Most home Wi‑Fi routers use WPA2, and the security of that protocol depends entirely on the passphrase you choose. The aircrack‑ng suite lets you test that passphrase on your own equipment—legally. This tutorial shows you how to capture a WPA2 handshake and run a dictionary attack against it. Every command is meant for your own router or a lab where you have explicit permission. Using these techniques on someone else’s network without consent is illegal and unethical.
What Is aircrack‑ng?
aircrack‑ng is a collection of tools for assessing Wi‑Fi network security, not a single program. It includes:
- airmon‑ng – enables monitor mode on a wireless interface
- airodump‑ng – captures raw 802.11 frames and shows nearby access points and clients
- aireplay‑ng – injects packets, including deauthentication frames
- aircrack‑ng – cracks WEP and WPA/WPA2 pre‑shared keys from captured data
Together they let you observe wireless traffic, force a client to reconnect, capture the four‑way handshake that contains the encrypted password, and then attempt to recover that password using a wordlist. For a beginner, this is the most direct way to understand why WPA2 with a strong passphrase matters.
Hardware and Software Requirements
Your wireless card must support monitor mode and packet injection. Most internal laptop Wi‑Fi chips (especially those from Intel) do not allow this. A cheap USB adapter based on the Ralink RT5370 or Atheros AR9271 chipset works reliably and costs under $20. On the software side, a Linux distribution such as Ubuntu, Kali Linux, or Parrot OS is ideal because the aircrack‑ng tools are in the default repositories. Install them with:
sudo apt update && sudo apt install aircrack-ngStep 1: Find Your Wireless Interface and Enable Monitor Mode
Plug in your USB adapter (or use a compatible internal card) and run iwconfig to see its name, typically wlan0 or wlan1. Then bring it down and put it into monitor mode:
sudo airmon-ng start wlan0This creates a new interface called wlan0mon (or wlan1mon). Verify with iwconfig – you should see “Mode:Monitor”.
Step 2: Capture Traffic and Identify Your Target
Run airodump‑ng to list all nearby access points. Replace wlan0mon with your monitor interface:
sudo airodump-ng wlan0monYou will see a table of BSSIDs (MAC addresses), channels, encryption types, and signal levels. Locate your own router in the list. Note its BSSID and the channel it uses. Press Ctrl+C to stop scanning.
Now start a focused capture on that specific channel and save the output to a file:
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0monReplace 6 with your router’s channel and AA:BB:CC:DD:EE:FF with its BSSID. The -w handshake tells airodump‑ng to write packets to files named handshake-01.cap, etc. Leave this terminal running.
Step 3: Capture the WPA2 Handshake
To obtain the four‑way handshake, you need a client to connect (or reconnect) to the access point. If a device is already connected, you can force it to reconnect by sending a deauthentication packet. In a second terminal, run:
sudo aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0monHere -0 2 sends two deauth frames, -a is the router’s BSSID, and -c is the MAC address of a connected client (you can see clients in the airodump‑ng output). The client will briefly disconnect and automatically reconnect, generating the handshake. Watch the airodump‑ng terminal; when it displays [WPA handshake: AA:BB:CC:DD:EE:FF] at the top, you have captured it.
Step 4: Crack the Handshake with a Wordlist
Now close the airodump‑ng terminal. The captured data is in handshake-01.cap. To attempt to recover the password, you need a wordlist. A common choice is rockyou.txt (available in Kali or downloadable from many sources). Run:
sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt handshake-01.capaircrack‑ng will try every password in the list. If your router’s password is a common word or a simple combination, it will be revealed in seconds. If not, the tool will report that the key was not found. This is a perfect demonstration of why a long, random passphrase is essential—dictionary attacks only work against weak passwords.
Understanding the Results
When aircrack‑ng finds the password, it displays the plain‑text key. For a learning exercise, you can then change your router’s password to something stronger and repeat the test—you will see that the same wordlist cannot crack it. This hands‑on experience teaches more than any theory about the importance of password entropy.
Legal and Ethical Boundaries
Every step above assumes you are testing your own router or a lab network you own. Capturing handshakes from neighbours, public Wi‑Fi, or any network without written permission violates computer‑fraud laws in most countries. Even sending a single deauth packet to a network you do not control is illegal. Always get explicit authorization before running any wireless security tool outside your own premises. Many universities and training platforms provide dedicated lab environments where you can practice safely.
Next Steps After the Tutorial
Once you have successfully captured and cracked a handshake, you can explore other parts of the aircrack‑ng suite: aircrack-ng also cracks WEP, though WEP is obsolete and rarely encountered. You can also use airdecap-ng to decrypt captured traffic if you already know the key. For deeper wireless analysis, tools like tcpdump and Wireshark can open the .cap files and let you inspect each packet.
After this tutorial, change your home router’s password to a passphrase of at least 16 characters, mixing uppercase, lowercase, digits, and symbols. Then run the capture again with a custom wordlist that does not contain that new password. Observe that aircrack‑ng fails—and you will have proven to yourself that a strong password is your first line of defence.
