4

I'm struggling to get a handshake from my router when using airodump. I'm running this from Kali Linux live CD.

airmon-ng shows my wireless card is an Atheros AR9462 using the ath9k - [phy0] driver. I believe this supports packet injection. aireplay-ng --test wlan0 and aireplay-ng --test mon0 show injection is working.

So, I'm attempting to crack the WPA2 PSK on my local network. I use:

airodump-ng -w output --bssid MY_BSSID mon0 -c 6

I've confirmed the BSSID and channels are correct.

I have my MacBook connected to my network, and it shows up when airodump is running. I wait until the #Data column shows about 5,000 then I send deauth packets whilst airodump is still running:

aireplay-ng --deauth 1 -a AP_BSSID mon0

I send one, wait a few moments and send another. I get no handshake. I've repeated, and still nothing. I've tried to send 100, but it just disconnects my laptop from the network (not a good idea lol).

I can't figure out what's going wrong. I've followed 2 different guides, and watched a video from BT that all show they're able to get a handshake.

Any ideas?

Edit: mon0 is in monitor mode.

  • From a pen test training I've followed recently, I remember that the WNIC must be running in promiscuous mode. In Kali Linux this should be the default, but I guess it wouldn't hurt to check it anyway? – Steven Volckaert May 5 '14 at 6:56
  • I just watn to point out that aireplay deauthentication allows you to target specific clients based on their MAC address. You don't need to disconnect everyone from the network! – user2675345 May 8 '14 at 10:38
  • Had a similar problem. So i used wifite and got "handshakes" in less than a minute. – inselberg Jun 9 '14 at 18:52
  • I was having a similar problem.. when i made sure the tablet i deAuthed reconnected (manually), i got the handshake. not so great if you're not in the same room as the device, guess you just gotta wait for the handshake. – user118333 Jul 23 '16 at 22:49
8

The process you've described should result in handshake packets, assuming that the deauth packets are successful in forcing the device to re-attach to the network. A couple of suggestions.

  • I'm guessing that placement of all the devices is ok (e.g they're quite near to each other physically). If the device in monitor mode is further away there's always a risk that it wont see all the traffic.
  • I'd suggest getting a couple of devices (your macbook and perhaps a phone or tablet) and shutting them down and then re-start them. When a device starts up and connects to the network it definitely should send a handshake packet. If you don't see one then, does suggest something more fundamental is wrong (although off the top of my head not sure what !)

Typically when I do this on engagements, I'll leave airodump running for a couple of hours or more, and on a relatively busy network it'll see some devices connecting. DeAuth is a useful idea but I'm always a bit leary of knocking people off the network.

1

If we assume that your procedure is correct then the only purpose of "No Handshake" situation is caused by hardware limitation, i.e.:

When your wifi device is 802.11g will not capture the handshake packets which are sent between two 802.11n router and client.

Everything will seem to be normal, you can see the frames and Beacons, also you are able to de-authenticate the clients (you can understand that from receiving more packets from a sleeping clients), but your only problem is that you can't capture Handshakes.

So you need to upgrade your wifi device, but make sure the new device is compatible with aircrack.

Not the answer you're looking for? Browse other questions tagged or ask your own question.