OSWP · Module 8
Aircrack-ng Essentials
Drive the Aircrack-ng suite by hand: scan with airodump-ng, capture WPA handshakes via deauth, and crack legacy WEP with IV injection.
~2 h 3 resources Last updated September 27, 2026
The Aircrack-ng suite is the core toolkit of the OSWP, and the exam bans the automated wrappers that hide it, so you must drive each tool yourself. PEN-210 covers the full workflow: airodump-ng to scan and capture, aireplay-ng to inject and deauthenticate, and aircrack-ng to crack. This module establishes that workflow against the two attacks that use the suite end to end: scanning the airspace, capturing a WPA handshake, and cracking legacy WEP.
Scanning with airodump-ng
airodump-ng is your eyes in monitor mode: it lists APs with their BSSID, channel, encryption, and signal, and the clients associated to each. Channel hopping surveys all bands; locking to a channel and targeting a BSSID focuses the capture. Writing output files in multiple formats feeds the cracking and visualization tools, and the same capture reveals hidden SSIDs and idle clients.
Capturing Handshakes
Cracking WPA/WPA2-PSK starts with capturing the four-way handshake. You run airodump-ng locked to the target AP's channel, then send a deauthentication frame (targeted or broadcast) to force a client to reconnect and replay the handshake. Verifying the handshake is present in the capture before you walk away is the step that saves a failed offline crack.
WEP Cracking
WEP is broken by IV reuse. The attack captures traffic, uses fake authentication to associate, and injects ARP requests to generate IVs rapidly, then aircrack-ng recovers the key from enough collected IVs, often in minutes. airdecap-ng then decrypts the capture with the recovered key.
Read
The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.