0 0 0 0 0Cracking WPA and WPA 2 networks is still very difficult and solely dependent on using a brute force attack with a good dictonary. Depending on the word-list that you use will improve the success rate of cracking WPA2 WiFi networks. In this tutorial I will be showing you how to grab the 4-Way handshake from a WPA2 WiFi network and how to do an offline brute-force cracking attempt at find the password for the WiFi network. The Raspberry Pi 3 can check around 500 keys per second which is not really fast when you have a word-list with over 10 millions passwords to check.The Raspberry Pi 3 can check around 1.8 million passwords an hour which again it doesn’t gurantee that it will be able to find the correct password for a WPA2 WiFi network.

1. Raspberry Pi 4

The best use of the Raspberry Pi in hacking WiFi networks is that you can use it to collect a 4-Way handshake and then transfer the handshake for cracking to a more powerful computer. The reason the Raspberry Pi is good for a scenrio like this is because of its mobility. You can easilly attach a battery to your Pi and put it in a backback and walk around collecting handshakes to crack.Today’s tutorial will show you how to capture a 4-Way Handshake and then use our Raspberry Pi 3 to crack the password. We will be using the aircrack-ng suite to collect the handshake and then to crack the password. You will need a good word-list for cracking. There are many word-lists out there.

One of the biggest word-lists I have seen is the which has over 1.5 Billion passwords that have been put together from many data breaches like Linked In and MySpace. Let’s get started. ObjectiveTo capture a 4-Way Handshake from a WPA2 WiFi network and crack the password using a brute-force method MaterialYou will need the following:. (You can use a bigger SD Card to store more videos on your server).

A WiFi Adapter capable of going into Monitor Mode (You can find a list of my )InstructionsI will be running a freshly installed version of Raspbian Jessie on my Raspberry Pi. You can use Rasbian Jessie Lite on your Raspberry Pi since we will just needing the terminal and I will be using SSH to run all my commands.

Go ahead and connect to your Raspberry Pi and lets begin by installing the. Run the following command to install the dependencies for the aircrack-ng suite.

Sudo airodump - ng - oui - updateNow that we have aircrack-ng installed we can begin searching for targets. I will be hacking my own WiFi network today for demonstation purposes. Lets begin by putting our WiFi adapter into monitor mode. You will need a USB WiFi adapte to put into monitor mode for this to work. The onboard WiFi adapter that is on the Raspberry Pi 3 will not work. I use the in this tutorial.You can view all your WiFi adapters with the ‘ iwconfig‘ command.

Your USB adapter will most likely be ‘ wlan1‘. Let’s put our WiFi adapter into monitor mode with the following command, be sure to replace wlan1 with your interface. Sudo airmon - ng start wlan1This will put our WiFi adapter in monitor mode and it will create a new interface for us to use, in my case the new interface is wlan1mon. Now let’s see what WiFi connections are around us by running the following command:sudo airodump-ng wlan1monYou can see my network name is ‘dayz’ and you can see that my network is running on Channel ‘ 3‘ and the BSSID is ‘ DC:EF:09:C6:BD:BD‘. Be sure to write down the BSSID and the Channel since we will need this for the next step. The next step is when we will try to capture the handshake so that we can use it to crack the WiFi password.

The way we will capture the handshake is we will sit and monitor all the data that is being passed with the WiFi network and we will look for when a new device connects or reconnects with the network. We can run ‘ deauth‘ commands to speed things up by booting devices off the network and having them reestablish with the network to capture the handshake.Let’s start by monitoring all the data for the network we are trying to capture the handshake. We will be using airodump-ng to write all the data to a file. We will need the channel number and the BSSID. Edit the command below to fit your needs, the ‘ write‘ argument will be the filename we are using to save to, I like to use the SSID.

Replace the BSSID with your BSSID. The -c argument is the channel and -write argument is your filename to save to. Sudo aireplay - ng - deauth 10 - a XX: XX: XX: XX: XX wlan1monYou should see the deauth command being sent.

After the command finishes go back to your other window that is monitoring the data and look to see if you have captured a handshake. You should see a ‘ WPA Handshake‘ appear in the top right corner.

Look at the image below for the handshake being captured.Once you have captured you can hit CTRL+C to stop capturing data. You can also close the other SSH connection or terminal that you performed the deauth commands since we will not need it anymore.We are now ready to attempt to crack the WPA password. Remember all your success lies in the word-list that you use. The Raspberry Pi 3 is pretty slow so I would not suggest running a huge word-list on the Raspberry Pi but you can use a small word-list that has common passwords fairly quickly.All you will need is the filename that you used above, in my case it was called ‘dayz’.

You can use the ‘ls’ command to find the files that were written. The handshake will be stored in ‘ dayz-01.cap’. Run the following command to begin cracking the WPA WiFi network using the word-list you have. This can be run offline so you do not need to be next to the WiFi network to crack it. Sudo aircrack - ng dayz - 01.cap - w. / yourwordlist.

Raspberry Pi 4

TxtThat’s basically it once you run that command aircrack-ng will begin checking all the passwords in your word-list trying to see if any of them match the hash from the 4-Way Handshake. The Raspberry Pi can check around 250-500 keys per second which is fairly slow. As you can see in my example it will take over an hour to check against 1.25 Million passwords, which is a small word-list to being with.NOTE: You can use an online hash cracking service like which you can upload your captured handshake and they will attempt to crack the password. It will work A LOT faster then using your Raspberry Pi as well as faster then using your own computer.