WiFite

[Mutt]

Good day, today I will introduce you to tools such as WiFite.

WiFite is an automated wireless attack tool.

The tool can attack many WEP, WPA and WPS encrypted networks in a row. This tool is configured to be automatic with just a few arguments. Wifite's goal is to be a set-and-forget wireless audit tool.

Peculiarities:

• sorts targets by signal (in dB); is the first to hack the closest access points
• automatically de-authenticates clients of hidden networks to reveal their SSID
• a set of filters for specifying exactly what to attack (wep / wpa / both, above a certain signal strength, channels, etc.)
• flexible settings (timeouts, packets per second, etc.)
• functions of "anonymity": change the MAC to a random address before the attack, then reverse change when the attack is completed
• all captured WPA handshakes are copied to the current wifite.py directory
• smart WPA deauthentication; cycles between deauthentication of all clients and broadcast
• stop any hacking by Ctrl + C with options to continue, go to the next target, skip the hack or exit
• displaying general information on the session upon exiting; showing all cracked keys
• all passwords are stored in cracked.txt

Page on GitHub: https://github.com/derv82/wifite2

---

Installing WiFite on Kali Linux​

The program is preinstalled in Kali Linux, additionally install the programs:

• hcxdumptool
• hcxtools

Kali Linux:

sudo apt install hcxdumptool
sudo apt install hcxtools

---

WiFite launch examples​

Attack access points with a power of more than 50 dB ( -pow 50 ) using the WPS attack ( -wps ):

wifite -pow 50 -wps

---

WiFite Help​

Optional arguments:

-h, --help show help and exit

SETTINGS:
-i [interface] Wireless interface to use (default: ask)
-c [channel] Wireless channels to scan (default: all channels)
-5, --5ghz Including 5Ghz channels (default: off)
-b [bssid] BSSID (eg AA: BB: CC: DD: EE: FF) of the access point to attack
-e [essid] ESSID (name) of the access point to attack
-v, --verbose Verbose mode, print all lines (default: quiet)

WEP:
--wep Show only WEP encrypted networks (default: off)
--require-fakeauth Attack failed if fake authentication failed (default: disabled)
--pps [pps] Packets per second to play (default: 600 pps)
--wept [seconds] Wait seconds before failure (default: 600 seconds)
--wepca [ivs] Run cracking on this number of IVs (default: 10000 ivs)
--weprs [seconds] Restart aireplay if no new IVs appear (default: 11 seconds)
--weprc [seconds] Restart aircrack after this delay (default: 30 seconds)
--arpreplay Use WEP ARP play attack (default: enabled)
--fragment Use WEP fragmentation attack (default: enabled)
--chopchop Use chop-chop WEP attack (default: enabled)
--caffelatte Use Cafe latte WEP attack (default: enabled)
--p0841 Use WEP attack p0841 (default: enabled)
--hirte Use WEP ARP replay attack (default: enabled)

WPA:
--wpa Show only WPA encrypted networks (including WPS)
--wpadt [seconds] Time to wait before sending deauthentication (default: 10 seconds)
--wpat [seconds] Time to wait to recognize a WPA attack as unsuccessful (default: 500 seconds)
--hs-dir [dir] Directory for saving handshakes files (default: hs)
--dict [file] File containing cracking passwords (default: None)
--strip Purge unneeded packages from the captured handshake using tshark or pyrit

WPS:
--wps Show only networks with WPS
--reaver Use ONLY Reaver on WPS networks (default: disabled)
--no-reaver DO NOT use Reaver on WPS networks (default: disabled)
--pixie Use only WPS Pixie-Dust attack (default: off)
--pixiet [seconds] Time to wait before a PixieDust attack is considered unsuccessful (default: 300 seconds)
--pixiest [seconds] Time to wait for a progress step before recognizing a PixieDust attack as unsuccessful (default: 30 seconds)
--wpst [seconds] Time to wait before recognizing a WPS PIN attack as unsuccessful (default: 600 seconds)
--wpsmr [attempts] Maximum number of attempts before failing (default: 20)
--wpsmf [fails] Maximum number of Reaver failures before attacking as failed (default: 30)
--wpsmt [timeouts] Maximum number of timeouts before stopping (default: 30)
--ignore-ratelimit Ignore attack if WPS is rate limited (default: enabled)

TEAMS:
--cracked Show previously cracked hotspots
--check [file] Check .cap files (or all hs / *. cap files) for WPA handshakes