- Airodump-ng -c 11 -bssid 00:01:02:03:04:05 -w dump wlan0mon. With the -c parameter you tune to a channel and the parameter after -w is the prefix to the network dumps written to disk. The “-bssid” combined with the AP MAC address limits the capture to the one AP. The “-bssid” option is only available on new versions of airodump-ng.
- Replace “MAC” with the MAC address you found in the last step. Remember to replace “mon0” with whatever your interface name was. Here’s an example address: airodump-ng -c 3 — bssid 1C:1C:1E:C1:AB:C1 -w /root/Desktop/ wlan0mon; Wait for a handshake to appear.
Hi welcome back today in this tutorial you will learn how to scan for various wireless network information using airodump-ng. This information will allow further attacks to be preformed on Wireless Access Points in range. Airodump-ng comes pre-installed in Kali Linux. If your using a different Linux operating system install airodump-ng by installing aircrack-ng.
If you are running this on a Macbook and are having troubles putting the wireless device into monitor mode, then you need to follow my previous tutorials regarding this. If you’re running this on another machine then chances are you can use the airmon-ng start wlan0 command to switch to monitoring mode.
For the rest of this tutorial I will assume we are working on a macbook pro and that the wireless monitoring device is called prism0.
STEP 1
- Check that you have monitoring mode enabled. Run ifconfig or iwconfig to check on this.
- In the above screen shot you can see that we have the prism0 wireless device. This is our monitoring mode device on the macbook.
STEP 2
- Run airodump-ng with options to write to a captured file. We will name this capture file “capture”
- Once airodump is running, we need to identify which wireless network we wish to crack. For this tutorial we are looking for a WPA type with a PSK. I’ve setup a wireless network for us to crack with these requirements, you can see two in the below screenshot. We need to run airodump until we have captured a WPA handshake. Once a handshake has been captured it will show in the top row, as illustrated below. (This means waiting for someone to connect to the access point. If you don’t want to wait you can force a de-authentication of a device connected to the network and hope they reconnect)
- If you wish to make a forced disconnection in order to capture the handshake you can execute the following :-
Airodump For Macbook
STEP 3
Airodump For Mac Os
- Once you have captured a handshake packet on the access point we wish to hack you can proceed to the next step, which is cracking the password. We are using a brute force method, which can take some time, but basically means running through a dictionary of words and finding which works. This can take hours, and there’s no guarantee that the password is in your dictionary. There’s many free online dictionaries in .txt format you can use. For the purposes of testing however you can use a password that you know is in your dictionary as we are just doing this for a learning experience.
- Run aircrack-ng and you will see a list of options. We need to input two options, the first is the BSSID of the network you wish to crack, the other is the path to the dictionary you will be using.
- Finally input the path to the capture file.
aircrack-ng -b 3C:Df:A9:66:E6:56 -w /root/Documents/Dictionarys/passwords.txt /root/Documents/CapturedPackets/capture-01.cap - After hitting enter if everything is done correctly aircrack will begin running through the dictionary. Now it’s just a matter of waiting until it finds the correct password
- Here’s the final cracked password
Comments are closed.