AIRCRACK-NG(1)

Okay bestie, welcome to AIRCRACK-NG(1) from the General Commands Manual 🎀✨ This is the manual for the cracking tool, so get comfy, grab your snacks, and let's go 🍓

🌸 NAME 🌸

aircrack-ng is an 802.11 WEP / WPA-PSK key cracker, and honestly it's iconic 💅

🧚 SYNOPSIS 🧚

aircrack-ng [options] <input file(s)>

Options go first, then your input file(s). Simple, cute, done 🫶

🦋 DESCRIPTION 🦋

Okay so aircrack-ng is an 802.11 WEP, 802.11i WPA/WPA2, and 802.11w WPA2 key cracking program. It's giving main character energy 👑

It can recover the WEP key once enough encrypted packets have been captured with airodump-ng. This part of the aircrack-ng suite figures out the WEP key using two fundamental methods 🔥 The first is the PTW approach (Pyshkin, Tews, Weinmann), and the big win there is that very few data packets are required to crack the WEP key 🦋 The second is the FMS/KoreK method, which uses various statistical attacks to discover the WEP key and mixes them with brute forcing 💀

Additionally, the program has a dictionary method for finding the WEP key. For cracking WPA/WPA2 pre-shared keys, you'll need a wordlist (file or stdin) or an airolib-ng database 🌈

🌷 INPUT FILES 🌷

Bestie, you can feed it capture files (.cap, .pcap), IVS (.ivs) or Hashcat HCCAPX files (.hccapx) 💖

🎀 OPTIONS 🎀

Here's every option, sorted into playlists so it's easier to scroll 🎶

💜 Common options 💜

• -a <amode> — Force the attack mode: 1 or wep for WEP (802.11), and 2 or wpa for WPA/WPA2 PSK (802.11i and 802.11w) ✨
• -e <essid> — Pick the target network by its ESSID. This is also required for WPA cracking if the SSID is cloaked. For SSIDs with special characters, check https://www.aircrack-ng.org/doku.php?id=faq#how_to_use_spaces_double_quote_and_single_quote_etc_in_ap_names
• -b <bssid> or --bssid <bssid> — Pick the target network by its access point MAC address 🎯
• -p <nbcpu> — Set how many CPUs to use for cracking the key/passphrase. This only works on SMP systems. By default, it uses all available CPUs 💪
• -q — If set, no status information gets displayed. Shh 🤫
• -C <macs> or --combine <macs> — Merges all those APs' MACs (separated by a comma) into one virtual one 🌸
• -l <file> — Write the key into a file. Heads up: it overwrites the file if it already exists 💀

🌸 Static WEP cracking options 🌸

• -c — Search alphanumeric characters only 🔤
• -t — Search binary coded decimal characters only 🔢
• -h — Search the numeric key for Fritz!BOX 📡
• -d <mask> or --debug <mask> — Specify the mask of the key. For example: A1:XX:CF
• -m <maddr> — Only keep the IVs coming from packets that match this MAC address. Or go wild and use -m ff:ff:ff:ff:ff:ff to use all and every IV, regardless of the network. Just know this disables ESSID and BSSID filtering 🙈
• -n <nbits> — Specify the key length: 64 for 40-bit WEP, 128 for 104-bit WEP, etc., all the way up to 512 bits. The default is 128 📏
• -i <index> — Only keep the IVs with this key index (1 to 4). By default it ignores the key index in the packet and uses the IV regardless 🗂️
• -f <fudge> — By default this is set to 2. Use a higher value to crank up the bruteforce level. Cracking takes longer, but the odds of success go up 📈
• -k <korek> — There are 17 KoreK attacks. Sometimes one attack makes a huge false positive that blocks the key from showing up, even with lots of IVs 😭 Try -k 1, -k 2, ... -k 17 to disable each attack selectively
• -x or -x0 — Disable last keybytes bruteforce. (Not advised, bestie 🙅‍♀️)
• -x1 — Enable last keybyte bruteforcing (default) ✅
• -x2 — Enable last two keybytes bruteforcing 💫
• -X — Disable bruteforce multithreading. This is SMP only 🧵
• -s — Shows the ASCII version of the key on the right side of the screen 👀
• -y — This is an experimental single brute-force attack. Only use it when the standard attack mode fails with more than one million IVs 🧪
• -z — Uses the PTW attack (Andrei Pyshkin, Erik Tews and Ralf-Philipp Weinmann). This is the default attack 👑
• -P <num> or --ptw-debug <num> — PTW debug: 1 disables klein, 2 is PTW 🐛
• -K — Use KoreK attacks instead of PTW 🔧
• -D or --wep-decloak — WEP decloak mode 🕵️‍♀️
• -1 or --oneshot — Run only one try to crack the key with PTW 🎯
• -M <num> — Specify the maximum number of IVs to use 🔢
• -V or --visual-inspection — Run in visual inspection mode. This can only be used when using KoreK 👁️

🧁 WEP and WPA-PSK cracking options 🧁

• -w <words> — Path to a dictionary file for WPA cracking. Separate filenames with a comma if you're using multiple dictionaries. Specify "-" to use stdin. Here's a list of wordlists: https://www.aircrack-ng.org/doku.php?id=faq#where_can_i_find_good_wordlists To use a dictionary with hexadecimal values, prefix it with "h:". Each byte in each key must be separated by ':'. When using it with WEP, set the key length with -n 📖
• -N <file> or --new-session <file> — Create a new cracking session. This lets you pause a cracking session and pick it back up later (using -R or --restore-session). Status files get saved every 10 minutes. It won't overwrite an existing session file 💾
• -R <file> or --restore-session <file> — Restore and continue a previously saved cracking session. This one is a solo act: don't pass any other parameter when starting aircrack-ng, because all the required info is already in the session file 🎤

💖 WPA-PSK options 💖

• -E <file> — Create an Elcomsoft Wireless Security Auditor (EWSA) Project file v3.02 📁
• -j <file> — Create a Hashcat v3.6+ Capture file (HCCAPX) 🧩
• -J <file> — Create a Hashcat Capture file (HCCAP) 🧩
• -S — WPA cracking speed test ⏱️
• -Z <sec> — How long the WPA cracking speed test runs, in seconds ⏲️
• -r <database> — Path to the airolib-ng database. Can't be used with -w 🚫

🌈 SIMD selection 🌈

• --simd=<option> — Aircrack-ng automatically loads the fastest optimization based on the instructions your CPU supports. This option lets you force a different one. The choices depend on your CPU, and these are all the possibilities that may be compiled regardless of CPU type: generic, sse2, avx, avx2, avx512, neon, asimd, altivec, power8 🌟
• --simd-list — Shows a list of the available SIMD architectures, separated by a space character. Aircrack-ng picks the fastest optimization on its own, so you rarely need this. It's handy for testing, or when a "lower" optimization like "generic" runs faster than the auto-picked one. Before forcing a SIMD architecture, check that your CPU supports the instruction using -u 🔍

✨ Other options ✨

• -H or --help — Show the help screen 🆘
• -u or --cpu-detect — Shows info on the number of CPUs and SIMD support 🖥️

🫶 AUTHOR 🫶

This manual page was written by Adam Cecile <gandalf@le-vert.net> for the Debian system (but anyone can use it). Permission is granted to copy, distribute and/or modify this document under the terms of the GNU General Public License, Version 2 or any later version published by the Free Software Foundation. On Debian systems, the complete text of the GNU General Public License can be found in /usr/share/common-licenses/GPL 📜

🔗 SEE ALSO 🔗

Bestie, here are your next reads 📚

• airbase-ng(8)
• aireplay-ng(8)
• airmon-ng(8)
• airodump-ng(8)
• airodump-ng-oui-update(8)
• airserv-ng(8)
• airtun-ng(8)
• besside-ng(8)
• easside-ng(8)
• tkiptun-ng(8)
• wesside-ng(8)
• airdecap-ng(1)
• airdecloak-ng(1)
• airolib-ng(1)
• besside-ng-crawler(1)
• buddy-ng(1)
• ivstools(1)
• kstats(1)
• makeivs-ng(1)
• packetforge-ng(1)
• wpaclean(1)
• airventriloquist(8)

---

That's the whole manual, bestie 🌈 aircrack-ng version 1.7.0, last updated May 2022. Stay iconic 💖