PHDora The Explorer
Forum Guru
Getting setup
You can't just run a command on Windows and then expect it to run. You need a proper Linux operating system, as most if not all pentesting scripts are written for Linux. A favorite of this forum would be Kali Linux, which comes with all the häçking tools you need pre installed on a Debian based OS. You do not have permission to view the full content of this post. Log in or register now. is a tutorial on how to boot kali linux from a USB. Beware, as booting it from a USB does not save your data. It is best to save your stuff on an additional USB. Once you have made the USB, plug it into your pc, then when booting click F8, or whatever your computer tells you to click to get to the BIOS. From there edit boot options to boot from USB. You will also need a wireless adapter capable of monitor/promiscuous mode (being able to 'see' packets) and packet injection (allowing you to inject packets such as deauth packets). I reccomend theYou do not have permission to view the full content of this post. Log in or register now. for fifteen dollars off of Amazon. It's cheap and will get you started. I also recommend taking a look at Pomtwin's post comparing wireless adapters.
Automated Network häçking
If you're only gonna crack your neighbors wifi once, then what's the point about learning all this stuff? Automated tools do attempt to crack networks for you, here are some you could use:
Wifite - Wifite is an automated network cracker that attempts attacks such as WPS pin bruteforcing and getting WPA(2) handshakes. You do not have permission to view the full content of this post. Log in or register now.. It has a very nice user interface and is easy to use.
Fluxion - Fluxion creates a fake network with the same name as your victim's, bumps them off their own, forces them onto yours and then attempts to phish their router password. It has very realistic phishing pages. It's made by an HF member, Deltaflux. Download it from the official site You do not have permission to view the full content of this post. Log in or register now..
Infernal Twin - I haven't personally tried this out but it is like Fluxion except it does additional things for you such as network mapping, saving data to a DB and more. Download it You do not have permission to view the full content of this post. Log in or register now..
WPS
Before we go any further we want to check if WPS is enabled, I also recommend reading the section below me (oh the irony) to find out things like how to get network BSSID's and monitor mode stuff so you can understand what we are doing here. WPS is (now not so common, but you will still find it) a router vulnerability that allows you to login to the router with a seven digit numeric code. We can exploit this with a few programs:
First to check if WPS is installed, we will do
wash -i (interface/wlan1mon)
If it is installed, we can use something like You do not have permission to view the full content of this post. Log in or register now. to exploit it. Remember to follow the install instructions listed on the github. Here is the command:
reaver -i wlan1mon -b (network BSSID) --mac-changer
We're telling Reaver to brute forcing the network using wlan1mon and to spoof our MAC address so victims can't identify where our packets are coming from. It will take a few hours but it will be worth it.
'The real deal' - cracking with commands
Automated stuff doesn't always work- and let's be honest; you don't know what you're doing. With commands you have full control over what you're doing and hopefully by the end of this you will know what you're typing. We'll be using the aircrack-ng suite which is pre installed on kali linux. You can get it from the official website, You do not have permission to view the full content of this post. Log in or register now.. One thing to know about linux is that it labels your wifi adapters like so:
Your internal wireless adapter will usually be wlan0, your usb one will be wlan1, another usb one will be wlan2 etc. To find your adapters type iwconfig in the command line.
aircrack-ng start <wlan1> this one. You submit your .cap file, where the handshake is stored over there. They will try to crack it. But what if you do have 3 GTX 1080's? (that an exaggeration) Well, for starters try to find out if the router is at default password. If it is, you're in luck. If it's a netgear router most netgear's are adjective_noun_3d. However, it all depends on the essid. There are two general ways to crack handshakes: with a wordlist and a mask. For cracking yourself, you should use You do not have permission to view the full content of this post. Log in or register now. for both windows and linux.
Wordlists
Wordlists are lists full of words. You try every single password in the list and see if it works. You want to find a wordlist related to the router assuming it's still at default password. If the router's name is NETGEARXX (x = numbers) try googling netgear list and you should find something. Note, to crack a handshake in hashcat you must first convert it to .hccapx format using a converter like You do not have permission to view the full content of this post. Log in or register now.. Command to run in hashcat, you must first cd into the HC directory:
hashcat64.exe -m 2500 filename.hccapx wordlist.txt
Masks
Masks are a very useful part of hashcat. Read more about them You do not have permission to view the full content of this post. Log in or register now..
You can't just run a command on Windows and then expect it to run. You need a proper Linux operating system, as most if not all pentesting scripts are written for Linux. A favorite of this forum would be Kali Linux, which comes with all the häçking tools you need pre installed on a Debian based OS. You do not have permission to view the full content of this post. Log in or register now. is a tutorial on how to boot kali linux from a USB. Beware, as booting it from a USB does not save your data. It is best to save your stuff on an additional USB. Once you have made the USB, plug it into your pc, then when booting click F8, or whatever your computer tells you to click to get to the BIOS. From there edit boot options to boot from USB. You will also need a wireless adapter capable of monitor/promiscuous mode (being able to 'see' packets) and packet injection (allowing you to inject packets such as deauth packets). I reccomend theYou do not have permission to view the full content of this post. Log in or register now. for fifteen dollars off of Amazon. It's cheap and will get you started. I also recommend taking a look at Pomtwin's post comparing wireless adapters.
Automated Network häçking
If you're only gonna crack your neighbors wifi once, then what's the point about learning all this stuff? Automated tools do attempt to crack networks for you, here are some you could use:
Wifite - Wifite is an automated network cracker that attempts attacks such as WPS pin bruteforcing and getting WPA(2) handshakes. You do not have permission to view the full content of this post. Log in or register now.. It has a very nice user interface and is easy to use.
Fluxion - Fluxion creates a fake network with the same name as your victim's, bumps them off their own, forces them onto yours and then attempts to phish their router password. It has very realistic phishing pages. It's made by an HF member, Deltaflux. Download it from the official site You do not have permission to view the full content of this post. Log in or register now..
Infernal Twin - I haven't personally tried this out but it is like Fluxion except it does additional things for you such as network mapping, saving data to a DB and more. Download it You do not have permission to view the full content of this post. Log in or register now..
WPS
Before we go any further we want to check if WPS is enabled, I also recommend reading the section below me (oh the irony) to find out things like how to get network BSSID's and monitor mode stuff so you can understand what we are doing here. WPS is (now not so common, but you will still find it) a router vulnerability that allows you to login to the router with a seven digit numeric code. We can exploit this with a few programs:
First to check if WPS is installed, we will do
wash -i (interface/wlan1mon)
If it is installed, we can use something like You do not have permission to view the full content of this post. Log in or register now. to exploit it. Remember to follow the install instructions listed on the github. Here is the command:
reaver -i wlan1mon -b (network BSSID) --mac-changer
We're telling Reaver to brute forcing the network using wlan1mon and to spoof our MAC address so victims can't identify where our packets are coming from. It will take a few hours but it will be worth it.
'The real deal' - cracking with commands
Automated stuff doesn't always work- and let's be honest; you don't know what you're doing. With commands you have full control over what you're doing and hopefully by the end of this you will know what you're typing. We'll be using the aircrack-ng suite which is pre installed on kali linux. You can get it from the official website, You do not have permission to view the full content of this post. Log in or register now.. One thing to know about linux is that it labels your wifi adapters like so:
Your internal wireless adapter will usually be wlan0, your usb one will be wlan1, another usb one will be wlan2 etc. To find your adapters type iwconfig in the command line.
aircrack-ng start <wlan1> this one. You submit your .cap file, where the handshake is stored over there. They will try to crack it. But what if you do have 3 GTX 1080's? (that an exaggeration) Well, for starters try to find out if the router is at default password. If it is, you're in luck. If it's a netgear router most netgear's are adjective_noun_3d. However, it all depends on the essid. There are two general ways to crack handshakes: with a wordlist and a mask. For cracking yourself, you should use You do not have permission to view the full content of this post. Log in or register now. for both windows and linux.
Wordlists
Wordlists are lists full of words. You try every single password in the list and see if it works. You want to find a wordlist related to the router assuming it's still at default password. If the router's name is NETGEARXX (x = numbers) try googling netgear list and you should find something. Note, to crack a handshake in hashcat you must first convert it to .hccapx format using a converter like You do not have permission to view the full content of this post. Log in or register now.. Command to run in hashcat, you must first cd into the HC directory:
hashcat64.exe -m 2500 filename.hccapx wordlist.txt
Masks
Masks are a very useful part of hashcat. Read more about them You do not have permission to view the full content of this post. Log in or register now..