Wireless Penetration Testing: Crack WPA2 Passwords with Aircrack-NG

Main ideas / lessons conveyed

• The video’s stated goal is educational: show how wireless penetration testing can be performed against WPA/WPA2, highlighting the importance of:
  • Changing router default passwords
  • Using strong, secure passwords
• It frames the work as ethical hacking that requires legal permission.
• It demonstrates a typical workflow used to:
  1. Put the Wi‑Fi adapter into monitor mode
  2. Discover nearby wireless networks
  3. Capture a WPA handshake by deauthenticating a client
  4. Crack the captured handshake using wordlists with aircrack-ng
  5. After obtaining the password, connect to the network on Linux via wpa_supplicant

Note: The content is presented for authorized, educational penetration testing only.

Step-by-step methodology / instructions (as presented)

0) Safety, scope, and prerequisites

• Perform only with legal authorization (ethical hacking).
• The demo is for educational purposes.
• Identify that the target is using WPA or WPA2.

1) Confirm the wireless interface exists (Kali Linux)

Run:

iwconfig

• Look for a wireless adapter (e.g., wlan0).
• If adapters aren’t detected, the speaker references another video about fixing alpha adapter issues in Kali Linux.

2) Kill conflicting Wi‑Fi management processes (blank slate)

Run:

sudo airmon-ng check kill

Purpose:

• Stops processes like wpa_supplicant that would otherwise interfere
• Ensures a clean environment for monitor mode + capturing

3) Enable monitor mode on the wireless adapter

Run:

sudo airmon-ng start wlan0

Notes:

• Some adapters rename the interface when in monitor mode (example: wlan0 → wlan0mon).
• If renamed, use the new interface name in later commands.

4) Discover nearby networks

Run airodump-ng with the interface:

sudo airodump-ng <interface>

Important scanning note about band options:

• The speaker mentions using band options like:
  • sudo airodump-ng <band options> <interface> (specifically recommending “d-band abg” / --band a,b,g)
• Rationale:
  • Without band options, scanning may focus on 2.4 GHz
  • With band options, scan across more ranges

Collect:

• BSSID (target access point identifier)
• Channel for the target network

5) Capture handshake traffic from only the target AP

Run a targeted capture using channel match, BSSID filtering, and an output file:

sudo airodump-ng --channel <channel> --bssid <BSSID> -w <capturefile> <interface>

During capture:

• Wait to see router and client info
• Record client MAC addresses (needed for targeted deauth)

6) Force a client to reconnect to obtain the WPA handshake

In a new terminal tab, run deauthentication (deauth):

sudo aireplay-ng -0 1 -a <AP BSSID> -c <client MAC> <interface>

Expected result:

• The client reconnects to the access point
• The capture file begins to show a WPA handshake

Deauth adjustment guidance:

• Usually one deauth packet (-0 1) is enough.
• If needed, increase the count (-0 <N>).
• You can send continuous deauth with -0 0 (until stopped).

Driver compatibility note:

• Some drivers may not target unicast deauth reliably.
• If targeted deauth fails, omit the client option (-c <client>) to send to all clients (broadcast).
  • The speaker discourages this because it can resemble denial-of-service across the network and calls it a last resort.

7) Disable monitor mode after capturing

Run:

sudo airmon-ng stop <interface>

• Confirm monitor mode is disabled.

8) Crack the captured WPA handshake with aircrack-ng

Run aircrack-ng using:

• A wordlist (-w)
• Target SSID (-e)
• Target BSSID (-b)
• The capture file (.cap)

Command structure described:

aircrack-ng -w <wordlist> -e <SSID> -b <BSSID> <capturefile>.cap

Wordlist guidance:

• The speaker uses rockyou.txt as a common default wordlist.
• Warns that in real-world scenarios, wordlists matter and may need to be tailored.

Additional note:

• The speaker claims you can often omit SSID (-e) and BSSID (-b) if you already have the capture file.

9) Example of a tailored wordlist using a known router PIN pattern

The speaker demonstrates faster cracking using a wordlist containing all 8-digit numeric combinations, based on the assumption the router uses an 8-digit PIN.

Process described:

• Search for the router model/SSID (example: “TPLink C6F6”)
• Use public info to confirm it uses an 8-digit PIN
• Build/use a wordlist of all 8-digit combinations

Reported results:

• With full combinations: “a few hours”
• Then a smaller/tuned list: “instantly,” yielding a key (example shown: 76212741)

10) Connect to the cracked Wi‑Fi on Kali/Linux using wpa_supplicant

Create/edit a configuration file (example shown as wifi.conf):

• Specifies:
  • SSID
  • psk (the discovered WPA key)
  • Uses WPA-PSK on WPA2, explicitly described as:
    • “WPA pre-shared key” on “WPA2 protocol”
  • If it were WPA1, they say to remove the 2 (as presented)

Start wpa_supplicant:

sudo wpa_supplicant -B -D nl80211 -i <interface> -c <configfile>

Notes:

• Linux capitalization matters.
• -B backgrounds the process to avoid locking up the terminal.

Request an IP via DHCP:

sudo dhclient -v <interface>

Verification:

• Browse to the router admin IP found via DHCP (example: 192.168.0.x)
• Log into the router web interface
• Confirm the wireless password shown matches what was cracked

Main tools / technologies mentioned

Kali Linux / Linux networking utilities

• iwconfig
• dhclient

Wireless monitoring & capture

• airmon-ng (monitor mode management)
• airodump-ng (network discovery + packet capture)
• aireplay-ng (deauthentication to prompt handshake capture)

Cracking

• aircrack-ng (crack WPA handshake using wordlists)
• Wordlists:
  • rockyou.txt
  • A custom numeric PIN wordlist

Association/auth on Linux

• wpa_supplicant (connect using WPA2 PSK config)

Speakers / sources featured

• Kaiser Clark (video narrator/speaker; cybersecurity professional and full-time penetration tester)