Kali Linux
Guidebook

1.1 Introduction

Password hashing is the standard method operating systems use to store credentials securely. Instead of storing passwords in plain text, systems convert them into irreversible hash values using algorithms like MD5, SHA-256, SHA-512, or bcrypt. When a user logs in, the entered password is hashed and compared against the stored hash. If the hashes match, access is granted.

If an attacker obtains these hashes — through a database breach, misconfigured permissions, or local privilege escalation — they do not need to reverse the hash mathematically. Instead, they can guess passwords, hash each guess with the same algorithm, and compare the results. This is where password cracking tools like John the Ripper become essential.

This chapter covers John the Ripper (JTR), one of the most widely used password-cracking tools in the security industry. You will learn how to install it, prepare hash files, run multiple attack types, and interpret the results — all within the context of authorized security testing on Kali Linux.

1.2 What Is John the Ripper?

John the Ripper is an open-source password cracker originally developed for Unix systems by Solar Designer in 1996. Its primary purpose is to detect weak passwords by testing hashed values against dictionaries, brute-force strategies, and rule-based transformations.

The version shipped with Kali Linux is the John the Ripper jumbo build, which extends the original with additional hash formats, performance optimizations, and extra attack modes not found in the core version. This community-maintained fork supports hundreds of hash types and is actively updated.

John operates entirely from the command line. It reads one or more files containing password hashes and attempts to recover the original plaintext passwords. Cracked passwords are stored in a pot file (~/.john/john.pot) so that previously recovered hashes are not re-tested in future sessions.

1.3 Why It Is Used

• Password auditing — Verifying that user accounts on a system do not have weak or easily guessable passwords.
• Penetration testing — Demonstrating the impact of a credential breach during an authorized engagement.
• Security assessments — Evaluating the strength of password policies enforced by an organization.
• Recovery of lost passwords — Regaining access to a system when the legitimate password has been forgotten (where permitted).
• Hash format research — Analyzing and testing the resilience of various hashing algorithms.

1.4 Features

• Multiple attack modes — Single crack mode, wordlist mode (with optional rules), incremental mode, and mask mode.
• Broad hash format support — Handles DES, MD5, SHA-256, SHA-512 (crypt), NTLM, Kerberos, ZIP, RAR, PDF, Office documents, and many more.
• Configurable rules engine — Applies transformations to wordlist entries (capitalization, substitutions, appending digits, leet speak, etc.).
• Session management — Interrupted sessions can be resumed from the point they were stopped.
• Multi-platform — Runs on Linux, Windows, macOS, and other Unix-like systems.
• Open source — Freely available under a permissive license; the jumbo build is actively maintained by the community.
• Automatic format detection — Identifies most hash formats without manual specification (though explicit specification is recommended).
• GPU acceleration — Supports OpenCL and CUDA for significantly faster cracking on compatible hardware.

1.5 Installation

On Kali Linux, John the Ripper can be installed directly from the APT repositories:

1.6 Prerequisites

Before using John the Ripper to crack system password hashes, ensure the following:

• Root access — Reading /etc/shadow requires elevated privileges.
• Understanding of hash types — Know which algorithm was used to hash the passwords (e.g., MD5 crypt, SHA-512 crypt, NTLM).
• Wordlist files — Dictionary-based attacks require a wordlist. Kali Linux includes several by default:

1.7 Basic Syntax

The general syntax for running John the Ripper is:

The password-file argument can be an unshadowed file, a file containing raw hashes, or any file in a format John recognizes. Options control the attack mode, hash format, wordlist path, and session behavior.

1.8 Most Important Commands

1.9 Command Explanation

Unshadowing Password Files

On Linux systems, /etc/passwd stores account information while /etc/shadow stores the actual password hashes. The unshadow utility merges these two files:

Single Crack Mode

Uses the GECOS field from /etc/passwd to generate fast password guesses:

Dictionary Attack with Rules

Reads each word from a wordlist, applies mangling rules, and tests against hashes:

Displaying Cracked Passwords

Resuming an Interrupted Session

1.10 Common Flags

1.11 Practical Examples

Example 1: Preparing the Hash File

Example 2: Single Crack Mode

Example 3: Dictionary Attack with Rockyou

Example 4: Viewing Results

1.12 Expected Output

During Cracking

After Running --show

1.13 Real-World Use Cases

• Internal penetration test — After gaining initial access to a Linux server, an auditor dumps /etc/shadow, runs John offline, and uses cracked credentials to pivot.
• Active Directory assessment — Hashes extracted from NTDS.DIT are cracked with John in NTLM format to evaluate password strength across the domain.
• Compliance audit — An organization uses John to verify that no accounts have weak passwords violating PCI-DSS or HIPAA policy.
• Application security review — Hashes from a compromised database are identified and cracked to evaluate breach impact.

1.14 Best Practices

1.15 Common Mistakes

1.16 Troubleshooting

Problem: "No password hashes loaded"

Cause: The hash file is empty, incorrectly formatted, or the format doesn't match.

Solution: Verify with cat unshadowed.txt and ensure format matches.

Problem: Cracking is extremely slow

Cause: Wrong hash format or using CPU instead of GPU.

Solution: Verify format and install GPU-enabled John build.

Problem: Session won't restore

Cause: Running from a different directory than where the session started.

Solution: Navigate to the original directory or use --restore=/absolute/path.

1.17 Related Tools

1.18 Security Notes

1.19 Summary

John the Ripper remains one of the most versatile password cracking tools available. Its strength lies in supporting hundreds of hash formats, multiple attack modes, and session resumption.

• Always use unshadow to combine /etc/passwd and /etc/shadow
• Specify the hash format explicitly with --format
• Run attacks in order: single crack → wordlist with rules → incremental
• Use --session=name to organize multiple sessions
• Always obtain proper authorization before cracking passwords

1.20 Quick Reference Cheat Sheet

2.1 Introduction

Network reconnaissance is the foundational phase of any penetration test or security assessment. Before you can exploit a vulnerability, you must first understand what exists on the target network — which hosts are alive, what ports are open, what services are running, and what operating systems are in use. This intelligence-gathering process directly determines the attack surface you'll be working with.

Nmap (Network Mapper) is the industry-standard tool for this phase. It has been the go-to network scanner for over two decades, used by security professionals, network administrators, and researchers worldwide. Whether you're scanning a single host or an entire enterprise subnet, Nmap provides the capabilities needed to map the network accurately.

This chapter covers Nmap in depth — from basic host discovery to advanced NSE scripting. You will learn to run efficient, stealthy scans and interpret the results to build a clear picture of the target environment.

2.2 What Is Nmap?

Nmap is a free, open-source network scanner created by Gordon Lyon (Fyodor) in 1997. It is designed to discover hosts and services on a computer network by sending specially crafted packets and analyzing the responses. Nmap supports multiple scanning techniques including TCP SYN scanning, TCP connect scanning, UDP scanning, and various ping sweeps.

Beyond simple port scanning, Nmap can detect service versions, operating systems, MAC addresses, and even run custom scripts through its Nmap Scripting Engine (NSE). It outputs results in multiple formats including interactive terminal output, XML, grepable output, and can even interface with databases for large-scale scanning.

Nmap ships pre-installed on Kali Linux and is available for Windows, macOS, and other Unix-like systems. Its combination of flexibility, accuracy, and extensibility has made it the most widely used network scanner in the world.

2.3 Why It Is Used

• Host discovery — Identifying which IP addresses are active on a network before targeting specific hosts.
• Port scanning — Determining which TCP and UDP ports are open on a target, revealing running services.
• Service version detection — Identifying the specific software and version running on each open port.
• Operating system detection — Fingerprinting the target's OS based on network stack behavior.
• Vulnerability scanning — Using NSE scripts to detect known vulnerabilities on open services.
• Network inventory — Maintaining an up-to-date map of network assets for security auditing.
• Firewall testing — Evaluating the effectiveness of firewall rules and intrusion detection systems.

2.4 Features

• Multiple scan types — SYN scan (-sS), Connect scan (-sT), UDP scan (-sU), ACK scan (-sA), FIN scan (-sF), and more.
• Service version detection (-sV) — Probes open ports to determine service name, version, and sometimes configuration details.
• OS fingerprinting (-O) — Sends a series of packets and compares responses against a database of known OS signatures.
• Nmap Scripting Engine (NSE) — Over 600 scripts for vulnerability detection, exploitation, and information gathering.
• Timing templates (-T0 through -T5) — Control scan speed from paranoid (very slow and stealthy) to insane (very fast but noisy).
• Multiple output formats — Normal (-oN), XML (-oX), Grepable (-oG), and JSON for integration with other tools.
• Host discovery methods — ARP ping, ICMP ping, TCP ping, and reverse-DNS for flexible host detection.
• Target specification — Supports IP ranges, CIDR notation, hostnames, and reading targets from files.
• Decoy scanning (-D) — Spoofs source addresses to obscure the real scanner's IP.
• Fragmentation (-f) — Splits packets into tiny fragments to evade simple IDS/IPS rules.

2.5 Installation

Nmap comes pre-installed on Kali Linux. If for some reason it is not available, install it with:

Verify the installation:

2.6 Prerequisites

• Network access — You need network connectivity to the target(s). Physical network access or VPN connection as per your engagement scope.
• Root/sudo privileges — SYN scans, OS detection, and some NSE scripts require raw packet generation, which needs root.
• Proper authorization — Scanning networks without authorization is illegal in most jurisdictions. Ensure you have a signed scope document.
• Understanding of TCP/IP — Knowledge of the TCP three-way handshake, common ports, and protocol behavior is essential for interpreting results.
• Target scope — Know exactly which IP ranges, hosts, and ports you are authorized to scan.

2.7 Basic Syntax

Target specification can be:

• A single host: 192.168.1.1
• A range: 192.168.1.1-100
• CIDR notation: 192.168.1.0/24
• A hostname: target.example.com
• From a file: -iL targets.txt
• Excluding hosts: 192.168.1.0/24 --exclude 192.168.1.50

2.8 Most Important Commands

2.9 Command Explanation

SYN Scan (Stealth Scan)

The SYN scan (-sS) is the default scan type when running as root. It sends a SYN packet and waits for a response. If it receives a SYN-ACK, the port is open. It then sends an RST to tear down the connection before it's fully established. This makes it faster and stealthier than a full connect scan.

Service Version Detection

Version detection (-sV) probes open ports to determine the service name, version number, and sometimes additional details like device type or OS. This information is critical for identifying known vulnerabilities.

Aggressive Scan

The -A flag enables OS detection (-O), version detection (-sV), script scanning (-sC), and traceroute (--traceroute) in a single command. It is the most comprehensive scan but also the noisiest.

Host Discovery (Ping Scan)

The -sn flag tells Nmap to only perform host discovery — determining which hosts are up — without scanning any ports. This is useful for mapping a network before detailed scanning.

Full Port Scan

By default, Nmap scans only the top 1000 most common ports. The -p- flag scans all 65535 TCP ports, ensuring no open services are missed.

2.10 Common Flags

2.11 Practical Examples

Example 1: Quick Network Sweep

Quickly identifies all live hosts on the /24 subnet without scanning any ports.

Example 2: Standard Port Scan

Scans the top 1000 TCP ports using SYN scan technique.

Example 3: Comprehensive Target Scan

Full port SYN scan with version detection, default scripts, aggressive timing, and results saved to file.

Example 4: UDP Scan

Scans the top 100 most common UDP ports. UDP scanning is slower than TCP, so limiting the port range is recommended.

Example 5: Vulnerability Scanning with NSE

Runs all vulnerability-detection NSE scripts against the target. Useful for finding known CVEs on open services.

Example 6: Stealthy Scan with Decoys

Uses 5 random decoy IPs and paranoid timing to make the scan harder to attribute to your IP.

2.12 Expected Output

Standard Port Scan Output

The output shows each port's state (open/closed/filtered), the service name, and the version string. The STATE column is critical: open means the port is accepting connections, filtered means a firewall is blocking it, and closed means no service is listening but the host responded.

Aggressive Scan Output

2.13 Real-World Use Cases

• External penetration test — Scanning a company's public IP ranges to identify exposed services before attempting exploitation.
• Internal network assessment — Mapping an internal network to discover forgotten servers, unauthorized devices, or misconfigured services.
• Web application reconnaissance — Identifying web servers, backend databases, and administrative interfaces on a target host.
• IoT device discovery — Scanning a network segment to find IoT devices and their exposed management interfaces.
• Firewall rule validation — Scanning from outside a firewall to verify that only intended ports are accessible.
• Incident response — Rapidly scanning a compromised network to identify attacker infrastructure or lateral movement paths.
• CTF competitions — Discovering hidden services and ports on CTF challenge machines.

2.14 Best Practices

2.15 Common Mistakes

2.16 Troubleshooting

Problem: "You requested a scan type which requires root privileges"

Cause: SYN scans, OS detection, and some scripts need raw socket access.

Solution: Run with sudo or use -sT for non-root connect scans.

Problem: All ports show as "filtered"

Cause: A firewall is dropping all packets, or host discovery is failing.

Solution: Try -Pn to skip host discovery, or use -sT which may bypass some firewall rules.

Problem: Scan is extremely slow

Cause: UDP scanning is inherently slow, or timing is too conservative.

Solution: Use -T4 for faster scanning. For UDP, limit ports with --top-ports.

Problem: OS detection shows "No exact OS matches"

Cause: The target has few open ports, giving Nmap insufficient data for fingerprinting.

Solution: Scan more ports with -p- and combine with -sV for better OS detection accuracy.

2.17 Related Tools

2.18 Security Notes

2.19 Summary

Nmap is the cornerstone tool of network reconnaissance. Mastering its scan types, timing options, and NSE scripting will make you significantly more effective in any security engagement.

• Start with host discovery (-sn) to map the network
• Use SYN scan (-sS) as your default scan type
• Always scan all ports (-p-) for thorough assessments
• Add version detection (-sV) and scripts (-sC) for detailed intelligence
• Save results with -oN, -oX, or -oA for reporting and analysis
• Adjust timing templates based on network conditions and stealth requirements

2.20 Quick Reference Cheat Sheet

3.1 Introduction

Before attacking a network, you must understand its topology — what devices are connected, how they communicate, and what interfaces are available. On a wired local network, ARP (Address Resolution Protocol) scanning reveals live hosts by mapping IP addresses to MAC addresses. On wireless networks, putting your adapter into monitor mode allows you to capture all radio frames in the air, not just those addressed to you.

This chapter covers two complementary skill sets: using ARP scanning tools like arp-scan and arping to discover wired network hosts, and using the aircrack-ng suite's airmon-ng to enable monitor mode on wireless adapters for packet capture and analysis.

Both techniques are foundational for any local network assessment. Whether you're on a corporate pentest or a CTF challenge, knowing how to enumerate local hosts and capture wireless traffic is essential.

3.2 What Are These Tools?

arp-scan

arp-scan is a tool that sends ARP request packets to a range of IP addresses and listens for ARP replies. Any device that responds is confirmed to be active on the local network. It operates at Layer 2, making it more reliable than ICMP ping for local host discovery since it bypasses firewalls that block ICMP.

arping

arping is a simpler tool that sends ARP or ICMP packets to a single host to verify its presence on the network. It is useful for quickly checking if a specific IP is alive and resolving its MAC address.

airmon-ng

airmon-ng is part of the Aircrack-ng suite. It manages wireless network interface modes, specifically enabling and disabling monitor mode. Monitor mode allows a wireless adapter to capture all frames on the channel it's tuned to, regardless of the destination MAC address — essentially turning your adapter into a passive sniffer.

3.3 Why They Are Used

• Local host discovery — Finding all devices on a LAN segment, including those that block ICMP.
• Network mapping — Building a picture of the local network topology with IP-to-MAC mappings.
• Rogue device detection — Identifying unauthorized devices connected to the network.
• Wireless reconnaissance — Capturing wireless frames for analysis, including beacon frames, handshakes, and data packets.
• Pre-engagement reconnaissance — Understanding the wireless environment (SSIDs, channels, encryption types) before targeting.
• ARP spoofing preparation — Identifying target MAC addresses needed for man-in-the-middle attacks.

3.4 Features

arp-scan Features

• Sends ARP requests and displays responses with IP, MAC, and hardware manufacturer
• Supports multiple network interfaces
• Can specify custom ARP data patterns
• Detects duplicate IP addresses (ARP conflict detection)
• Can load a custom MAC/Vendor mapping file

airmon-ng Features

• Enables monitor mode on supported wireless adapters
• Kills interfering processes that may disrupt capture
• Lists available wireless interfaces and their current mode
• Checks for wireless driver and chipset compatibility
• Manages virtual monitor interfaces

3.5 Installation

Install arp-scan and arping

Install Aircrack-ng Suite

3.6 Prerequisites

• Network interface — An active network interface connected to the target LAN (wired for ARP, wireless for airmon-ng).
• Root/sudo privileges — ARP packet injection and wireless mode changes require elevated privileges.
• Compatible wireless adapter — For monitor mode, you need an adapter with chipset that supports monitor mode and packet injection (e.g., Atheros, Ralink, Realtek RTL8812AU).
• Correct wireless drivers — Some adapters require specific drivers. Check airmon-ng compatibility lists.
• Same subnet — ARP scanning only works within your broadcast domain (same Layer 2 segment).

3.7 Basic Syntax

arp-scan

arping

airmon-ng

3.8 Most Important Commands

3.9 Command Explanation

Scanning the Local Subnet with arp-scan

The -l flag tells arp-scan to automatically determine the local subnet based on the interface's IP address and netmask, then scan all addresses in that range:

Pinging a Single Host with arping

Use arping to quickly verify if a specific host is reachable at Layer 2:

Checking Wireless Interfaces

Before enabling monitor mode, check which wireless interfaces are available and their current state:

Killing Interfering Processes

NetworkManager, wpa_supplicant, and other services can interfere with monitor mode. Kill them before proceeding:

Enabling Monitor Mode

This creates a new virtual interface (typically wlan0mon) in monitor mode. All capture tools should use this interface.

Disabling Monitor Mode

After disabling monitor mode, restart NetworkManager with sudo systemctl start NetworkManager to restore normal WiFi connectivity.

3.10 Common Flags

3.11 Practical Examples

Example 1: Quick Local Network Scan

This is the most common arp-scan command. It automatically detects your subnet and scans all addresses.

Example 2: Scan Specific Subnet on Specific Interface

Useful when you have multiple interfaces and need to scan from a specific one.

Example 3: Verify Gateway Connectivity

Example 4: Complete WiFi Monitor Mode Workflow

This complete workflow: kills interfering processes, enables monitor mode, then starts airodump-ng to capture wireless traffic.

Example 5: Restoring Normal WiFi

3.12 Expected Output

arp-scan Output

Each line shows the IP address, MAC address, and the hardware vendor identified from the MAC prefix (OUI lookup). This vendor information helps identify device types quickly.

airmon-ng start Output

3.13 Real-World Use Cases

• Internal pentest — Running arp-scan immediately after connecting to a client network to map all visible devices before targeting.
• Rogue device detection — Comparing ARP scan results against the organization's asset inventory to find unauthorized devices.
• WiFi assessment prep — Enabling monitor mode to capture the wireless environment, identify all access points and clients, and plan the attack.
• ARP spoofing setup — Identifying the target and gateway MAC addresses needed for tools like arpspoof or bettercap.
• Physical security assessment — Discovering IoT devices, IP cameras, printers, and other devices on the network that may be forgotten or unsecured.
• Incident response — Identifying new or unexpected MAC addresses on the network that may indicate an attacker's presence.

3.14 Best Practices

3.15 Common Mistakes

3.16 Troubleshooting

Problem: "arp-scan: Could not obtain interface address"

Cause: The specified interface doesn't have an IP address or doesn't exist.

Solution: Check interface name with ip a and ensure it has an IP assigned.

Problem: "airmon-ng: ERROR: No such device"

Cause: The wireless interface name is wrong or the adapter is not connected.

Solution: Run ip link or iwconfig to find the correct interface name.

Problem: Monitor mode enables but no packets are captured

Cause: Wrong channel, or the adapter doesn't properly support monitor mode.

Solution: Manually set the channel with iwconfig wlan0mon channel 6 and verify with iwlist wlan0mon channel.

Problem: "Device or resource busy" when starting monitor mode

Cause: Interfering processes still running.

Solution: Run sudo airmon-ng check kill again and manually kill any remaining processes.

3.17 Related Tools

3.18 Security Notes

3.19 Summary

ARP scanning and WiFi monitor mode are complementary skills for local network discovery. ARP scanning provides fast, reliable host discovery on wired networks, while monitor mode opens the door to wireless reconnaissance and attack.

• Use arp-scan -l for quick local network discovery
• Use arping for verifying individual hosts
• Always kill interfering processes before enabling monitor mode
• Use a dedicated USB adapter with known monitor mode support
• Restore NetworkManager after disabling monitor mode
• Combine ARP discovery results with Nmap for comprehensive enumeration

3.20 Quick Reference Cheat Sheet

4.1 Introduction

Wireless networks secured with WPA or WPA2-PSK (Pre-Shared Key) rely on a 4-way handshake process when a client device authenticates to an Access Point (AP). This handshake proves that both the AP and the client know the pre-shared key, without ever transmitting the key itself across the air.

However, if an attacker can capture this 4-way handshake, they can perform an offline dictionary attack against it. By repeatedly hashing passwords from a wordlist and comparing the results to the captured handshake, the attacker can recover the original Wi-Fi password.

This chapter focuses on using the Aircrack-ng suite to locate target networks, capture the WPA2 handshake using airodump-ng, actively force clients to reconnect using aireplay-ng, and finally crack the captured hash offline using aircrack-ng.

4.2 What Are These Tools?

The Aircrack-ng suite is a complete set of tools to assess Wi-Fi network security. For this workflow, we focus on three primary components:

• airodump-ng — A packet capture tool for 802.11 frames. It displays nearby Access Points, connected clients, and saves the raw captured data to disk (.cap files).
• aireplay-ng — A frame injection tool used to generate artificial traffic. In this workflow, it is used to send deauthentication (deauth) frames to force a client to disconnect and reconnect, triggering a new handshake.
• aircrack-ng — An 802.11 WEP and WPA-PSK keys cracking program that can recover keys once enough data packets or a valid handshake has been captured.

4.3 Why It Is Used

• Wireless security auditing — Evaluating the strength of an organization's wireless passwords.
• Physical penetration testing — Gaining initial access to an internal network from the parking lot or lobby.
• Compliance testing — Ensuring that wireless networks meet regulatory standards for encryption and password complexity.
• Red teaming — Simulating real-world attacks where wireless networks are often the weakest link in the perimeter.

4.4 Features

• Passive capturing — airodump-ng can capture handshakes passively by just listening to the airwaves, remaining completely undetectable.
• Active deauthentication — aireplay-ng can actively disrupt connections to speed up the capture process.
• Offline cracking — Once the handshake is captured, aircrack-ng runs offline, meaning there is no risk of locking out accounts or generating network alerts during the cracking phase.
• Broad compatibility — Works with almost any wireless adapter that supports monitor mode and packet injection.

4.5 Installation

The Aircrack-ng suite is pre-installed on Kali Linux. If you need to install or update it, you can do so via APT:

4.6 Prerequisites

• Monitor Mode adapter — Your wireless adapter must be in monitor mode (e.g., wlan0mon) as covered in Chapter 3.
• Packet Injection capability — Required for sending deauth frames with aireplay-ng. Test it with sudo aireplay-ng --test wlan0mon.
• A good wordlist — The success of the attack entirely depends on the wordlist. rockyou.txt is a standard starting point.
• Proximity to target — You need a strong enough signal to reliably capture the packets from both the AP and the client.

4.7 Basic Syntax

4.8 Most Important Commands

4.9 Command Explanation

Targeting a Network

Once you identify a target AP, you must lock airodump-ng to its specific channel and BSSID (MAC address), and tell it to write the captured packets to a file:

Deauthenticating a Client

To speed up the capture, you can force a connected client to disconnect. When they automatically reconnect, airodump-ng will capture the handshake. The -0 flag specifies the deauth attack, followed by the number of packets to send (e.g., 5):

Cracking the Handshake

After successfully capturing the handshake, you can stop airodump-ng and use aircrack-ng to brute-force the password using a wordlist:

4.10 Common Flags

4.11 Practical Examples

Step 1: Locate Target

Start airodump-ng to scan all channels:

Identify your target's BSSID and Channel. Press Ctrl+C to stop.

Step 2: Targeted Capture

Focus airodump-ng on the target AP to capture the handshake (assuming BSSID 00:11:22:33:44:55 on channel 6):

Leave this terminal open and running.

Step 3: Deauthenticate a Client

In a second terminal window, identify a connected client (STATION) from the airodump-ng output, and send deauth frames:

Step 4: Verify Handshake and Crack

Check the first terminal. In the top right corner, you should see [ WPA handshake: 00:11:22:33:44:55 ]. If you see this, you can stop airodump-ng and proceed to cracking:

4.12 Expected Output

airodump-ng Handshake Capture

aircrack-ng Success

4.13 Real-World Use Cases

• Red Team Engagements — Bypassing physical security by accessing the internal network from outside the building via a weak Wi-Fi password.
• Guest Network Auditing — Ensuring guest networks are properly isolated and that their PSK strength is adequate.
• Employee Awareness — Demonstrating the danger of using weak or easily guessable passwords for corporate Wi-Fi.

4.14 Best Practices

4.15 Common Mistakes

4.16 Troubleshooting

Problem: aircrack-ng says "1 handshake, with PMKID" but cracking fails immediately

Cause: The capture is incomplete and doesn't contain all 4 parts of the handshake.

Solution: Capture the handshake again. Ensure you are close enough to both the AP and the client to hear packets from both directions.

Problem: aireplay-ng fails with "No such BSSID available"

Cause: You are too far away from the AP, or the AP is on a different channel.

Solution: Verify you are locked to the correct channel in airodump-ng. Move physically closer.

4.17 Related Tools

4.18 Security Notes

4.19 Summary

Capturing WPA2 handshakes is a core skill for any physical or wireless penetration test. The combination of passive monitoring and active deauthentication allows attackers to efficiently gather the cryptographic material needed to brute-force a network key.

• Use airodump-ng to locate the target and lock onto its channel.
• Use aireplay-ng to send targeted deauthentication frames to a connected client.
• Verify the handshake was captured in airodump-ng before stopping.
• Use aircrack-ng with a strong wordlist to crack the captured handshake offline.

4.20 Quick Reference Cheat Sheet