Wireless Attacks

wifite

wifite is the “just do it” wrapper for wireless auditing. Instead of running airmon, airodump, aireplay, and aircrack by hand, you launch wifite, it puts your adapter into monitor mode, scans the area, and presents a ranked list of nearby networks. Pick your targets and it runs the appropriate attacks automatically — capturing WPA handshakes, trying WPS where it’s exposed, capturing PMKIDs — and hands you the results. It’s the fast path when you know the manual steps and just want them done.

Official-repo package; Security → Wireless Attacks → wifite. Needs root and a monitor-capable adapter.

The help it prints

   .               .    
 .´  ·  .     .  ·  `.  wifite2 2.8.1
 :  :  :  (¯)  :  :  :  a wireless auditor by derv82
 `.  ·  ` /¯\ ´  ·  .´  maintained by kimocoder
   `     /¯¯¯\     ´    https://github.com/kimocoder/wifite2

options:
  -h, --help                    show this help message and exit

SETTINGS:
  -v, --verbose                 Shows more options (-h -v). Prints commands and outputs. (default: quiet)
  -i [interface]                Wireless interface to use, e.g. wlan0mon (default: ask)
  -c [channel]                  Wireless channel to scan e.g. 1,3-6 (default: all 2Ghz channels)
  -inf, --infinite              Enable infinite attack mode. Modify scanning time with -p (default: off)
  -mac, --random-mac            Randomize wireless card MAC address (default: off)
  -p [scan_time]                Pillage: Attack all targets after scan_time (seconds)
  --kill                        Kill processes that conflict with Airmon/Airodump (default: off)
  -pow, --power [min_power]     Attacks any targets with at least min_power signal strength
  --skip-crack                  Skip cracking captured handshakes/pmkid (default: off)
  -first, --first [attack_max]  Attacks the first attack_max targets
  -ic, --ignore-cracked         Hides previously-cracked targets. (default: off)
  --clients-only                Only show targets that have associated clients (default: off)
  --nodeauths                   Passive mode: Never deauthenticates clients (default: deauth targets)
  --daemon                      Puts device back in managed mode after quitting (default: off)

WEP:
  --wep                         Show only WEP-encrypted networks
  --require-fakeauth            Fails attacks if fake-auth fails (default: off)
  --keep-ivs                    Retain .IVS files and reuse when cracking (default: off)

WPA:
  --wpa                         Show only WPA/WPA2-encrypted networks (may include WPS)
  --wpa3                        Show only WPA3-encrypted networks (SAE/OWE)
  --owe                         Show only OWE-encrypted networks (Enhanced Open)
  --new-hs                      Captures new handshakes, ignores existing handshakes in hs (default: off)
  --dict [file]                 File containing passwords for cracking (default: /usr/share/dict/wordlist-probable.txt)

WPS:
  --wps                         Show only WPS-enabled networks
  --wps-only                    Only use WPS PIN & Pixie-Dust attacks (default: off)
  --bully                       Use bully program for WPS PIN & Pixie-Dust attacks (default: reaver)
  --reaver                      Use reaver program for WPS PIN & Pixie-Dust attacks (default: reaver)
  --ignore-locks                Do not stop WPS PIN attack if AP becomes locked (default: stop)

PMKID:
  --pmkid                       Only use PMKID capture, avoids other WPS & WPA attacks (default: off)
  --no-pmkid                    Don't use PMKID capture (default: off)
  --pmkid-timeout [sec]         Time to wait for PMKID capture (default: 300 seconds)

COMMANDS:
  --cracked                     Print previously-cracked access points
  --ignored                     Print ignored access points
  --check [file]                Check a .cap file (or all hs/*.cap files) for WPA handshakes
  --crack                       Show commands to crack a captured handshake
  --update-db                   Update the local MAC address prefix database from IEEE registries

Examples

# Scan everything and choose interactively
sudo wifite

# Only target WPA networks, and crack with a specific wordlist
sudo wifite --wpa --dict /usr/share/wordlists/rockyou.txt

# Only networks above a signal strength, to skip the faint ones
sudo wifite --power 40

# Attack a specific network by ESSID
sudo wifite -e "TargetNetwork"