Wifite

Wifite is a nice Python tool that wraps the aircrack-ng suite. It's got a nice colorful display, and lots and lots of options for doing things that you would almost always otherwise spend time scrambling to scrape together scripts to do yourself.

Most common modes:

Attacking APs

Attack all APs:

$ wifite --all

Shut up shut up shut up

Sometimes you just want the program to shut up, and stop all the fancy gui stuff, and just crack some wifis. In that case, use the quiet flag:

$ wifite --all --quiet

WPA WEP and WPS

If we want to attack WPA networks only, we can use the wpa flag:

$ wifite --all --wpa

Alternatively, if we want to attack WEP networks, we can use the wep flag:

$ wifite --all --wep

There are lots of WEP attacks:

WEP:
  --wep                 Only target WEP networks.
  --pps PPS             Set the number of packets per second to inject.
  --wept WEPT           Sec to wait for each attack, 0 implies endless.
  --chopchop            Use chopchop attack.
  --arpreplay           Use arpreplay attack.
  --fragment            Use fragmentation attack.
  --caffelatte          Use caffe-latte attack.
  --p0841               Use P0842 attack.
  --hirte               Use hirte attack.
  --nofakeauth          Stop attack if fake authentication fails.
  --wepca WEPCA         Start cracking when number of IVs surpass [n].
  --wepsave WEPSAVE     Save a copy of .cap files to this directory.

Link to more info on cafe latte attack: [1]

In contrast, there are no specific WPA attacks, and only one WPS attack (the Pixie attack):

WPS:
  --wps                 Only target WPS networks.
  --pixie               Only use the WPS PixieDust attack

MAC Address

To change the mac address on the device:

• Put the card into MANAGED mode, do not put it in monitor mode
• Add the --mac flag to wifite

To attack all WPA networks seen, and switch out the MAC address before starting, run the following:

$ ifconfig wlan0 down; iwconfig wlan0 mode managed; ifconfig wlan0 up
$ wifite --all --wpa --mac --quiet

Power Levels

We can also restrict ourselves to clients whose signal strength is greater than some value (meaning, the dB of the signal strength is LESS THAN THE NEGATIVE of the number we provide). For example, a strong signal would have a signal strength of -20 dB, and a weak signal would have a signal strength of -80 dB. We might want to ignore all networks with signal strengths weaker than -60 dB, so we would get anything with a signal strength of -20 dB, -30 dB, -40 dB, -50 dB, etc. Here's the command:

$ wifite --all --power 60

On the flip side, we can also set a custom TRANSMISSION level, by specifying the power level in mW (note that this can be illegal depending on your country/region):

$ wifite --all --tx 30

[2]