Reconnaissance

Initial Network Scan

First, I needed to identify the target wireless network and gather basic information about it.

# Enable monitor mode on wireless interface
sudo airmon-ng start wlan0

This created the monitor mode interface wlan0

Exploitation

Step 1: Capturing the WPA Handshake

To crack WPA2-PSK encryption, I needed to capture the 4-way handshake that occurs when a client authenticates to the access point.

sudo airodump-ng -c 13 --bssid x.x.x.x -w capture-01 wlan0

Command Breakdown:

• -c 13 - Focus on channel 13
• --bssid x.x.x.x - Target specific access point
• -w capture-01 - Write captured packets to file with prefix “capture-01”
• wlan0 - Monitor mode interface

Step 2: Monitoring for Connected Clients

The airodump-ng output showed two connected clients:

BSSID              STATION            PWR    Rate    Lost   Frames  Notes
x.x.x.x            a.a.a.a            -17    1e-24      0      142  EAPOL

The EAPOL flag indicated that client a.a.a.a had a handshake captured.

Step 3: Handshake Captured!

After monitoring for approximately 1 minute, I successfully captured the WPA handshake:

WPA handshake: x.x.x.x

The capture was saved to capture-01.cap-02.cap.

Password Cracking