New face. Good. Sit down, don't touch anything yet.

I run wireless engagements. Drive-by audits, retail Wi-Fi pentests, the occasional "we forgot what password the warehouse AP uses" recovery job. All authorised. All paid. All boring until something breaks.

Today you're going to crack two networks. One WEP, one WPA2-PSK. WEP is dead, has been since 2007, but you still find it on legacy industrial gear, old printers, that one IP camera nobody updated since 2015. WPA2 is what you'll actually encounter in the field.

The kit on this terminal is a simulated Pineapple. Same commands as the real aircrack-ng suite, same workflow, no actual radio frequencies harmed. Don't run this on networks you don't own, that's how people end up in court.

Let's see what's in range.

Managed mode is for clients. We're not a client. We're an observer.

To capture wireless frames without being associated to an AP, the card has to be put into monitor mode, listening to everything in range on a given channel, including traffic not addressed to us. This is the foundation of every Wi-Fi attack.

The tool is airmon-ng. It also kills processes that fight monitor mode (network managers, wpa_supplicant); let it.

Now we listen. airodump-ng shows every access point your card can hear, along with the clients connected to them. ESSIDs, BSSIDs, channels, encryption type, signal strength.

You'll see noise. Real airspace is crowded, every café, every neighbour's router, every IoT light bulb. Your job is to find the targets you've been authorised to test.

For this engagement, you're looking for two networks:
→ POWERZIO_OLD: old wireless, the WEP one
→ Powerzio_Internal: operations Wi-Fi, WPA2

Note their BSSIDs and channels. You'll need both.

We start with WEP. It's the easier kill.

WEP uses a fixed key with a 24-bit Initialization Vector (IV) prepended to each packet. The IV is reused often enough that with about 10,000–40,000 captured IVs, you can mathematically recover the key. No password guessing. Pure cryptographic weakness.

Step one: stop scanning everywhere. Lock onto the WEP target's BSSID and channel, and write everything to a file. The more IVs we capture, the faster the crack.

You should now have a wep_capture.ivs file in your working directory. That's the raw capture, with all those juicy IVs.

Time to run the actual crack. aircrack-ng takes the capture file and brute-forces the WEP key statistically; not by guessing, but by exploiting the IV reuse. On a modern machine, with enough data, this takes seconds.

WPA2 is a different animal.

There's no IV weakness to exploit. The key is hashed with the SSID as salt, then used to derive session keys via a 4-way handshake when a client connects. Our only opening is to capture that handshake and brute-force the passphrase offline.

That means: we need a client to connect (or reconnect) to the AP while we're listening.

If nobody connects during your capture window, you've got nothing. Patience or pressure: that's the choice.

Waiting for someone to voluntarily reconnect could take hours. We've got a faster option: kick them off.

aireplay-ng --deauth sends spoofed deauthentication frames to a connected client, telling them their session has been terminated. The client doesn't know it's spoofed. Their device immediately tries to reconnect and that reconnection includes the 4-way handshake.

You'll need a second terminal session for this. Keep airodump-ng running in the first one and watch for the handshake notification while you deauth from the second.

Handshake captured. Now the slow part.

Unlike WEP, WPA2 doesn't yield to math; it yields to wordlists. sudo aircrack-ng reads candidate passwords from a file, hashes each one with the SSID as salt, and checks whether the result matches what's in the captured handshake. If a candidate matches, you have the password.

If it's not in the wordlist, you fail. Real engagements: pick wordlists carefully, generate custom ones from OSINT (company name, hometown, founding year, common patterns), and budget hours-to-days for the crack.

For this lab, the password is in /var/aircrack/fortinet-2021_passwords.txt : a trimmed version of leaked passwords from fortinet from 2021. The lab password is in there.