How to crack wifi password with Kali Linux

In this post you are going to learn how to crack wifi password with kali linux. I'll provide entire step by step guide to entire process. Before start I want to tell you some disclaimer that this blog is only for educational purpose and only work on authorized wifi network. 

First up all you need to setup your system with kali linux. You can either set up your system with main O.S. or you can use VM Virtual box to setup up on windows. Below is the basic things requirements to start this practical process:

1) Kali Linux - Click here to download Latest O.S.

2) Wifi Receiver(Optional)- If you are using Virtual box/PC you need this. Get On Amazon 

3) Wifi Router(Target)

4) Internet Connection

This some basic requirement to crack the wifi network. Now lets start step by step process:

Step 1: Login your kali system with root privilege and open terminal

Step 2: Before start any process we should update our all packages using following command this will take some time for update all packages but it necessary step.

       

apt-get dist-upgrade


 

Step 3: Check out your network configuration have wlan0 mode using following command 

 

       

ifconfig


 

You will get following result 

 

Step 4: To start work on this we need to change wlan0 mode to monitor mode to achieve this use following commands

       

ifconfig wlan0 down

iwconfig wlan0 mode monitor

ifconfig wlan0 up

iwconfig 


 

After completing this command you will see following result that your wlan0 now changed from managed mode to the monitor mode.

Step 5: Now we need to check our nearest wifi networks and information related to particular network. For this following command will give all data about the nearest networks.

       

airodump-ng wlan0


 

This will give following result. 

We are going to target second network in list which is ESSID is TP-Link_F16A this is my personal home network. Note down the BSSID of your targeted network.

Warning: Use only your personal home network or on network with you have permissions.

Step 6:  Now we want to required to get handshake data from the targeted network for this purpose run below command:

 

       

airodump-ng --bssid 1C:3B:F3:9F:F1:6A --channel 10 --write demo-handshake wlan0


 

In the above code 1C:3B:F3:9F:F1:6A  is the BSSID and 10 is the channel of targeted network which is got from step 5's BSSID and CH column.

After running this command you will get following output:

Note: There should be at least 1 device connected to the targeted network. In my case there have 3 clients connected to my network. 

Step 7:   In above step we just got the information of connected clients but getting the handshake date 1 of the client need to disconnect and connect again the network. So, we can do this process from our side or can wait done by this from client side. So here we will deauth client and reconnect again to the network. For this open new terminal and type following command:

 

       

aireplay-ng --deauth 4 -a 1C:3B:F3:9F:F1:6A -c C0:B6:58:80:BA:7C wlan0


 

We user aireplay-ng for disconnect client from network. Here 4 is represent time to disconnect and connect client again in second. So, Targeted client will disconnect for 4 second from the network. C0:B6:58:80:BA:7C is the client id got from step 6. You can use any connected client for complete this process. Once you done this process now you will get handshake file and your first terminal shows following result with content of WPA handshake file.

 

Step 8: Now we need to create or wordlist and for this purpose we are going to use another powerful package that is crunch. The wordlist is collection or combinations of words and passwords basically the target network is used. You need to do some social engineering for this purpose. In my case password is collection of digits. We will discuss about social engineering in our next blog. So, I need to create collection of all possible digit combinations using crunch. Below is the command to create wordlist file with collection of digit passwords.

       

crunch 6 8 1234567890 -o wordlist


 

The above command create wordlist file with all combinations of 6-8 digits. Possible it will take two much time for create this list. You can also download previously created wordlist using following link and try with handshake. 

Step 9: Now we are ready to crack our password. We have a handshake of network and wordlist of combinations of passwords. For cracking process, We are going to use aircrack-ng tool. Before it check your created files location. Mostly with above command all file located at root directory. You can check this using ls command. You will get following output with this command

 

In above output, above handshake file name is demo-handshake-01.cap.  

Step 10: This is final step command to crack your password. Just put following command and boom! you will see password. 

       

aircrack-ng demo-handshake-01.cap -w wordlist


 

It will take time depend on your wordlist. After process completed its give following result with key found.

Now you can ready to access this network with this password. 

Security Tips:

1) Never use only digit or only character password to your network. This can crack easily.

2) Instead of using public combinations use your own combination and remember only your mind is the most secure place to store your password

3) More lengthy typical password is hard to crack with tool this will take lots of time to complete this process. Eg. Your password is 15 character with contain of digit, character and special symbol then it will hard to crack with this tool due to more combinations in wordlist. Possible this will take around 1-3 weeks to crack or may be 1-12 months to check all combinations for regular machine. There have also another speedy tools we will look this in another post.