In this video I'll show you how to use airodump-ng, a tool that’s included in the aircrack-ng package and
is used for IEEE 802.11 frames capturing. It’s a reconnaissance tool used also to capture
the wpa2 4-way handshake that’s needed to crack the wifi password. All commands should
be executed as root.
in Kali Linux
the tool is already available but on other distributions you can install it by executing apt install
aircrack-ng. Aircrack-ng is the package that contains airodump-ng so apt install aircrack-ng.
To see a summary of its options execute airodump-ng --help.
Every access point in the range sends out about 10 so called beacon frames per second.
These small frames contain a lot of information about the WiFi networks and their clients like the
network name or essid, the encryption used, the channel the AP operates on and many more.
So in fact airodump-ng performs passive reconnaissance. It listens for beacons and displace the information
continuously on the screen. Airodump-ng is used at the beginning of an attack to look out for potential
targets.
Prior to looking for WiFi networks and clients you must put your WiFi card into Monitor Mode. Monitor
Mode is a spatial mode that allows your WiFi adapter to listen to every wireless packet in the range.
Let's put the adapter into Monitor Mode.
I've explained all these commands in the last lecture so I'm going to just execute them fast airmon
-ng check
aimon-ng check kill
and arimon -ng start wlen0 the name of the interface.
If your interface has another name use that name, you can check the name by executing ifconfig. In
my case is wlen0.
It has created another interface and append “mon” to it; so wlen0 has become wlan0mon and to
confirm it is in Monitor Mode I've executed "iwconfig" and we see the mode; and we start airdump-ng
on wlan0mon wifi card: airdump-ng -i and the name of the interface
I'll change the theme to a darker one to see it better.
Okay all the visible access points are listed in the upper part of the screen and the clients are listed
in the lower part of the screen.
You cannot see the lower part of the screen because there are so many APs. Airdum-ng hopes from
channel to channel and shows all access points
it can receive beacons from. Keep in mind that a WiFi card can operate on a single channel at the
moment.
Airdump-ng has to jump from channel to channel to scan the entire frequency bend; the current channel
is shown in the top left corner. The AP section shows the following information BSSID is
MAC address of the access point; BWR is the signal strength or power; Beacons column displays the
number of beacon frames received ( the more beacons the better the signal quality); data column displays
the number of data frames received and CH is the channel on which the AIP operates and MB column displays
the speed of AP Mode.
Then comes ENC which is the encryption used and CIPHER,
the protocol where CCMP is used with wpa2 and means advanced encryption standard.
Or is the authentication type where for example PSK means Pre-shared key; and finally, the last
column is the ESSID which is the network name.
Sometimes this can be hidden.
Because of the channel hoping it won't capture all packets from your target network.
If we want to listen just on one channel we use -C and the channel number.
I'm stopping it by pressing control C and then start it again only on channel 1; so I am adding -
C and 1.
Now it's capturing packets only on channel 1.
And if you want to capture the frames only from one AP you add -- BSSID option and the
MAC address of the AP, like this--bssid and let's take this one
It's capturing packets only from this network and if you want to save the capture to a file you use -w
and the name of the file, let's say dump. In the bottom section you will see all clients connected
to that particular access point and network; in this case there is only one client.