Aircrack-ng

What is Aircrack-ng?

Aircrack-ng is an open-source suite for auditing Wi-Fi network security. It is not a single program but a set of tools that work together: they capture wireless traffic, analyse nearby networks and test how strong a network's password is. It is the historic reference for understanding how secure (or insecure) WPA/WPA2 networks are and why a short or predictable password is a real risk.

The main pieces are airmon-ng (puts the card into monitor mode), airodump-ng (listens and captures), aireplay-ng (injects packets) and aircrack-ng (tests passwords against a capture). The suite runs on Linux and needs a Wi-Fi card that supports monitor mode and injection.

This guide is strictly about auditing your own network. Attacking someone else's Wi-Fi without their explicit permission is illegal in virtually every country and can carry criminal penalties. Do it only on your own router, in a lab you built, or with written authorisation.

What Aircrack-ng is used for

• Checking your Wi-Fi password strength: if your own key falls to a dictionary, it is time to change it.
• Understanding the protocol: seeing the WPA2 handshake and how access is negotiated.
• Inventorying your wireless environment: which networks and devices are around you and on which channels.
• Training and labs: practising wireless security in a controlled way.
• Verifying configuration: confirming you use WPA2/WPA3 and not obsolete protocols like WEP.

How to install Aircrack-ng

It is preinstalled on Kali Linux. On Debian, Ubuntu or derivatives:

sudo apt install aircrack-ng

You need a Wi-Fi adapter that supports monitor mode and packet injection. Many built-in laptop cards do not do this well; a USB adapter with a compatible chipset is usually recommended. Check the installed version with:

aircrack-ng --help

How to use Aircrack-ng: auditing your own network step by step

The goal is to capture your network's handshake when one of your devices connects, then check whether your password would survive a dictionary attack. All against your own router.

1. Identify your interface and enable monitor mode

sudo airmon-ng
sudo airmon-ng start wlan0

This creates a monitor-mode interface (for example wlan0mon). First it helps to stop processes that might interfere:

sudo airmon-ng check kill

2. Locate your network

sudo airodump-ng wlan0mon

You will see a list of nearby networks. Identify yours and note its BSSID (the router's MAC) and its channel (CH). Do not capture or interact with networks that are not yours.

3. Capture your network's handshake

Focus the capture on your BSSID and channel, and save the result to a file:

sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon

Now connect one of your devices (phone, laptop) to your network. When it associates, airodump-ng shows a WPA handshake notice at the top right. If you do not want to wait, on your own network you can prompt one of your devices to reconnect by sending it a controlled deauthentication from another terminal:

sudo aireplay-ng --deauth 3 -a AA:BB:CC:DD:EE:FF wlan0mon

Use a low number and only on your own network: the aim is for your device to repeat the handshake, not to disrupt anyone.

4. Test your password strength

With the handshake captured, run it against a dictionary (for example rockyou.txt, included in Kali):

aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

If KEY FOUND! appears with your password, your key is in a common dictionary: change it immediately for a long, random one. If the dictionary runs out without finding it, that is a good sign. Remember to stop monitor mode when you finish:

sudo airmon-ng stop wlan0mon

Pro tips

• Lock the channel with -c when capturing: hopping between channels greatly lowers the chance of catching the handshake.
• Minimal deauth, only on your network: 2-3 packets are enough to make your own device repeat the handshake.
• A long, random password changes everything: the real lesson of this audit is that WPA2 with a good key holds; with a bad one, it does not.
• Use WPA3 if your gear supports it, and disable WPS on the router: it is a frequent weak point.
• Validate your card: not all support injection. If aireplay-ng fails, it is usually the adapter or driver.
• Keep your captures with -w so you can re-run the analysis without capturing again.

Pros and cons

Pros	Cons
Free, open source and battle-tested	Requires compatible Wi-Fi hardware
Teaches how WPA/WPA2 really works	Learning curve and terminal-based
Ideal for auditing your key's strength	Mainly Linux
Complete suite (capture, analyse, test)	Misuse is illegal

Aircrack-ng alternatives

• Kismet: a wireless detector and analyser, excellent for inventory and monitoring.
• hcxdumptool + Hashcat: a modern workflow to capture and test passwords using the GPU, much faster.
• Wireshark: to analyse captured traffic in detail and understand the protocols.
• For broader assessments, a distribution like Parrot OS or the labs at Hack The Box.

Frequently asked questions

Is Aircrack-ng free?

Yes, it is free and open-source software, available in the Kali repositories and those of most Linux distributions.

Is it legal to use Aircrack-ng?

The tool is legal. Auditing your own network is legal; capturing or decrypting traffic from other networks without explicit permission is not, and is a crime in most countries.

Can Aircrack-ng break any Wi-Fi?

No. It does not "break" the encryption: it tests passwords against the handshake using a dictionary. If the key is long and random, it will not find it. That is why a good password is the best defence.

Why isn't it capturing the handshake?

Common causes: you have not locked the correct channel, no device is reconnecting, or your card does not handle monitor mode or injection well. Lock the channel and reconnect one of your devices.

Does it work against WPA3?

WPA3 introduces protections (SAE) that neutralise the classic dictionary attack on the handshake. That is, in fact, one reason to upgrade your network to WPA3 if you can.

If you want to learn wireless and network security hands-on in a controlled way, the Hackers en Acción Academy has guided labs and challenges.