# Aircrack-ng Essentials

> Drive the Aircrack-ng suite by hand: scan with airodump-ng, capture WPA handshakes via deauth, and crack legacy WEP with IV injection.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/aircrack-ng-essentials
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

The Aircrack-ng suite is the core toolkit of the OSWP, and the exam bans the automated wrappers that hide it, so you must drive each tool yourself. PEN-210 covers the full workflow: airodump-ng to scan and capture, aireplay-ng to inject and deauthenticate, and aircrack-ng to crack. This module establishes that workflow against the two attacks that use the suite end to end: scanning the airspace, capturing a WPA handshake, and cracking legacy WEP.

## Scanning with airodump-ng

airodump-ng is your eyes in monitor mode: it lists APs with their BSSID, channel, encryption, and signal, and the clients associated to each. Channel hopping surveys all bands; locking to a channel and targeting a BSSID focuses the capture. Writing output files in multiple formats feeds the cracking and visualization tools, and the same capture reveals hidden SSIDs and idle clients.

## Capturing Handshakes

Cracking WPA/WPA2-PSK starts with capturing the four-way handshake. You run airodump-ng locked to the target AP's channel, then send a deauthentication frame (targeted or broadcast) to force a client to reconnect and replay the handshake. Verifying the handshake is present in the capture before you walk away is the step that saves a failed offline crack.

## WEP Cracking

WEP is broken by IV reuse. The attack captures traffic, uses fake authentication to associate, and injects ARP requests to generate IVs rapidly, then aircrack-ng recovers the key from enough collected IVs, often in minutes. airdecap-ng then decrypts the capture with the recovered key.

## Study material

- [Passive Wireless Scanning with airodump-ng](https://hackindex.io/platforms/wireless/reconnaissance/passive-scanning-with-airodump-ng.md) (read, core)
- [Capturing the WPA 4-Way Handshake](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture.md) (read, core)
- [WEP Cracking with Aircrack-ng](https://hackindex.io/platforms/wireless/exploitation/wep-cracking-with-aircrack-ng.md) (read, core)