We can also perform a de-authentication attack which will force the client to disconnect from the wifi network and when we stop the attack, the client will try to connect to the network and we can capture the handshake packet. Now we need to literally wait for some client to connect and airodump-ng will give us the captured handshake.

The MAC addresses specified in the station are the MAC addresses of the devices connected to the WiFi network. You will see a wpa_handshake-01.cap file is generated which will contain all data transferred to and from the network. We specified the bssid of the network on which we want to perform the attack and the channel number specified by the channel argument. This will store the sniffed data in a file named wpa_handshake. If your adapter does not support monitor mode you can purchase an external adapter that supports this mode)Īirodump - ng - bssid 60 : 32 : B1 : XX : XX : XX - channel 1 - write wpa_handshake wlan1mon (Most modern day network adapters support monitor mode. Note: To check the name of your wireless network interface run iwconfig. To enter monitor mode, run these commands: By default, it should be in managed mode. The data packets are literally sent over the air, so if we are in the range of the router, we will be able to capture these packets, so change the wireless interface to monitor mode. We will exploit this rule to perform de-auth attacks later. A device will only receive data that has destination MAC as its address. To send a packet in a network, the packet should have a source MAC address and a destination MAC address. Running Brute Force on the captured Handshake.Cracking WPA2Ĭracking WPA2 using brute force involves mainly 2 parts: If you want to change your MAC address, you can follow the steps mentioned in this link. The only known practical way to crack a WPA2 encrypted network is through a wordlist/dictionary attack.īefore starting you may want to change your MAC Address. WPA/WPA2 encryption took care of all these flaws, still, there are ways to get into a network secured by WPA2. The WEP connections or WPS-enabled networks were easier to hack into because of the flaws in their design. Almost all modern-day wifi routers use WPA2 encryption.

Wifi password viewer mac