Aircrack-ng explained: tools, adapter requirements and how to test Wi-Fi security
Aircrack-ng is a versatile and powerful tool for ethical hackers who want to test the security of wireless networks. By offering features such as packet sniffing, WPA and WEP cracking, and dictionary-based attacks, Aircrack-ng helps security professionals assess the strengths and weaknesses of wireless networks. With its open-source nature, ease of use, and compatibility with multiple platforms, it remains a key tool for cybersecurity assessments and wireless network security.
Quick answer: Aircrack-ng is an open-source suite for assessing Wi-Fi security. Its tools capture wireless traffic, test whether a network's keys or passphrase can be recovered, and check driver support. Use it only on networks you own or have written permission to test. It needs an adapter that supports monitor mode.
Key takeaways
- Aircrack-ng is a suite: airmon-ng, airodump-ng, aireplay-ng and aircrack-ng each do one job.
- You need a Wi-Fi adapter and driver that support monitor mode and packet injection.
- WEP is broken. A weak WPA2 passphrase can be guessed offline from a captured handshake.
- Test only your own lab access point or one you have written permission to test.
- Defend with WPA3, long random passphrases and WPS disabled.
What is Aircrack-ng?
Aircrack-ng is a free suite of command-line tools for assessing the security of Wi-Fi networks. It is open source and is included in Kali Linux. The project site and documentation are at aircrack-ng.org.
A security tester uses it to answer one question: how easily could someone break into this wireless network? The answer helps the owner fix it.
Legal note. Capturing traffic from or attacking a network you do not own, without written permission, is illegal in India under the Information Technology Act, 2000. Use a router you own, set up for the purpose, in your own lab.
Which tools are in the suite?
| Tool | What it does |
|---|---|
airmon-ng | Puts a wireless card into monitor mode |
airodump-ng | Lists nearby networks and captures packets |
aireplay-ng | Sends crafted frames, for example to test deauthentication |
aircrack-ng | Tests captured data against WEP keys or a WPA/WPA2 wordlist |
airdecap-ng | Decrypts capture files when the key is known |
What adapter do you need?
You need a Wi-Fi adapter whose chipset and driver support monitor mode and packet injection. Many built-in laptop cards do not allow this under a virtual machine. A USB adapter is the usual solution. Pass it through to your Kali VM.
Check what your adapter can do:
$ iw list | grep -A 8 "Supported interface modes"
$ sudo aireplay-ng --test wlan0If "monitor" appears in the supported modes, the card can sniff. The injection test tells you whether it can send frames. Look at the Aircrack-ng documentation for compatible chipsets rather than trusting a shop listing.
How do you set up a safe lab?
- Use a spare router you own as the test access point. Set a WPA2-PSK passphrase on it.
- Keep it away from your normal home or office network.
- Use a Kali VM with a USB adapter attached.
- Connect one test device to the access point.
How do you test your own network?
Put the card into monitor mode and look at the networks around you:
$ sudo airmon-ng start wlan0
$ sudo airodump-ng wlan0monairodump-ng shows the SSID, BSSID, channel and encryption of every network it hears. Only your own lab access point is in scope. Lock the capture to its channel and write to a file. When your test device connects, a WPA handshake can be captured. You then run aircrack-ng with a wordlist against that file. If the wordlist finds your passphrase, the passphrase is weak. If it does not, that tells you only that your wordlist did not contain it. WPA2 security depends entirely on the strength of the passphrase.
What do the results teach?
- WEP can be recovered from enough captured traffic, so it should never be used.
- WPA2-PSK with a short or common passphrase can be guessed offline from a captured handshake.
- WPA3 uses SAE, which resists this offline guessing. See our guide to Wi-Fi encryption standards.
How do you defend your Wi-Fi?
- Use WPA3, or WPA2 with a long random passphrase of 14 or more characters.
- Disable WPS, which has its own weaknesses.
- Change default router admin passwords and keep firmware updated.
- Use WPA2/WPA3-Enterprise with individual credentials in an organisation.
- Monitor for rogue access points and unusual deauthentication floods.
Common problems
- Adapter not detected in the VM: attach the USB device to the guest, not the host.
- Monitor mode fails: stop NetworkManager and
wpa_supplicantfirst, asairmon-ng check killsuggests. - No injection: the driver or chipset does not support it. Use a supported adapter.
Where does this fit in your career?
Wireless testing is a standard part of a penetration test. OffSec offers a dedicated wireless course, covered in our OSWP course. More tools are in top Linux security tools for ethical hackers.
Next steps
If you want to practise wireless testing properly, see the OSWP PEN-210 course. For the wider tool set read the top eight Kali Linux tools.
Related reading
Frequently Asked Questions
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Wow
0
Sad
0
Angry
0
Vaishnavi is a skilled tech professional at the Ethical Hacking Training Institute in Pune, responsible for managing and optimizing the technical infrastructure that supports advanced cybersecurity education. With deep expertise in network security, backend operations, and system performance, she ensures that practical labs, online modules, and assessments run smoothly and securely. Her behind-the-scenes contributions play a vital role in delivering a seamless and secure learning experience for aspiring ethical hackers.
