Back to OSINT guides

Aircrack-ng Guide

The complete suite for wireless network security audits. Test, analyze and secure your WiFi infrastructure with the reference tools.

10+ built-in tools
WEP/WPA/WPA2
Open Source

What is Aircrack-ng?

Aircrack-ng is a suite of tools for auditing the security of 802.11 (WiFi) wireless networks. It captures traffic, tests password strength and evaluates the security configuration of WEP, WPA and WPA2 networks.

Network capture
Passive and active WiFi traffic monitoring
Key auditing
WEP/WPA/WPA2 strength testing
Packet injection
Active testing and traffic generation
Security analysis
Vulnerability detection and audits

Key features

A complete toolset for WiFi security audits

Packet capture

Real-time WiFi traffic capture and analysis with advanced filtering and multi-format export

Real time
Airodump-ngMulti-channelExport PCAP

Cracking WEP/WPA

WiFi key security auditing with optimized dictionary and brute-force attacks

> 1M keys/s
WEPWPA/WPA2Dictionnaires

Monitor mode

Enable promiscuous mode to passively capture all wireless packets

802.11 a/b/g/n/ac
InjectionSniffingCompatible

Packet injection

Send crafted packets to test resilience and force handshake generation

Aireplay-ng
DeauthFake authARP replay

Security analysis

Full evaluation of WiFi configuration and detection of critical vulnerabilities

Multi-protocoles
AuditComplianceReporting

Complete suite

Integrated toolset for every aspect of wireless security testing

10+ tools
Airmon-ngAirdecap-ngAirbase-ng

Tools in the suite

More than 10 specialized tools covering every aspect of WiFi auditing

Capture & Monitoring

airodump-ng
Packet capture and WiFi network scanning
airmon-ng
Enable/disable monitor mode
airodump-ng-oui-update
Update the vendor OUI database

Injection & attacks

aireplay-ng
Packet injection and attacks (deauth, fake auth)
airbase-ng
Create fake access points (Evil Twin)
airtun-ng
Create virtual network tunnels

Cracking & analysis

aircrack-ng
Crack WEP and WPA/WPA2-PSK keys
airdecap-ng
Decrypt WEP/WPA captures
aircrack-ng-bench
Benchmark cracking performance

Utilitaires

airserv-ng
Server to share a WiFi adapter over the network
airolib-ng
Manage password databases
packetforge-ng
Build custom crafted packets

Practical use cases

Real-world WiFi security audit scenarios

Enterprise WPA2 audit

Test a corporate WiFi network's strength through handshake capture

Detailed workflow

1
Monitor mode

Enable monitor mode with airmon-ng start wlan0

2
Network scan

Scan with airodump-ng to identify the target

3
Targeted capture

Capture on the target network's channel

4
Deauth attack

Force a reconnection with aireplay-ng --deauth

5
Handshake capture

Capture the WPA handshake during reconnection

6
Cracking offline

Test with a dictionary via aircrack-ng

Rogue access point detection

Identify fake access points and Evil Twins nearby

Detailed workflow

1
Full scan

Scan all channels to map APs

2
SSID analysis

Compare SSIDs and detect duplicates

3
BSSID check

Check MAC addresses and vendors

4
Signal analysis

Measure signal strength to locate devices

5
Correlation

Cross-check against the legitimate network inventory

6
Alerte

Document and report suspicious APs

Legacy WEP resilience test

Full security assessment of an obsolete WEP network

Detailed workflow

1
Passive capture

Collect IVs with airodump-ng

2
Fake authentication

Associate with the target network

3
ARP replay

Inject to generate traffic

4
IV collection

Collect 50K+ IVs for cracking

5
Cracking WEP

Run aircrack-ng on the capture

6
Validation

Test the recovered key

Command examples

Practical commands for different audit scenarios

Initial setup

airmon-ng check kill

Kill processes that interfere with monitor mode

SetupEssentiel
airmon-ng start wlan0

Enable monitor mode on wlan0

MonitorSetup
iwconfig

Check that the interface is in monitor mode (wlan0mon)

Check

Capture & Scan

airodump-ng wlan0mon

Scan all available WiFi networks

ScanDiscovery
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Capture a specific network on channel 6

CaptureTargeted
airodump-ng --band abg wlan0mon

Scan all bands (2.4GHz and 5GHz)

5GHzComplet

Attacks & injection

aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

Send 10 deauthentication packets

DeauthHandshake
aireplay-ng --fakeauth 0 -a BSSID -h YOUR_MAC wlan0mon

Fake authentication for WEP injection

WEPFake auth
aireplay-ng --arpreplay -b BSSID -h YOUR_MAC wlan0mon

ARP replay attack to generate IVs

WEPARP

Cracking

aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture.cap

Crack WPA with a dictionary

WPADictionary
aircrack-ng -b AA:BB:CC:DD:EE:FF capture.cap

Crack WEP with the collected IVs

WEPAuto
aircrack-ng -w - -b BSSID capture.cap

Crack with a wordlist from stdin (pipe)

WPAPipe

Best practices

Essential recommendations for a responsible WiFi audit

Do

  • Get written authorization
    Get a written mandate before any WiFi security test
  • Check compatibility
    Use a WiFi adapter that supports monitor mode and injection
  • Document the audit
    Keep a record of commands, captures and results
  • Secure your captures
    Encrypt and protect .cap files containing handshakes
  • Test in a controlled environment
    Practice on your own network before a client audit
  • Update regularly
    Use the latest version of Aircrack-ng and drivers

Avoid

  • Testing without authorization
    Illegal and liable to prosecution
  • Disrupting neighboring networks
    Avoid mass deauth attacks that affect other networks
  • Using an incompatible adapter
    Check compatibility before buying hardware
  • Disclosing recovered keys
    Keep audit results strictly confidential
  • Neglecting OPSEC
    Your WiFi adapter reveals your MAC address: change it if needed
  • Unnecessarily long tests
    Keep the audit as short as strictly necessary

Installation and setup

Complete guide to installing and configuring Aircrack-ng

1

Installing on Kali Linux

Aircrack-ng comes preinstalled on Kali Linux

sudo apt update && sudo apt install aircrack-ng
KaliParrot OSUbuntu
2

Checking your WiFi adapter

Check that your adapter supports monitor mode and injection

airmon-ngiw list | grep "Supported interface modes" -A 8
3

Recommended adapters

  • • Alfa AWUS036NHA (Atheros AR9271)
  • • TP-Link TL-WN722N v1 (Atheros AR9271)
  • • Alfa AWUS036ACH (Realtek RTL8812AU)
  • • Panda PAU09 (Ralink RT5372)
4

Enabling monitor mode

airmon-ng check killairmon-ng start wlan0

→ wlan0mon interface created

⚠️ Critical legal warning

Using Aircrack-ng on WiFi networks you do not own, or without explicit written authorization, is ILLEGAL in most jurisdictions and can lead to criminal and civil prosecution.

Legitimate use only:

  • Auditing your own WiFi networks
  • Tests with the owner's written authorization
  • Lab and training environments
  • Security research within a legal framework

Resources and documentation

Useful links to go further

Official Aircrack-ng website

Official documentation, downloads and tutorials

Visit the website

GitHub Repository

Source code, issues and latest updates

View the code

Full documentation

Detailed guides for every tool in the suite

Read the docs

Hardware compatibility

List of compatible WiFi adapters and drivers

See the list

Ready to audit your WiFi networks?

Discover other OSINT tools and strengthen your wireless security skills

See case studiesOther OSINT guides
CyberXTEL
100% Free

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL