October 22, 2026 · 6 min read · tools
Aircrack-ng is the classic collection of tools for testing wireless networks. The suite has been around since 2006 and is still the foundation under almost everything that happens in the WiFi field. Many more modern tools, including Wifite2, are really a clever way of driving these components.
Where newer tools hide everything behind one button, Aircrack-ng gives you separate tools that you tie together yourself. That takes more work, but you see exactly what is happening. That is also why it is the best way to learn how an attack on a wireless network really fits together.
The name causes confusion. aircrack-ng is both the name of the whole suite and the name of the one component that cracks the key.
During a WiFi pentest we use the suite for the work we want to keep control over. An automated tool decides for itself which attack it tries, and that is not always what you want within an agreed scope. With airodump-ng you can listen purely passively without disturbing anything, and in a production environment that is often the only permitted way of working.
The suite is also our fallback. If an adapter does not work with a newer tool, or you want to analyse a capture from another source, you almost always end up at airodump-ng or aircrack-ng. For the real cracking work we then switch over to Hashcat, because that is many times faster on a GPU.
| Component | What it does |
|---|---|
airmon-ng |
Puts your adapter into monitor mode and shuts down conflicting processes |
airodump-ng |
Scans networks and records traffic in a capture file |
aireplay-ng |
Injects frames, for deauthentication and fake authentication among other things |
aircrack-ng |
Cracks WEP keys and WPA handshakes from a capture |
airbase-ng |
Sets up a fake access point for evil twin scenarios |
airdecap-ng |
Decrypts a capture once you have the key |
airolib-ng |
Manages pre-computed PMK tables per SSID |
On Kali Linux the suite is pre-installed. On other distributions:
sudo apt install aircrack-ng
Then check whether your adapter can inject. Without injection the deauthentication attacks do not work:
sudo airmon-ng check kill # shut down conflicting processes
sudo airmon-ng start wlan0 # switch on monitor mode
sudo aireplay-ng --test wlan0mon # can this card inject?
If you get messages about conflicting processes, NetworkManager has claimed your card. airmon-ng check kill shuts those down. Afterwards you put the card back with sudo airmon-ng stop wlan0mon.
This is the classic order for capturing a WPA2 handshake. Only use it on your own network.
1. See what is there. airodump-ng shows the networks in range with their BSSID, channel and encryption.
sudo airodump-ng wlan0mon
2. Listen in on a specific target. Once you have your target, you lock airodump-ng onto that channel and that BSSID, and write everything to a file. Keep this window open, because this is where the message will appear in a moment.
sudo airodump-ng -c 6 --bssid 02:5f:a3:1c:84:d0 -w vangst wlan0mon
3. Force a handshake. A handshake only happens when a device connects. With a deauthentication you briefly throw a connected client off, after which it reconnects automatically. Aim at one client instead of at broadcast: that works better and disturbs less.
# -a is the access point, -c the client, 5 is the number of deauths
sudo aireplay-ng --deauth 5 -a 02:5f:a3:1c:84:d0 -c 0a:3c:71:e8:4f:12 wlan0mon
WPA handshake then appears in the top right of the airodump-ng window. That is your signal that you have enough. Keep the number of deauths low: five is enough, and more only disturbs unnecessarily.
4. Cracking. Now that you have the handshake, the rest is offline work that you can do anywhere.
# Quick test with a small list, on the processor
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 02:5f:a3:1c:84:d0 vangst-01.cap
# Serious cracking work: first convert to the 22000 format, then put the GPU on it
hcxpcapngtool -o vangst.hc22000 vangst-01.cap
hashcat -m 22000 vangst.hc22000 /usr/share/wordlists/rockyou.txt
In practice we usually skip step 4 with aircrack-ng and go straight to Hashcat, because a GPU does the work tens of times faster.
| Command and option | Purpose |
|---|---|
airodump-ng -c [channel] |
Lock onto one channel instead of hopping |
airodump-ng --bssid [mac] |
Show and record only this access point |
airodump-ng -w [name] |
Write traffic to name-01.cap |
airodump-ng --band abg |
Include 5 GHz in the scan as well |
aireplay-ng --deauth [n] |
Send n deauthentication frames, 0 is continuous |
aireplay-ng -a / -c |
The access point and the specific client |
aireplay-ng --test |
Check whether the adapter can inject |
aircrack-ng -w [list] |
Wordlist for the cracking |
aircrack-ng -b [mac] |
Choose which network from the capture you crack |
airmon-ng check kill |
Shut down NetworkManager and other sources of interference |
Watch out with --deauth 0: that sends deauthentication frames non-stop and effectively takes a network down. Within a pentest that is rarely allowed, and unnecessary besides, because a handful of frames yields the same handshake.
All three do the same kind of work, but at a different level of automation.
Aircrack-ng gives you separate tools and full control. You decide yourself which attack you carry out and when, which matters if the scope prescribes passive listening. Wifite2 drives those same components automatically and chooses the order itself, which saves a lot of time in an environment with dozens of networks. wifit3 goes a step further and lets go of the suite completely: it talks to the USB adapter directly, no longer needs aircrack-ng, also runs on Windows and macOS, and is the only one that can push WPA3 in transition mode back to WPA2.
We use them alongside each other. The suite to understand things and to work in a targeted way, the automated tools to get a quick picture of an environment with many networks.
The attacks from this suite are clearly visible. A deauthentication is an 802.11 management frame of subtype 12, which rarely occurs in normal traffic and never in runs from the same MAC address. Monitor mode itself is passive and therefore cannot be detected, but as soon as you start injecting you give away your position. Wireless intrusion detection in an enterprise environment picks this up without any trouble, and controllers from Ubiquiti, Aruba and Cisco report it as “deauth flood”.
For your own network, this is what counts most. Switch WPS off, because that is the quickest route in and a strong password does not help against it. Use a long, random WPA2 key that is not in a wordlist, because a captured handshake is only valuable if the password can be guessed. Switch WPA3 on with Protected Management Frames (802.11w) as soon as your equipment supports it, because PMF signs management frames so that loose deauthentication frames are ignored. And turn transition mode off as soon as all devices can handle WPA3, because otherwise that fallback still makes a WPA2 handshake possible.
For how these attacks play out in practice, read our blog on WiFi hacking with wifit3.
Only use Aircrack-ng on networks that are yours or for which you have explicit, written permission. Deauthentication breaks the connections of bystanders. Without permission, attacking a wireless network is a criminal offence.
aircrack-ng command is only the part that tries to crack the actual key out of a captured file. So you do the scanning and the capturing with other components of the same suite.
sudo aireplay-ng --test wlan0mon.
-c to the channel of your target. If that still does not work, a PMKID attack may be the answer, because that one does not need a client at all.
aircrack-ng is actually slow, because it runs on the processor. It is fine for a quick test of whether an obvious password is in a short list. For serious cracking work you convert the capture to the 22000 format and put Hashcat on it with a GPU, which is tens to hundreds of times faster.
Wifite2 automates the testing of wireless networks: it maps out WiFi networks and applies handshake, PMKID and WPS attacks per network.
wifit3 (often searched for as wifite3) is the successor to Wifite2: a WiFi pentest tool that works without aircrack-ng and runs on Linux, Windows and macOS.
Hashcat cracks password hashes with the GPU and makes millions of attempts per second. We use it for WiFi handshakes, Windows hashes and Kerberos tickets.