The previous post explained why a weak WPA2 password falls: an attacker records the handshake and guesses against it offline. This post is about the tools that do that work - what each one is, what it can observe, and, more usefully, what it cannot touch once you have done the basics right.
This is defensive, descriptive material. Every tool below is standard, public, and used daily by penetration testers auditing networks they were hired to audit. Naming them is not a how-to. The one network you are allowed to point any of this at is your own - running it against a network you do not own is illegal in most countries, and nothing here is a recipe for doing so. The value in knowing the toolset is seeing your own network the way an auditor does.
The one workflow they all share
Almost every Wi-Fi audit follows the same three steps, and the tools are just different implementations of them:
- Listen. Put a Wi-Fi adapter into monitor mode so it reports every frame in the air, not only the ones addressed to it. This is passive - it changes nothing.
- Capture a handshake. Record the 4-way handshake that happens when a device joins, because it contains a value derived from the password.
- Guess offline. Take the captured file to a fast machine and test password candidates against it, with no further contact with the network.
Keep that shape in mind and each tool below slots into one of the three steps.
The aircrack-ng suite
aircrack-ng is not one program but a suite, and it is the name everyone knows. The parts map cleanly onto the workflow:
- airmon-ng sets up monitor mode. The plumbing step.
- airodump-ng is the listener. Point it at the air and it lists the networks around you - their names, channels, encryption type, signal, and the clients connected to each - and writes captured frames to a file. It is a survey tool first: the same picture of the airwaves that a site survey needs. When a handshake crosses its capture, it saves it.
- aireplay-ng generates traffic, including the management frames that make a connected device reconnect. Under WPA2 those frames are unprotected, so this is how an auditor forces a fresh handshake without waiting for someone to reboot. This is exactly the class of trick WPA3 shuts down (see below).
- aircrack-ng itself is the cracker: it takes the captured handshake and a wordlist and reports whether the password is in that list.
That is the whole loop the earlier post described, in four named binaries. Nothing about it is exotic - it ships in every security-testing Linux distribution.
The modern variants
The aircrack-ng loop is the classic one; the tools that came after it are faster or narrower, not different in principle.
- hcxdumptool + hcxtools target the PMKID - a value some routers hand out on first contact, which means a handshake can sometimes be collected without any client connected at all. It shifted the "you must wait for a device to join" assumption, and it is why the attack post says to assume any WPA2 network is capturable.
- hashcat is the offline cracker of choice because it runs on the GPU. Where a CPU tries thousands of guesses a second, a GPU tries hundreds of billions. This is the raw engine behind "a weak password falls in minutes" - and the reason a long passphrase, not a clever short one, is the only real defence under WPA2.
- Wifite is a wrapper that automates the whole aircrack-ng loop into one command. It lowers the skill floor to near zero, which is precisely why assuming "no one near me would bother" is a bad bet.
The observation tools
Two tools in this world are not crackers at all - they only watch, and both are mainstream network-engineering software.
- Kismet is a passive detector. It sits silent, logs every network and device it hears, and never transmits. Network teams use it to find rogue access points - someone plugging an unauthorised router into the office. On your own network it answers "what is broadcasting around me, and is any of it mine that should not be?"
- Wireshark is the packet analyser everyone in networking already knows. On Wi-Fi it decodes the frames a capture recorded. On an encrypted network it sees only the outsides of the frames - which is the point: it is a good way to prove to yourself that your traffic is unreadable to a listener, because you become that listener and see nothing useful.
What none of them get past
Here is the part worth internalising, because it is the whole return on this series: against a network set up correctly, this entire toolkit runs and finds nothing.
- A long passphrase defeats the crackers. aircrack-ng and hashcat only ever test guesses. Four or five unrelated words are in no wordlist and too long to brute-force in any human timeframe. The capture succeeds; the crack does not.
- WPA3 defeats the offline model itself. Its SAE handshake needs a live exchange with the router for every guess, so a captured file is no longer something to grind on privately. hashcat's GPU advantage evaporates when each guess needs a round-trip to your router.
- WPA3's protected management frames defeat the forced reconnect. aireplay-ng's deauth trick relies on unprotected management frames; WPA3 signs them, so the "make a device reconnect on demand" step stops working.
- WPS off closes the side door. None of the above matters if an 8-digit PIN lets someone skip the password entirely. Turn it off.
So the tools are real and the threat is real, but the defence is boring and complete: WPA3 (or WPA2 with a long passphrase), WPS off. Do that and the toolkit has nothing to bite on.
Auditing your own network, legitimately
If you want to actually run the check rather than take the guidance on faith, the honest way is narrow and legal: test the one network you own. At a high level, and without a command playbook - capture a handshake from your own network by reconnecting one of your own devices, then run a wordlist of the most common and leaked passwords against it, exactly the list an attacker starts with. Read the result as a plain yes/no: if your password shows up, it would fall in minutes and must change today; if a serious run does not crack it, you have evidence your passphrase is doing its job. Professional certifications teach this same exercise on this same basis.
The goal is not to become an attacker. It is to find a weak passphrase before someone else does, on the only network where finding it is your business.
Where a phone analyzer fits
None of the tools above run on a stock phone - Android does not grant apps the radio access that monitor mode needs, which is a security decision, not an oversight. So a phone analyzer is not in the capture-and-crack business at all. What it does is the defensive half you use far more often: NetTools: Network Analyzer reads the security type a network actually negotiated - WPA2 or WPA3 - so you can confirm the setting that makes this whole toolkit fail, and it lists every device on your LAN so an unfamiliar one is something you notice. It is the fast daily check that your defence is still in place; the heavy tools above are the once-in-a-while audit.
Knowing what the tools do is what lets you stop worrying about them. The series ends with the ten-minute list that makes them irrelevant: securing your home Wi-Fi.
Cover photo by Jake Walker on Unsplash.
