Cyber Research Wiki

Aircrack-ng Suite

A collection of command-line tools for monitoring, testing, and auditing Wi‑Fi networks, including packet capture, frame injection, and offline key recovery for WEP and WPA/WPA2‑PSK.

Overview

Aircrack‑ng is an open‑source suite for assessing security of IEEE 802.11 networks at the MAC layer. It organizes functionality into four areas: monitoring (frame capture and export), attacking (frame replay, deauthentication, fake AP), testing (adapter/driver capability checks), and cracking (offline key recovery for WEP and WPA/WPA2‑PSK, including PMKID workflows). The toolkit is CLI‑centric and scriptable, with primary use on Linux and limited support on other platforms. Beyond offensive testing, it is used by defenders to validate wireless monitoring pipelines, tune WIDS/WIPS, and evaluate policy controls such as Protected Management Frames (PMF/802.11w).

What It Is

A modular toolkit composed of specialized utilities that operate on 802.11 traffic and device behavior. Notable components include: airmon‑ng for managing monitor mode; airodump‑ng for discovery and capture of 802.11 frames; aireplay‑ng for frame injection and replay; aircrack‑ng for offline recovery of WEP and WPA/WPA2‑PSK keys; airdecap‑ng for decrypting captures with known keys; airbase‑ng for emulating access points or clients; and airolib‑ng for precomputing PMKs to accelerate PSK workflows. Its cracking focus is WEP and WPA/WPA2‑PSK using captured handshakes or PMKIDs, with handling for environments that implement PMF/802.11w. The project positions the suite for authorized assessment and emphasizes hardware/driver compatibility.

How It Works

The suite interfaces with compatible wireless chipsets and drivers that support monitor mode and, for active testing, raw frame injection. In passive operation, airodump‑ng captures management and data frames to enumerate BSSIDs, SSIDs, channels, cipher suites, and associated clients, exporting results for external analysis. For active assessments, aireplay‑ng constructs and transmits crafted frames—such as replays or deauthentication—to study network and client behavior and, where permitted, to facilitate capture of authentication material. Offline key recovery uses aircrack‑ng to test candidate keys against captured WPA/WPA2 handshakes or PMKIDs and to analyze WEP IVs, verifying correctness by deriving and comparing message integrity codes or keys. Airbase‑ng can emulate AP or client roles to probe client behavior and evaluate controls against rogue infrastructure. Throughout, adapter and driver capabilities determine feasibility and reliability of capture and injection.

Core Concepts

Typical Workflow

Use Cases

Limitations

Related Tools

Evidence Gaps

Sources

Confidence

high