0

With Airodump I can see Wi-Fi networks and clients associated to them. I know password to this Wi-Fi networks. Is it possible to dump encrypted traffic between AP and client (WPA2) and then decrypt it with password to see unencrypted traffic?

2 Answers 2

1

If you are able to sniff your traffic in Wireshark:

Edit --> Preferences --> Protocols --> IEEE 802.11 --> Decrypt --> Enter hexadecimal key.

3
  • I know how to decrypt but I don't know that way, thanks. I'm using Airdecap. I asked about technical capabilities to sniff all network traffic between AP and client. Is it possible?
    – QkiZ
    Commented Mar 4, 2016 at 21:48
  • I see, if you aren't performing this from on the client itself, I am not sure. Sorry!
    – 404Cat
    Commented Mar 5, 2016 at 17:28
  • I sniff some traffic to pcap file. But after decrypt via Airdecap I got file 24 bytes long and nothing in there.
    – QkiZ
    Commented Mar 5, 2016 at 17:42
0

First, use Airodump-ng's --output-format to capture in pcap format.

The, use tshark, per Decrypt WPA with Tshark on ask.wireshark.org, or wireshark itself as 404Cat listed.

tshark -nr input.pcap -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\" Passphrase:SSID\"" -R "http"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .