This post deals about hacking WPA WPA2/WEP protected WiFi security
using Aircrack-ng
WEP has been deprecated since early 2001, WPA was introduced as an industry standard, which used TKIP for encryption of data. Later, WPA2 became an industry standard since it introduced AES encryption, which is more powerful than TKIP; however, it also supports TKIP encryption. The WPA/WPA2 key that we would use to authenticate on a wireless network is used to generate another unique key. Five additional parameters would be added to our key to generate a unique key. The parameters are the SSID of the network authenticator, Nounce (ANounce), supplicant Nounce (SNounce), authenticator MAC address (access point MAC), and suppliant MAC address (WiFi client MAC). From a hacker’s perspective, we can use a brute force or dictionary attack or rainbow tables to crack a WPA/WPA2 network, obviously a dictionary attack is much less time consuming than other attacks; therefore it should be your first preference. The success rate of this attack depends upon the wordlist you would use. Another requirement for this attack to work is the four-way handshake, which takes place between a client and an access point, which we will capture using the deauthentication attack.
Let’s see how we can use Aircrack-ng to crack a WPA/WPA2 network:

 


Step 1—First of all, ensure that your network card is inside the monitoring mode.
Step 2—Next, we would listen on the mon0 interfaces for other access points having encryption set to either wpa or wpa2. We would use the “airmon-ng mon0” command to do it.
Our target AP would be Shaxter, which uses WPA as their encryption type. We will take a note of its BSSID and the channel that it’s on, this information would be useful in the upcoming steps. BSSID:
F4:3E:61:92:68:D7 Channel:

 


Capturing Packets
Step 3—Next, we need to save the data associated with our access point to a specific file. The inputs we need to specify are the channel, the bssid, and the file name to write.
Command: airodump-ng –c 1 –w rwap –bssid F4:3E:61:92:68:D7 mon0
◾ –w—File to write ◾ –c—Channel

Capturing the Four-Way Handshake Step 4—In order to successfully crack WAP, we would need to capture the four-way handshake. As mentioned, to achieve this we could use a deauthentication attack to force clients to disconnect and reconnect with the access point. Structure
aireplay-ng –deauth 10 –a ≤Target AP≥ –c ≤Mac address of Mon0≥mon0 Command: aireplay-ng –deauth 10 –a F4:3E:61:92:68:D7 –c 94:39:E5:EA:85:31 mon0
After we have successfully performed a deauthentication attack, we will be able to capture the four-way handshake. Cracking WPA/WAP2 Now that we have all the inputs required for cracking the WPA/WPA PSK, we will use aircrackng and specify a wordlist that would be used against the rhawap.cap file that was generated earlier. Remember that in order for us to successfully crack the WPA/WPA2 PSK, we need to make sure that our file contains the four-way handshake. Structure
aircrack-ng –w Wordlist ‘capture_file’.cap Command: aircrack-ng rhawap.cap –w/pentest/passwords/wordlists/darkc0de.lst
So, now this will start the dictionary attack against the rhawap.cap file, and if the key is found in the dictionary, it will reveal it to us.