How to Crack Wi-Fi Passwords Using Kali Linux
Cracking Wi-Fi passwords is a task commonly performed in penetration testing and ethical hacking, where security professionals test the vulnerability of wireless networks. Kali Linux, a powerful penetration testing distribution, contains various tools that can help with these tasks. However, it is important to emphasize that performing unauthorized Wi-Fi cracking or hacking activities is illegal. Always ensure you have explicit permission from the network owner before proceeding.
In this article, we will walk through the steps to crack Wi-Fi passwords using Kali Linux, focusing on methods like WPA/WPA2 cracking with aircrack-ng and hashcat.
Prerequisites
Before diving into Wi-Fi password cracking, ensure you have the following:
- Kali Linux installed on your machine (either on a physical or virtual machine).
- Wireless Network Adapter that supports packet injection and monitor mode. Popular options include Alfa AWUS036NHA and TP-Link TL-WN722N.
- Permission to test the network you plan to crack. Testing networks you do not own or have explicit permission to crack is illegal and unethical.
Step 1: Install Necessary Tools
Kali Linux comes with several pre-installed tools for cracking Wi-Fi passwords. Key tools include:
- aircrack-ng: A suite of tools for cracking WEP, WPA, and WPA2 passwords.
- hashcat: A powerful password-cracking tool.
You can make sure these tools are installed and updated by running:
sudo apt-get update
sudo apt-get install aircrack-ng hashcat
Step 2: Identify the Wireless Interface
To begin the attack, first, you need to identify your wireless adapter. Use the iwconfig command to list all network interfaces:
iwconfig
Look for the wireless interface (often labeled as wlan0, wlan1, etc.). You’ll need to use this interface throughout the process.
Step 3: Enable Monitor Mode
To capture the traffic required for cracking a Wi-Fi password, your wireless adapter must be set to monitor mode. Monitor mode allows your adapter to listen to all wireless traffic and inject packets.
- Stop the network manager service to avoid interference:
sudo systemctl stop NetworkManager - Set your adapter to monitor mode:
sudo ip link set wlan0 down sudo iw dev wlan0 set type monitor sudo ip link set wlan0 up
Alternatively, you can use airmon-ng:
sudo airmon-ng start wlan0
Your adapter should now be in monitor mode, typically renamed to wlan0mon or similar.
Step 4: Discover Nearby Wi-Fi Networks
Next, use the airodump-ng tool to list all nearby Wi-Fi networks and gather the necessary details (such as the BSSID, channel, and encryption type).
Run the following command to scan for networks:
sudo airodump-ng wlan0mon
This will display nearby networks, including details such as:
- ESSID (Network name)
- BSSID (MAC address of the access point)
- Channel (Wi-Fi channel the AP is on)
- Encryption type (WEP, WPA, WPA2)
Identify the target network (usually by ESSID) and note the BSSID and channel number.
Step 5: Capture the WPA Handshake
To crack the password for WPA/WPA2, you need to capture a handshake. A handshake occurs when a device connects to the network. When captured, the handshake contains the encrypted version of the Wi-Fi password.
Use airodump-ng to capture this handshake:
sudo airodump-ng -c <channel> --bssid <BSSID> -w capture wlan0mon
Replace <channel> with the channel number of the target network, and <BSSID> with the BSSID of the access point. The -w capture option tells the tool to write the captured data to a file named capture.cap.
You’ll need a device (like a phone or laptop) to connect to the target network, or you can wait for a device to authenticate. If you want to speed up the process, you can force a client to reconnect by sending a deauthentication packet:
sudo aireplay-ng --deauth 10 -a <BSSID> wlan0mon
This will send 10 deauthentication packets to the network, causing a client to disconnect and reconnect, triggering the handshake capture.
Step 6: Crack the WPA/WPA2 Password
Once you have the capture.cap file containing the handshake, you can begin cracking the WPA/WPA2 password. This process involves using a wordlist (a list of potential passwords) and comparing the hashes in the capture file to the hashes in the wordlist.
Option 1: Using aircrack-ng
The simplest tool to use for cracking WPA passwords is aircrack-ng. Run the following command:
sudo aircrack-ng capture.cap -w /path/to/wordlist.txt
capture.cap: The file containing the captured handshake.-w /path/to/wordlist.txt: The wordlist file containing potential passwords. Kali Linux includes a default wordlist at/usr/share/wordlists/rockyou.txt.
Aircrack-ng will go through each word in the list and check it against the handshake file. If a match is found, it will display the cracked password.
Option 2: Using Hashcat
For more advanced cracking, you can use hashcat, which uses your system’s GPU for faster password cracking.
First, convert the WPA handshake to a hashcat-compatible format:
sudo hcxpcapngtool capture.cap -o capture.hc22000
Then, use hashcat to crack the password:
hashcat -m 22000 -a 0 capture.hc22000 /path/to/wordlist.txt
-m 22000: Specifies the hash mode for WPA/WPA2.-a 0: Specifies the attack mode (0 means a dictionary attack).capture.hc22000: The converted handshake file./path/to/wordlist.txt: The wordlist file.
Hashcat will start attempting to crack the password using the wordlist.
Step 7: Monitor the Cracking Process
Depending on the size of your wordlist and the complexity of the password, cracking can take a few minutes to several hours or even days. You can monitor the progress of hashcat or aircrack-ng as they try each password.
If the password is found in the wordlist, the tool will display it on the screen.
Legal and Ethical Considerations
Cracking Wi-Fi passwords without permission is illegal and unethical. Always ensure that you have explicit permission from the network owner before attempting any form of penetration testing or password cracking. Unauthorized access to networks is a violation of laws in many countries and can lead to criminal charges.
Conclusion
Cracking Wi-Fi passwords using Kali Linux is a common task in penetration testing, particularly for testing WPA/WPA2 security. Tools like aircrack-ng and hashcat can help you perform dictionary-based attacks to crack passwords once you’ve captured the necessary handshake. However, it’s essential to use these techniques responsibly and legally, ensuring that you have proper authorization before attempting any form of network testing. Always follow ethical hacking practices to help improve security, not compromise it.