Aircrack-ng is an open-source suite for auditing Wi-Fi security. It focuses on 802.11 wireless networks and covers the full workflow: putting a wireless card into monitor mode, capturing raw wireless frames, injecting packets such as deauthentication frames, and cracking WEP and WPA/WPA2-PSK keys from captured handshakes. Wireless auditors use it to test whether a network's passphrase is strong and whether the network resists common attacks.
Last updated: 6 August 2026
The suite is a set of command-line tools that work in sequence. airmon-ng enables monitor mode on a capable adapter; airodump-ng scans for networks and captures traffic on a chosen channel; aireplay-ng can send deauthentication frames to force a client to reconnect so its WPA handshake is captured; and aircrack-ng then attempts to recover the pre-shared key from that handshake using a wordlist. In practice it is the standard toolkit for demonstrating that a weak Wi-Fi passphrase can be recovered offline once a handshake is captured.
Linux · Windows · macOS · BSD
Open source (GNU GPLv2)
sudo airmon-ng start wlan0Put a supported wireless card into monitor mode (creates wlan0mon).
sudo airodump-ng wlan0monScan the area to list nearby access points, their BSSID and channel.
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0monLock onto one AP and channel and write captured frames to files.
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0monSend 5 deauth frames to a client to help capture the WPA handshake.
sudo aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.capCrack the captured WPA/WPA2 handshake against a wordlist.
sudo airmon-ng stop wlan0monReturn the adapter to managed mode when finished.
Attacking Wi-Fi you do not own is illegal. Capturing handshakes, sending deauthentication frames or cracking a passphrase for any network without the owner's explicit permission is unauthorised access under the IT Act 2000, and deauth attacks also disrupt service. Test only your own lab network or one you are contracted, in writing, to audit.
Success against WPA/WPA2-PSK depends entirely on the passphrase being in your wordlist; a long, random passphrase is effectively uncrackable. It needs a wireless adapter that supports monitor mode and injection. WPA3 and enterprise (802.1X) networks resist these handshake attacks, so the suite is mainly effective against weak PSK setups.
| Tool | Pick it when |
|---|---|
| hcxtools + Hashcat | You want the modern PMKID/WPA workflow cracked on GPU with mode 22000. |
| Kismet | You need passive wireless discovery, monitoring and device tracking. |
| Wifite | You want an automated wrapper that orchestrates the aircrack-ng workflow for you. |
| Bettercap | You want a broader MITM framework that also handles Wi-Fi and BLE. |
| Reaver / Bully | You are specifically testing WPS PIN weaknesses. |
Ethical Hacking Course (6 months) — wireless security module
We are not affiliated with, endorsed by, or a reseller for the vendors of any tool on this site.
Free counselling call. We will tell you honestly whether a full course is worth it for what you actually want to do.
Call +91 75175 72000