Aircrack-ng

Aircrack-ng is the standard open-source suite for assessing 802.11 (Wi-Fi) network security. It is a suite, not a single tool: the components chain together into a capture → inject → crack workflow against WEP and WPA/WPA2-PSK networks. The eponymous aircrack-ng binary is only the final cracker; the capture and injection tools do the real work first.

The toolchain

Tool	Role
airmon-ng	Puts a compatible wireless card into monitor mode (passive sniffing of raw 802.11 frames) and back
airodump-ng	Packet capture: dumps raw 802.11 frames, collecting WEP IVs or WPA 4-way handshakes to a pcap/ivs file
aireplay-ng	Frame injection: deauthentication, fake authentication, and ARP-request replay to force traffic / handshake generation
aircrack-ng	The cracker: statistical WEP key recovery (PTW / FMS attacks) or dictionary/brute attack on a captured WPA handshake
airdecap-ng	Decrypts WEP/WPA capture files once the key is known

The WPA/WPA2-PSK workflow

The canonical assessment sequence from the official tutorial:

# 1. Enable monitor mode
airmon-ng start wlan0
 
# 2. Capture on the AP's channel, filtered to its BSSID, writing to a file
airodump-ng -c 9 --bssid 00:14:6C:7E:40:80 -w psk wlan0mon
 
# 3. (Optional but usual) Deauthenticate a connected client to force
#    it to re-run the 4-way handshake while you capture
aireplay-ng -0 1 -a 00:14:6C:7E:40:80 -c <client MAC> wlan0mon
 
# 4. Crack the captured handshake against a wordlist
aircrack-ng -b 00:14:6C:7E:40:80 -w wordlist.txt psk*.cap

The -b selects the target BSSID, -w the wordlist, and the capture file must contain a complete 4-way handshake — airodump-ng displays “WPA handshake: ” in the upper-right when one has been captured. Without the full handshake, aircrack-ng has nothing to test passwords against.

WEP vs WPA cracking

• WEP is broken cryptographically: aircrack-ng recovers the key statistically from enough captured IVs (no wordlist needed), typically accelerated by aireplay-ng ARP replay to generate IV-rich traffic. A few hundred thousand IVs is usually plenty with PTW.
• WPA/WPA2-PSK has no equivalent statistical flaw; the only offline attack is guessing the passphrase and checking each candidate against the captured handshake. Success is therefore a wordlist problem — this is where hashcat (GPU-accelerated, mode 22000 for WPA-PBKDF2) typically takes over from aircrack-ng’s CPU cracker for serious work.
• WPA3-SAE resists offline dictionary attacks by design (Dragonfly handshake), pushing assessment toward downgrade, rogue-AP, and client-side attacks instead.

Operational notes

• Everything depends on the card/chipset: it must support monitor mode and injection. Many internal laptop cards do one but not the other; USB adapters with Atheros/RT3070/MT7612U-class chipsets are the usual recommendation.
• Deauthentication (aireplay-ng -0) is loud and disruptive — it works because classic 802.11 management frames are unauthenticated, and 802.11w protected management frames defeat it (see wifi-deauthentication-attacks).
• Only run against networks you are authorized to assess; injection and deauth are unambiguous on the wire.

Sources

• Aircrack-ng — Documentation
• Aircrack-ng — Tutorial: How to Crack WPA/WPA2
• Aircrack-ng — Airodump-ng Documentation

Related

• wi-fi — SSID/BSSID/ESSID and why management frames are attackable
• hashcat — GPU cracking of captured WPA handshakes
• cewl-custom-wordlist-generator — building the wordlist side of the attack
• wifi-deauthentication-attacks — the deauth primitive aireplay-ng -0 invokes; why PMF blunts it