WiFi Pentesting Tools

Installation and basic usage guide for tools used in the WiFi Pentesting guides.

All commands are written for Kali Linux or Debian-based systems.

Update Kali Linux#

Always update before installing tools:

sudo apt update
sudo apt full-upgrade -y

Check WiFi Adapter#

Check your adapter is detected:

ip link
iw dev
iw list

To confirm Monitor Mode support, look for * monitor under Supported interface modes in the output of iw list.

Enable Monitor Mode#

sudo airmon-ng check kill
sudo airmon-ng start wlan0

This creates a monitor interface, usually named wlan0mon.

Disable Monitor Mode#

sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager

Aircrack-ng Suite#

What is it?#

The core suite for WiFi auditing. Includes airmon-ng, airodump-ng, aireplay-ng, and aircrack-ng.

Installation#

sudo apt install aircrack-ng -y

Check Installation#

aircrack-ng --version

Basic Usage#

## Crack a captured WPA handshake
aircrack-ng -w wordlist.txt capture.cap

Used For#

WEP cracking, WPA/WPA2 handshake cracking, packet injection, monitor mode management.

airmon-ng#

What is it?#

Manages wireless interface modes. Part of the aircrack-ng suite.

Installation#

Included with aircrack-ng.

Check Installation#

airmon-ng

Basic Usage#

sudo airmon-ng start wlan0
sudo airmon-ng stop wlan0mon

Used For#

Enabling and disabling Monitor Mode on wireless adapters.

airodump-ng#

What is it?#

Captures 802.11 frames. Part of the aircrack-ng suite.

Installation#

Included with aircrack-ng.

Check Installation#

airodump-ng --help

Basic Usage#

## Scan all channels
sudo airodump-ng wlan0mon
 
## Target a specific BSSID and channel
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Used For#

Scanning for nearby access points, capturing WPA/WPA2 handshakes.

aireplay-ng#

What is it?#

Injects packets into a wireless network. Part of the aircrack-ng suite.

Installation#

Included with aircrack-ng.

Check Installation#

aireplay-ng --help

Basic Usage#

## Deauthentication attack
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

Used For#

Deauthentication attacks, fake authentication, packet replay for WEP cracking.

Reaver#

What is it?#

Brute-forces WPS PINs to recover WPA/WPA2 passphrases.

Installation#

sudo apt install reaver -y

Check Installation#

reaver --version

Basic Usage#

sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

Used For#

WPS PIN brute-force attacks, Pixie Dust attacks (with -K 1 flag).

Wash#

What is it?#

Scans for WPS-enabled access points. Part of the Reaver package.

Installation#

Included with reaver.

Check Installation#

wash --help

Basic Usage#

sudo wash -i wlan0mon

Used For#

Finding targets with WPS enabled before running Reaver.

Hashcat#

What is it?#

A fast GPU-accelerated password cracker. Supports WPA/WPA2 hash formats including PMKID.

Installation#

sudo apt install hashcat -y

Check Installation#

hashcat --version

Basic Usage#

## Crack WPA2 PMKID or handshake (converted to hc22000 format)
hashcat -m 22000 capture.hc22000 wordlist.txt

Used For#

Cracking WPA/WPA2 handshakes and PMKID hashes using wordlists or rules.

hcxdumptool#

What is it?#

Captures WPA/WPA2 traffic including PMKID without needing a connected client.

Installation#

sudo apt install hcxdumptool -y

Check Installation#

hcxdumptool --version

Basic Usage#

sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

Used For#

Capturing PMKID hashes for clientless WPA2 attacks.

hcxtools#

What is it?#

Converts captured WiFi traffic into formats usable by Hashcat.

Installation#

sudo apt install hcxtools -y

Check Installation#

hcxpcapngtool --version

Basic Usage#

hcxpcapngtool -o capture.hc22000 capture.pcapng

Used For#

Converting pcapng captures from hcxdumptool into Hashcat-compatible format.

Wireshark#

What is it?#

Graphical network protocol analyzer. Useful for inspecting captured WiFi frames.

Installation#

sudo apt install wireshark -y

Check Installation#

wireshark --version

Basic Usage#

wireshark capture.pcap

Used For#

Inspecting and analyzing packet captures, understanding WiFi frame structure.

hostapd#

What is it?#

Software access point daemon. Used for creating rogue access points.

Installation#

sudo apt install hostapd -y

Check Installation#

hostapd -v

Basic Usage#

Create a config file hostapd.conf and run:

sudo hostapd hostapd.conf

Used For#

Setting up Evil Twin access points and rogue WPA/WPA2 networks.

hostapd-wpe#

What is it?#

A patched version of hostapd for capturing WPA2-Enterprise credentials via a rogue RADIUS server.

Installation#

sudo apt install hostapd-wpe -y

Check Installation#

hostapd-wpe --help

Basic Usage#

sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

Used For#

WPA2-Enterprise attacks · capturing MSCHAP credentials from clients connecting to a rogue AP.

EAPHammer#

What is it?#

A toolkit for attacking WPA2-Enterprise networks. Automates rogue AP setup and credential harvesting.

Installation#

git clone https://github.com/s0lst1c3/eaphammer
cd eaphammer
sudo ./kali-setup

Check Installation#

python3 eaphammer --help

Basic Usage#

sudo python3 eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid CorpWifi --creds

Used For#

WPA2-Enterprise attacks, PEAP/MSCHAPv2 credential capture, evil twin for enterprise networks.

KRACK Test Scripts#

Advanced / Research Tool

What is it?#

Proof-of-concept scripts for testing Key Reinstallation Attack (KRACK) vulnerabilities in WPA2 implementations.

Installation#

git clone https://github.com/vanhoefm/krackattacks-scripts
cd krackattacks-scripts
pip install -r requirements.txt

Check Installation#

Read the README inside the cloned repository for setup and dependency instructions.

Basic Usage#

Follow the instructions in the repository's README. Requires a specific lab setup.

Used For#

Testing whether WPA2 clients and APs are vulnerable to key reinstallation attacks.

SSID Confusion PoC#

Advanced / Research Tool

What is it?#

Proof-of-concept demonstrating how SSIDs can be used to confuse clients into connecting to wrong networks.

Installation#

git clone https://github.com/vanhoefm/ssid-confusion-poc
cd ssid-confusion-poc

Follow setup instructions in the repository README.

Check Installation#

See the repository documentation.

Basic Usage#

Follow the steps in the repository README for lab testing.

Used For#

Demonstrating SSID confusion attacks, useful for understanding downgrade and mismatch vulnerabilities.

AirSnitch#

Advanced / Research Tool

What is it?#

A tool for monitoring and logging probe requests sent by nearby WiFi devices.

Installation#

git clone https://github.com/tomac/airsnitch
cd airsnitch

Follow setup steps in the repository README.

Check Installation#

See the repository documentation.

Basic Usage#

sudo python airsnitch.py wlan0mon

Used For#

Passive monitoring of probe requests to identify nearby devices and their preferred SSIDs.

FragAttacks#

Advanced / Research Tool

What is it?#

Test tools for the FragAttacks vulnerabilities · a set of vulnerabilities in the 802.11 WiFi standard affecting frame aggregation and fragmentation.

Installation#

git clone https://github.com/vanhoefm/fragattacks
cd fragattacks

Follow the detailed setup instructions in the repository README, which covers dependencies and configuration.

Check Installation#

See the repository documentation.

Basic Usage#

Follow the repository's test instructions. Requires specific hardware and kernel module setup.

Used For#

Testing devices for FragAttacks vulnerabilities in frame aggregation and fragmentation handling.

Dragonslayer#

Advanced / Research Tool

What is it?#

A tool for performing downgrade attacks against WPA3-SAE, part of the Dragonblood research.

Installation#

git clone https://github.com/vanhoefm/dragonslayer
cd dragonslayer

Follow the setup instructions in the repository README.

Check Installation#

See the repository documentation.

Basic Usage#

Follow the instructions in the repository README for lab-based WPA3 testing.

Used For#

Testing WPA3 downgrade vulnerabilities (Dragonblood attacks).

Fragile Frames Research Tools#

Advanced / Research Tool

What is it?#

Research tools related to frame handling vulnerabilities in 802.11 implementations.

Installation#

Follow the official research publication and associated repository for setup instructions, as this varies by implementation.

Basic Usage#

Refer to the research paper and repository documentation.

Used For#

Academic and lab testing of 802.11 frame handling edge cases.

SAECRED#

Advanced / Research Tool

What is it?#

A research tool for testing vulnerabilities in the WPA3 SAE (Simultaneous Authentication of Equals) handshake.

Installation#

Refer to the official research publication and associated repository for installation steps.

Basic Usage#

Follow the repository documentation. Lab environment required.

Used For#

Testing SAE credential handling and related WPA3 vulnerabilities.

Dragondoom Research Artifact#

Advanced / Research Tool

What is it?#

A research artifact demonstrating timing side-channel vulnerabilities in WPA3-SAE implementations.

Installation#

Refer to the official research paper and artifact repository for build and setup instructions.

Basic Usage#

Follow the repository documentation. Requires a controlled lab setup.

Used For#

Demonstrating and testing Dragondoom timing side-channel attacks against WPA3-SAE.

Notes#

• Always work in an isolated lab.
• Monitor Mode support depends on your WiFi adapter chipset. Recommended chipsets: Atheros, Ralink, Realtek (RTL8812AU).
• Research tools marked Advanced / Research Tool may require specific kernel versions, drivers, or hardware.
• Keep all tools updated regularly.