 13 August 2015
Line 79:		Line 79:
	This will give us a list of wireless access points, their SSIDs, their channels, and their MAC addresses. This is precisely what we'll need to attack our WEP router.		This will give us a list of wireless access points, their SSIDs, their channels, and their MAC addresses. This is precisely what we'll need to attack our WEP router.

	==~~New Node~~ Connects to the Network==		==Sheep Connects to the Network==

Admin: /* New Node Connects to the Network */

2015-08-13T17:32:33Z

New Node Connects to the Network

← Older revision		Revision as of 17:32, 13 August 2015
Line 81:		Line 81:
	==New Node Connects to the Network==		==New Node Connects to the Network==

	Before or while you are monitoring the network,you~~'ll want~~ to ~~connect your~~ third party to the WEP network and ~~start sending packets~~.
			Before or while you are monitoring the network, you will have a new node connect to the network - the third party you're connecting. Suppose it's a hapless sheep streaming Pandora. The sheep joins the WEP network, and packet traffic begins.

	==Start the Attack==		==Start the Attack==

Admin: /* Third Party Connect to the Network */

2015-08-13T17:31:16Z

Third Party Connect to the Network

← Older revision		Revision as of 17:31, 13 August 2015
Line 79:		Line 79:
	This will give us a list of wireless access points, their SSIDs, their channels, and their MAC addresses. This is precisely what we'll need to attack our WEP router.		This will give us a list of wireless access points, their SSIDs, their channels, and their MAC addresses. This is precisely what we'll need to attack our WEP router.

	==~~Third Party Connect~~ to the Network==		==New Node Connects to the Network==

	Before or while you are monitoring the network,you'll want to connect your third party to the WEP network and start sending packets.		Before or while you are monitoring the network,you'll want to connect your third party to the WEP network and start sending packets.