d : use masking of the key (A1:XX:CF:YY) h : search the numeric key for Fritz!BOX t : search binary coded decimal chr only c : search alpha-numeric characters only C : merge the given APs to a virtual one q : enable quiet mode (no status output) b : target selection: access point's MAC e : target selection: network identifier a : force attack mode (1/WEP, 2/WPA-PSK) EAPOL packets (2 and 3) or packets (3 and 4) are considered a full handshake. However, aircrack-ng is able to work successfully with just 2 packets. For WPA handshakes, a full handshake is composed of four packets. A “four-way handshake” is required as input. SSE2 support is included to dramatically speed up WPA/WPA2 key processing. The FMS/KoreK method incorporates various statistical attacks to discover the WEP key and uses these in combination with brute forcing.Īdditionally, the program offers a dictionary method for determining the WEP key.įor cracking WPA/WPA2 pre-shared keys, only a dictionary method is used. The second method is the FMS/KoreK method. The main advantage of the PTW approach is that very few data packets are required to crack the WEP key. An important limitation is that the PTW attack currently can only crack 40 and 104 bit WEP keys. This Tutorial: Packets Supported for the PTW Attack page provides details. Please remember that not all packets can be used for the PTW method. If the key is not found, then it uses all the packets in the capture. In the first phase, aircrack-ng only uses ARP packets. The first method is via the PTW approach (Pyshkin, Tews, Weinmann).

This part of the aircrack-ng suite determines the WEP key using two fundamental methods. Using this program without the knowledge of the Wi-Fi owner is a legal violation.Īircrack-ng can recover the WEP key once enough encrypted packets have been captured with airodump-ng. This is a program for professionals in the field of IT security, its use requires the consent of the owner of the wireless network.

This program is covered in the Wireless Attacks (PEN-210) (WiFu) course from Offensive Security and many other information security courses. Aircrack-ng is used by security professionals to test the reliability of wireless networks. Aircrack-ng is a Wi-Fi security auditing tool specifically 802.11 WEP and WPA/WPA2-PSK.

How to use aircrack on kali