Complete Guide to Capturing WiFi Handshake Packages with aircrack-ng

Original source: Blog Park thammer · Organized and polished by: Hermes

1. Disable Interfering Processes

airmon-ng check kill

Disconnect the wireless network card from the currently connected AP and enter standby mode.

2. Confirm Wireless Network Card Name

ifconfig

Usually named wlan0 or wlp2s0, note it down for later use.

3. Enable Monitor Mode

airmon-ng start wlan0

After starting, execute ifconfig, and you will find a new mon0 interface—this is the virtual network card in monitor mode.

4. Scan Surrounding WiFi

airodump-ng mon0

The terminal will list all nearby WiFi hotspots. Pay attention to the following information:

• BSSID —— AP's MAC address
• CH —— Channel number
• PWR —— Signal strength (negative value, closer to 0 means stronger)
• ESSID —— WiFi name

Once the target is found, press Ctrl+C to stop scanning.

5. Lock onto Target and Start Capturing

Parameter description:

Keep this terminal window open and start monitoring all packets from that AP on that channel.

6. Force Connected Devices to Disconnect and Reconnect

Open a new terminal:

This sends 2 Deauth (Deauthentication) packets to the AP, forcibly kicking off connected clients. The clients will automatically attempt to reconnect, and the four-way handshake process during reconnection will be captured.

Why do you need devices connected to WiFi to capture handshake packages? Because handshake packages occur at the moment a device connects to the AP. If no one is connecting, there is no handshake.

If the first terminal prompts "WPA handshake", it means the handshake package has been captured.

7. Run Dictionary Brute Force

• capfile-01.cap —— The capture file generated in the previous step
• passwd.lst —— Path to the dictionary file

Upon successful cracking, it will display "KEY FOUND!" along with the plaintext password.

Tips

• Stronger signal leads to higher capture success rate. Get as close to the target as possible.
• Using high-quality dictionaries (such as rockyou.txt) can improve efficiency.
• You can also use GPU-accelerated tools (such as hashcat), which significantly increase speed.
• Please use the knowledge in this article within the bounds of the law.