In some cases we can find some authentication data (the 4 way handshake) in the capture. Now let’s suppose we start with a pcap file containing encrypted wireless traffic:Īs we know, if we try to guess what’s inside, we cannot see anything as it is encapsulated and crypted:

You start a mon interface with: airmon-ng start and start capturing traffic with airodump-ng –channel channel –write file.pcap mon0 In this post I want to explore this case of study. In most of the cases, the aircrack suite is used to crack WEP/WPA passwords with accessing the network as a main goal however let’s explore another scenario: maybe you are monitoring a special network in a particular time-lapse, and your main goal isn’t getting permanent access to the network, let’s suppose that your goal is just obtaining relevant information about the traffic, so you don’t have time to crack the network and perform a man in the middle, or maybe you just want to stay under the radar, so you just move near to the wireless access point and start capturing all the traffic in 802.11g format, then you arrive at the office and have plenty of time to crack the keys and decrypt the traffic. In this small and simple tutorial we are going to review the process of using aircrack for cracking and decrypting a PCAP containing 802.11g traffic.

Hi again! LY0N HACKING SERIES DECEMBER 27, 2017 Pau Muñoz Bruteforce WPA and decrypt pcap’s with aircrack

Decrypt wpa2 pcap wireshark