Wifite2 - Automated Wireless Auditor

What is Wifite2?

Wifite2 is a tool that largely automates the testing of wireless networks. You see the WiFi networks in range, pick a target and the tool carries out the well-known attacks against it on its own. Wifite2 is written in Python and is the rewrite of the original Wifite from 2010.

Wifite2 is not a cracking tool itself. It is a clever way of driving tools that were already there: Aircrack-ng for capturing and cracking handshakes, reaver and bully for WPS attacks, and tshark for reading out captures. The gain is in the order. Wifite2 works out per network which attack stands a chance, tries it, and moves on to the next one if it does not succeed. That saves you tying separate commands together by hand.

The tool comes with Kali Linux by default. For some years now the original repository has been getting few updates, and Kali ships a more actively maintained fork. The author has since moved on to wifit3, which turns the approach on its head.

What do we use Wifite2 for?

In a WiFi pentest Wifite2 is the tool for the first pass. In one run you see which access points are there, which encryption they run, whether WPS is open and how many clients are attached to them. That tells us straight away where the weak spots are.

After that we use the tool to demonstrate it. A captured handshake that then breaks open with Hashcat proves that the WiFi key is too weak. A successful PixieDust attack proves that WPS has to be switched off. Those are the concrete findings that end up in a report, along with the evidence.

Installing Wifite2

On Kali Linux Wifite2 is already installed and you start it directly with sudo wifite. On another distribution, or if you want the latest version from source:

git clone https://github.com/derv82/wifite2.git
cd wifite2 && sudo python3 setup.py install

# Check that everything works and which components are missing
sudo wifite -h

Bear in mind that Wifite2 leans on external programs. If aircrack-ng, reaver or tshark is missing, the tool quietly skips the attacks that go with it, without a clear error message. So always check first that they are present.

Using Wifite2

Connect a suitable USB adapter first. If you are working in a virtual machine, pass the device through to the VM and not to the host system. Wifite2 then selects the adapter itself and puts it into monitor mode, so you do not have to fiddle with airmon-ng by hand.

# Standard start: shut down conflicting processes and scan all channels
sudo wifite --kill

The tool starts scanning and shows the networks it finds. The ESSID column holds the name, CH is the channel, PWR the signal strength and CLIENTS the number of connected devices. Let the scan run for a while, because clients only appear once they send traffic. Press CTRL+C to stop and enter the number of your target, or a range such as 1,3-5.

From that point on Wifite2 works through the attacks itself, one after another, so the network does not get overloaded by everything being tried at once.

In practice you steer that process with filters, so that you do not end up on networks that fall outside the scope:

# Only WPA networks that actually have clients on them
sudo wifite --kill --wpa --clients-only

# Lock onto one channel, which saves a lot of time if you already know the target
sudo wifite --kill -c 6

# PMKID only: no client needed and you disturb nobody
sudo wifite --kill --pmkid

# Fully passive: never deauthenticate
sudo wifite --kill --nodeauths

# Use your own wordlist for the cracking
sudo wifite --kill --dict /usr/share/wordlists/rockyou.txt

Afterwards you check what has been captured and what has already been cracked:

# Show access points cracked earlier
sudo wifite --cracked

# Check a capture for a usable handshake
sudo wifite --check hs/handshake_TestLab_02-5f-a3-1c-84-d0.cap

Important options of Wifite2

The --nodeauths option is one to remember. Deauthentication actively breaks users’ connections, and that is by no means always acceptable within the agreed scope. Listening in passively takes longer, but disturbs nothing. The same goes for -p, pillage mode: it attacks everything it sees, and in an environment with neighbouring networks that is exactly what you do not want.

Which attacks does Wifite2 carry out?

A captured handshake is not a password yet. Wifite2 tries to crack it with a bundled wordlist, but for serious cracking work you export the capture and put Hashcat on it with a GPU. If that does not succeed, that in itself is a perfectly good finding: the key is strong enough.

Wifite2 or wifit3?

Both tools come from the same author, but they solve the problem differently. Wifite2 drives existing Linux tools and needs a kernel driver in monitor mode to do so. wifit3 drops that and talks to the USB adapter directly, which is why it also works on Windows and macOS and why you no longer need aircrack-ng.

Choose Wifite2 if you work on Kali and have an adapter that handles monitor mode, because the hardware support is broader and the tool is proven. Choose wifit3 if your adapter is on the supported list, if you want to test WPA3 networks in transition mode, or if you do not work on Linux. If you want to understand what happens under the hood, bring in Aircrack-ng and carry out the steps by hand. We use all three, depending on the environment and the scope.

Detection and defence

The attacks from Wifite2 are noisy. A deauthentication is an 802.11 management frame of subtype 12, which rarely occurs in normal traffic and never in runs of dozens. A run of failed WPS attempts leaves traces in the log of the access point and puts many modern devices into a lockout, which is a signal in itself. Wireless intrusion detection in an enterprise environment sees this without any trouble, and controllers from Ubiquiti, Aruba and Cisco report it as “deauth flood” or “WPS brute force”.

For your own network the following counts most. Switch WPS off, because PixieDust cracks a vulnerable access point in seconds and no strong password helps against that. Use a long, random WPA2 key that is not in a wordlist, so that a captured handshake is worthless. Switch WPA3 with Protected Management Frames (802.11w) on if your equipment supports it, because PMF signs management frames and thereby makes loose deauthentication frames useless.

If you want to know how resilient your wireless network really is, a WiFi pentest maps that out. To see what these attacks look like in practice, read our blog on WiFi hacking with wifit3.

Only use Wifite2 on networks that are yours or for which you have explicit, written permission. Deauthentication breaks the connections of bystanders who have nothing to do with your test. Without permission, attacking a wireless network is a criminal offence.