\documentclass[10pt,a4paper]{article} % Packages \usepackage{fancyhdr} % For header and footer \usepackage{multicol} % Allows multicols in tables \usepackage{tabularx} % Intelligent column widths \usepackage{tabulary} % Used in header and footer \usepackage{hhline} % Border under tables \usepackage{graphicx} % For images \usepackage{xcolor} % For hex colours %\usepackage[utf8x]{inputenc} % For unicode character support \usepackage[T1]{fontenc} % Without this we get weird character replacements \usepackage{colortbl} % For coloured tables \usepackage{setspace} % For line height \usepackage{lastpage} % Needed for total page number \usepackage{seqsplit} % Splits long words. %\usepackage{opensans} % Can't make this work so far. Shame. Would be lovely. \usepackage[normalem]{ulem} % For underlining links % Most of the following are not required for the majority % of cheat sheets but are needed for some symbol support. \usepackage{amsmath} % Symbols \usepackage{MnSymbol} % Symbols \usepackage{wasysym} % Symbols %\usepackage[english,german,french,spanish,italian]{babel} % Languages % Document Info \author{itnetsec} \pdfinfo{ /Title (aircrack-ng-suite.pdf) /Creator (Cheatography) /Author (itnetsec) /Subject (Aircrack-ng Suite Cheat Sheet) } % Lengths and widths \addtolength{\textwidth}{6cm} \addtolength{\textheight}{-1cm} \addtolength{\hoffset}{-3cm} \addtolength{\voffset}{-2cm} \setlength{\tabcolsep}{0.2cm} % Space between columns \setlength{\headsep}{-12pt} % Reduce space between header and content \setlength{\headheight}{85pt} % If less, LaTeX automatically increases it \renewcommand{\footrulewidth}{0pt} % Remove footer line \renewcommand{\headrulewidth}{0pt} % Remove header line \renewcommand{\seqinsert}{\ifmmode\allowbreak\else\-\fi} % Hyphens in seqsplit % This two commands together give roughly % the right line height in the tables \renewcommand{\arraystretch}{1.3} \onehalfspacing % Commands \newcommand{\SetRowColor}[1]{\noalign{\gdef\RowColorName{#1}}\rowcolor{\RowColorName}} % Shortcut for row colour \newcommand{\mymulticolumn}[3]{\multicolumn{#1}{>{\columncolor{\RowColorName}}#2}{#3}} % For coloured multi-cols \newcolumntype{x}[1]{>{\raggedright}p{#1}} % New column types for ragged-right paragraph columns \newcommand{\tn}{\tabularnewline} % Required as custom column type in use % Font and Colours \definecolor{HeadBackground}{HTML}{333333} \definecolor{FootBackground}{HTML}{666666} \definecolor{TextColor}{HTML}{333333} \definecolor{DarkBackground}{HTML}{A3A3A3} \definecolor{LightBackground}{HTML}{F3F3F3} \renewcommand{\familydefault}{\sfdefault} \color{TextColor} % Header and Footer \pagestyle{fancy} \fancyhead{} % Set header to blank \fancyfoot{} % Set footer to blank \fancyhead[L]{ \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{C} \SetRowColor{DarkBackground} \vspace{-7pt} {\parbox{\dimexpr\textwidth-2\fboxsep\relax}{\noindent \hspace*{-6pt}\includegraphics[width=5.8cm]{/web/www.cheatography.com/public/images/cheatography_logo.pdf}} } \end{tabulary} \columnbreak \begin{tabulary}{11cm}{L} \vspace{-2pt}\large{\bf{\textcolor{DarkBackground}{\textrm{Aircrack-ng Suite Cheat Sheet}}}} \\ \normalsize{by \textcolor{DarkBackground}{itnetsec} via \textcolor{DarkBackground}{\uline{cheatography.com/21064/cs/6776/}}} \end{tabulary} \end{multicols}} \fancyfoot[L]{ \footnotesize \noindent \begin{multicols}{3} \begin{tabulary}{5.8cm}{LL} \SetRowColor{FootBackground} \mymulticolumn{2}{p{5.377cm}}{\bf\textcolor{white}{Cheatographer}} \\ \vspace{-2pt}itnetsec \\ \uline{cheatography.com/itnetsec} \\ \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Cheat Sheet}} \\ \vspace{-2pt}Published 28th January, 2016.\\ Updated 12th May, 2016.\\ Page {\thepage} of \pageref{LastPage}. \end{tabulary} \vfill \columnbreak \begin{tabulary}{5.8cm}{L} \SetRowColor{FootBackground} \mymulticolumn{1}{p{5.377cm}}{\bf\textcolor{white}{Sponsor}} \\ \SetRowColor{white} \vspace{-5pt} %\includegraphics[width=48px,height=48px]{dave.jpeg} Measure your website readability!\\ www.readability-score.com \end{tabulary} \end{multicols}} \begin{document} \raggedright \raggedcolumns % Set font size to small. Switch to any value % from this page to resize cheat sheet text: % www.emerson.emory.edu/services/latex/latex_169.html \footnotesize % Small font. \begin{multicols*}{2} \begin{tabularx}{8.4cm}{x{1.292 cm} x{1.672 cm} x{4.636 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airbase-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage}}: `airbase-ng \textless{}options\textgreater{} \textless{}replay interface\textgreater{}`} \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 2 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} `-a` & {\emph{bssid}} & set Access Point MAC address \tn % Row Count 6 (+ 2) % Row 4 \SetRowColor{LightBackground} `-i` & {\emph{iface}} & capture packets from this interface \tn % Row Count 8 (+ 2) % Row 5 \SetRowColor{white} `-w` & {\emph{WEP key}} & use this WEP key to encrypt/decrypt packets \tn % Row Count 10 (+ 2) % Row 6 \SetRowColor{LightBackground} `-W` & {\emph{0|1}} & {[}don't{]} set WEP flag in beacons 0|1 (default: auto) \tn % Row Count 13 (+ 3) % Row 7 \SetRowColor{white} `-h` & {\emph{MAC}} & source mac for MITM mode \tn % Row Count 14 (+ 1) % Row 8 \SetRowColor{LightBackground} `-f` & {\emph{disallow}} & disallow specified client MACs (default: allow) \tn % Row Count 16 (+ 2) % Row 9 \SetRowColor{white} `-q` & {\emph{none}} & quiet (do not print statistics) \tn % Row Count 18 (+ 2) % Row 10 \SetRowColor{LightBackground} `-v` & {\emph{none}} & verbose (print more messages) (long -{}-verbose) \tn % Row Count 20 (+ 2) % Row 11 \SetRowColor{white} `-M` & {\emph{none}} & M-I-T-M between {[}specified{]} clients and bssids \tn % Row Count 22 (+ 2) % Row 12 \SetRowColor{LightBackground} `-A` & {\emph{none}} & Ad-Hoc Mode (allows other clients to peer) (long -{}-ad-hoc) \tn % Row Count 25 (+ 3) % Row 13 \SetRowColor{white} `-Y` & {\emph{in|out|both}} & external packet processing \tn % Row Count 27 (+ 2) % Row 14 \SetRowColor{LightBackground} `-c` & {\emph{channel}} & sets the channel the AP is running on \tn % Row Count 29 (+ 2) % Row 15 \SetRowColor{white} `-X` & {\emph{none}} & hidden ESSID (long -{}-hidden) \tn % Row Count 31 (+ 2) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.292 cm} x{1.672 cm} x{4.636 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airbase-ng (cont)}} \tn % Row 16 \SetRowColor{LightBackground} `-s` & {\emph{none}} & force shared key authentication \tn % Row Count 2 (+ 2) % Row 17 \SetRowColor{white} `-S` & {\emph{none}} & set shared key challenge length (default: 128) \tn % Row Count 4 (+ 2) % Row 18 \SetRowColor{LightBackground} `-L` & {\emph{none}} & Caffe-Latte attack (long -{}-caffe-latte) \tn % Row Count 6 (+ 2) % Row 19 \SetRowColor{white} `-N` & {\emph{none}} & Hirte attack (cfrag attack), creates arp request against wep client (long –cfrag) \tn % Row Count 10 (+ 4) % Row 20 \SetRowColor{LightBackground} `-x` & {\emph{nbpps}} & number of packets per second (default: 100) \tn % Row Count 12 (+ 2) % Row 21 \SetRowColor{white} `-y` & {\emph{none}} & disables responses to broadcast probes \tn % Row Count 14 (+ 2) % Row 22 \SetRowColor{LightBackground} `-0` & {\emph{none}} & set all WPA,WEP,open tags. can't be used with -z \& -Z \tn % Row Count 17 (+ 3) % Row 23 \SetRowColor{white} `-z` & {\emph{type}} & sets WPA1 tags. 1=WEP40 2=TKIP 3=WRAP 4=CCMP 5=WEP104 \tn % Row Count 20 (+ 3) % Row 24 \SetRowColor{LightBackground} `-Z` & {\emph{type}} & same as -z, but for WPA2 \tn % Row Count 21 (+ 1) % Row 25 \SetRowColor{white} `-V type` & {\emph{type}} & fake EAPOL 1=MD5 2=SHA1 3=auto \tn % Row Count 23 (+ 2) % Row 26 \SetRowColor{LightBackground} `-F` & {\emph{prefix}} & write all sent and received frames into pcap file \tn % Row Count 26 (+ 3) % Row 27 \SetRowColor{white} `-P` & {\emph{none}} & respond to all probes, even when specifying ESSIDs \tn % Row Count 29 (+ 3) % Row 28 \SetRowColor{LightBackground} `-I` & {\emph{interval}} & sets the beacon interval value in ms \tn % Row Count 31 (+ 2) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.292 cm} x{1.672 cm} x{4.636 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airbase-ng (cont)}} \tn % Row 29 \SetRowColor{LightBackground} `-C` & {\emph{seconds}} & enables beaconing of probed ESSID values (requires -P) \tn % Row Count 3 (+ 3) % Row 30 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 3 (+ 0) % Row 31 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Filter Options}}} \tn % Row Count 4 (+ 1) % Row 32 \SetRowColor{white} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 6 (+ 2) % Row 33 \SetRowColor{LightBackground} `-{}-bssids` & {\emph{\textless{}file\textgreater{}}} & read a list of BSSIDs out of that file (short -B) \tn % Row Count 9 (+ 3) % Row 34 \SetRowColor{white} `-{}-bssid` & {\emph{\textless{}MAC\textgreater{}}} & BSSID to filter/use (short -b) \tn % Row Count 11 (+ 2) % Row 35 \SetRowColor{LightBackground} `-{}-client` & {\emph{\textless{}MAC\textgreater{}}} & MAC of client to accept (short -d) \tn % Row Count 13 (+ 2) % Row 36 \SetRowColor{white} `-{}-clients` & {\emph{\textless{}file\textgreater{}}} & read a list of MACs out of that file (short -D) \tn % Row Count 15 (+ 2) % Row 37 \SetRowColor{LightBackground} `-{}-essid` & {\emph{\textless{}ESSID\textgreater{}}} & specify a single ESSID (short -e) \tn % Row Count 17 (+ 2) % Row 38 \SetRowColor{white} `-{}-essids` & {\emph{\textless{}file\textgreater{}}} & read a list of ESSIDs out of that file (short -E) \tn % Row Count 20 (+ 3) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{2.204 cm} x{1.292 cm} x{4.104 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airdecloak-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage}}: `airdecloak-ng {[}options{]}`} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 1 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameter}} & {\bf{Description}} \tn % Row Count 4 (+ 3) % Row 3 \SetRowColor{white} -i & {\emph{input file}} & Path to the capture file \tn % Row Count 6 (+ 2) % Row 4 \SetRowColor{LightBackground} –bssid & {\emph{BSSID}} & BSSID of the network to filter. \tn % Row Count 8 (+ 2) % Row 5 \SetRowColor{white} –ssid & {\emph{ESSID}} & ESSID of the network to filter (not yet implemented). \tn % Row Count 11 (+ 3) % Row 6 \SetRowColor{LightBackground} –filters & {\emph{filters}} & Apply theses filters in this specific order. They have to be separated by a ','. \tn % Row Count 15 (+ 4) % Row 7 \SetRowColor{white} \seqsplit{–null-packets} & {\emph{none}} & Assume that null packets can be cloaked (not yet implemented). \tn % Row Count 18 (+ 3) % Row 8 \SetRowColor{LightBackground} \seqsplit{–disable-base\_filter} & {\emph{none}} & Disable the base filter. \tn % Row Count 20 (+ 2) % Row 9 \SetRowColor{white} \seqsplit{–drop-frag} & {\emph{none}} & Drop all fragmented packets. In most networks, fragmentation is not needed. \tn % Row Count 24 (+ 4) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airdrop-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage}}: `airdrop-ng {[}options{]} \textless{}pcap file\textgreater{}`} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 1 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameter}} & {\bf{Description}} \tn % Row Count 3 (+ 2) % Row 3 \SetRowColor{white} `-i` & {\emph{card}} & Wireless card in monitor mode to inject from \tn % Row Count 5 (+ 2) % Row 4 \SetRowColor{LightBackground} `-t` & {\emph{csv file}} & Airodump txt file in CSV format NOT the pcap \tn % Row Count 7 (+ 2) % Row 5 \SetRowColor{white} `-p` & {\emph{psyco}} & Disable the use of Psyco JIT \tn % Row Count 9 (+ 2) % Row 6 \SetRowColor{LightBackground} `-r` & {\emph{Rule File}} & Rule File for matched deauths \tn % Row Count 11 (+ 2) % Row 7 \SetRowColor{white} `-u` & {\emph{update}} & Updates OUI list \tn % Row Count 12 (+ 1) % Row 8 \SetRowColor{LightBackground} `-d` & {\emph{Driver}} & Injection driver. Default is mac80211 \tn % Row Count 14 (+ 2) % Row 9 \SetRowColor{white} `-s` & {\emph{sleep}} & Time to sleep between sending each packet \tn % Row Count 16 (+ 2) % Row 10 \SetRowColor{LightBackground} `-b` & {\emph{debug}} & Turn on Rule Debugging \tn % Row Count 17 (+ 1) % Row 11 \SetRowColor{white} `-l` & {\emph{key}} & Enable Logging to a file, if file path not provided airdrop will log to default location \tn % Row Count 21 (+ 4) % Row 12 \SetRowColor{LightBackground} `-n` & {\emph{nap}} & Time to sleep between loops \tn % Row Count 23 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{1.292 cm} x{1.672 cm} x{4.636 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Airdecap-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage}}: `airdecap-ng {[}options{]} \textless{}pcap file\textgreater{}`} \tn % Row Count 1 (+ 1) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 1 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameter}} & {\bf{Description}} \tn % Row Count 3 (+ 2) % Row 3 \SetRowColor{white} `-l` & {\emph{none}} & don't remove the 802.11 header \tn % Row Count 5 (+ 2) % Row 4 \SetRowColor{LightBackground} `-b` & {\emph{bssid}} & access point MAC address filter \tn % Row Count 7 (+ 2) % Row 5 \SetRowColor{white} `-k` & {\emph{pmk}} & WPA/WPA2 Pairwise Master Key in hex \tn % Row Count 9 (+ 2) % Row 6 \SetRowColor{LightBackground} `-e` & {\emph{essid}} & target network ascii identifier \tn % Row Count 11 (+ 2) % Row 7 \SetRowColor{white} `-p` & {\emph{pass}} & target network WPA/WPA2 passphrase \tn % Row Count 13 (+ 2) % Row 8 \SetRowColor{LightBackground} `-w` & {\emph{key}} & target network WEP key in hexadecimal \tn % Row Count 15 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{1.6 cm} x{6.4 cm} } \SetRowColor{DarkBackground} \mymulticolumn{2}{x{8.4cm}}{\bf\textcolor{white}{Airgraph-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{2}{x{8.4cm}}{{\bf{Usage:}} `python airgraph-ng -i {[}airodumpfile.txt{]} -o {[}outputfile.png{]} -g {[}CAPR OR CPG{]}`} \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} \mymulticolumn{2}{x{8.4cm}}{} \tn % Row Count 2 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Description}} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} `-i` & Input File \tn % Row Count 5 (+ 1) % Row 4 \SetRowColor{LightBackground} `-o` & Output File \tn % Row Count 6 (+ 1) % Row 5 \SetRowColor{white} `-g` & Graph Type {[}CAPR (Client to AP Relationship) OR CPG (Common probe graph){]} \tn % Row Count 9 (+ 3) % Row 6 \SetRowColor{LightBackground} `-a` & Print the about \tn % Row Count 10 (+ 1) % Row 7 \SetRowColor{white} `-h` & Print this help \tn % Row Count 11 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}--} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aircrack-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage}}: `aircrack-ng {[}options{]} \textless{}capture file(s)\textgreater{}`} \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 2 (+ 0) % Row 2 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameter}} & {\bf{Description}} \tn % Row Count 4 (+ 2) % Row 3 \SetRowColor{white} `-a` & {\emph{amode}} & Force attack mode (1 = static WEP, 2 = WPA/WPA2-PSK) \tn % Row Count 7 (+ 3) % Row 4 \SetRowColor{LightBackground} `-b` & {\emph{bssid}} & Long version - -bssid. Select the target network based on the access point's MAC address. \tn % Row Count 11 (+ 4) % Row 5 \SetRowColor{white} `-e` & {\emph{essid}} & If set, all IVs from networks with the same ESSID will be used. This option is also required for WPA/WPA2-PSK cracking if the ESSID is not broadcasted (hidden). \tn % Row Count 18 (+ 7) % Row 6 \SetRowColor{LightBackground} `-p` & {\emph{nbcpu}} & On SMP systems: \# of CPU to use. This option is invalid on non-SMP systems \tn % Row Count 21 (+ 3) % Row 7 \SetRowColor{white} `-q` & {\emph{none}} & Enable quiet mode (no status output until the key is found, or not) \tn % Row Count 24 (+ 3) % Row 8 \SetRowColor{LightBackground} `-c` & {\emph{none}} & (WEP cracking) Restrict the search space to alpha-numeric characters only (0x20 - 0x7F) \tn % Row Count 28 (+ 4) % Row 9 \SetRowColor{white} `-t` & {\emph{none}} & (WEP cracking) Restrict the search space to binary coded decimal hex characters \tn % Row Count 32 (+ 4) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aircrack-ng (cont)}} \tn % Row 10 \SetRowColor{LightBackground} `-h` & {\emph{none}} & (WEP cracking) Restrict the search space to numeric characters (0x30-0x39) These keys are used by default in most Fritz!BOXes \tn % Row Count 5 (+ 5) % Row 11 \SetRowColor{white} `-d` & {\emph{start}} & (WEP cracking) Long version –debug. Set the beginning of the WEP key (in hex), for debugging purposes. \tn % Row Count 10 (+ 5) % Row 12 \SetRowColor{LightBackground} `-m` & {\emph{maddr}} & (WEP cracking) MAC address to filter WEP data packets. Alternatively, specify -m ff:ff:ff:ff:ff:ff to use all and every IVs, regardless of the network. \tn % Row Count 17 (+ 7) % Row 13 \SetRowColor{white} `-M` & {\emph{number}} & (WEP cracking) Sets the maximum number of ivs to use. \tn % Row Count 20 (+ 3) % Row 14 \SetRowColor{LightBackground} `-n` & {\emph{nbits}} & (WEP cracking) Specify the length of the key: 64 for 40-bit WEP, 128 for 104-bit WEP, etc. The default value is 128. \tn % Row Count 25 (+ 5) % Row 15 \SetRowColor{white} `-i` & {\emph{index}} & (WEP cracking) Only keep the IVs that have this key index (1 to 4). The default behaviour is to ignore the key index. \tn % Row Count 30 (+ 5) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aircrack-ng (cont)}} \tn % Row 16 \SetRowColor{LightBackground} `-f` & {\emph{fudge}} & (WEP cracking) By default, this parameter is set to 2 for 104-bit WEP and to 5 for 40-bit WEP. Specify a higher value to increase the bruteforce level: cracking will take more time, but with a higher likelyhood of success. \tn % Row Count 9 (+ 9) % Row 17 \SetRowColor{white} `-H` & {\emph{none}} & Long version - -help. Output help information. \tn % Row Count 11 (+ 2) % Row 18 \SetRowColor{LightBackground} `-l` & {\emph{file name}} & (Lowercase L, ell) logs the key to the file specified. \tn % Row Count 14 (+ 3) % Row 19 \SetRowColor{white} `-K` & {\emph{none}} & Invokes the Korek WEP cracking method. (Default in v0.x) \tn % Row Count 17 (+ 3) % Row 20 \SetRowColor{LightBackground} `-k` & {\emph{korek}} & (WEP cracking) There are 17 korek statistical attacks. Sometimes one attack creates a huge false positive that prevents the key from being found, even with lots of IVs. Try -k 1, -k 2, … -k 17 to disable each attack selectively. \tn % Row Count 27 (+ 10) % Row 21 \SetRowColor{white} `-p` & {\emph{threads}} & Allow the number of threads for cracking even if you have a non-SMP computer. \tn % Row Count 31 (+ 4) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aircrack-ng (cont)}} \tn % Row 22 \SetRowColor{LightBackground} `-r` & {\emph{database}} & Utilizes a database generated by airolib-ng as input to determine the WPA key. Outputs an error message if aircrack-ng has not been compiled with sqlite support. \tn % Row Count 7 (+ 7) % Row 23 \SetRowColor{white} \seqsplit{`-x/-x0`} & {\emph{none}} & (WEP cracking) Disable last keybytes brutforce. \tn % Row Count 9 (+ 2) % Row 24 \SetRowColor{LightBackground} `-x1` & {\emph{none}} & (WEP cracking) Enable last keybyte bruteforcing (default). \tn % Row Count 12 (+ 3) % Row 25 \SetRowColor{white} `-x2` & {\emph{none}} & (WEP cracking) Enable last two keybytes bruteforcing. \tn % Row Count 15 (+ 3) % Row 26 \SetRowColor{LightBackground} `-X` & {\emph{none}} & (WEP cracking) Disable bruteforce multithreading (SMP only). \tn % Row Count 18 (+ 3) % Row 27 \SetRowColor{white} `-y` & {\emph{none}} & (WEP cracking) Experimental single bruteforce attack which should only be used when the standard attack mode fails with more than one million IVs \tn % Row Count 24 (+ 6) % Row 28 \SetRowColor{LightBackground} `-u` & {\emph{none}} & Long form - -cpu-detect. Provide information on the number of CPUs and MMX support. Example responses to "aircrack-ng - -cpu-detect" are "Nb CPU detected: 2" or "Nb CPU detected: 1 (MMX available)". \tn % Row Count 33 (+ 9) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.216 cm} x{1.596 cm} x{4.788 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aircrack-ng (cont)}} \tn % Row 29 \SetRowColor{LightBackground} `-w` & {\emph{words}} & (WPA cracking) Path to a wordlist or "-" without the quotes for standard in (stdin). \tn % Row Count 4 (+ 4) % Row 30 \SetRowColor{white} `-z` & {\emph{none}} & Invokes the PTW WEP cracking method. (Default in v1.x) \tn % Row Count 7 (+ 3) % Row 31 \SetRowColor{LightBackground} `-P` & {\emph{none}} & Long version - -ptw-debug. Invokes the PTW debug mode. \tn % Row Count 10 (+ 3) % Row 32 \SetRowColor{white} `-C` & {\emph{MACs}} & Long version - -combine. Merge the given APs to a virtual one. \tn % Row Count 13 (+ 3) % Row 33 \SetRowColor{LightBackground} `-D` & {\emph{none}} & Long version - -wep-decloak. Run in WEP decloak mode. \tn % Row Count 16 (+ 3) % Row 34 \SetRowColor{white} `-V` & {\emph{none}} & Long version - -visual-inspection. Run in visual inspection mode. \tn % Row Count 19 (+ 3) % Row 35 \SetRowColor{LightBackground} `-1` & {\emph{none}} & Long version - -oneshot. Run in oneshot mode. \tn % Row Count 21 (+ 2) % Row 36 \SetRowColor{white} `-S` & {\emph{none}} & WPA cracking speed test. \tn % Row Count 22 (+ 1) % Row 37 \SetRowColor{LightBackground} `-s` & {\emph{none}} & Show the key in ASCII while cracking \tn % Row Count 24 (+ 2) % Row 38 \SetRowColor{white} `-E` & {\emph{file\textgreater{}}} & (WPA cracking) Create EWSA Project file v3 \tn % Row Count 26 (+ 2) % Row 39 \SetRowColor{LightBackground} `-J` & {\emph{file}} & (WPA cracking) Create Hashcat Capture file \tn % Row Count 28 (+ 2) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} \begin{tabularx}{8.4cm}{x{1.9 cm} x{1.444 cm} x{4.256 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aireplay-ng}} \tn % Row 0 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Usage:}}` aireplay-ng \textless{}options\textgreater{} \textless{}replay interface\textgreater{}`} \tn % Row Count 2 (+ 2) % Row 1 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 2 (+ 0) % Row 2 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Filter Options}}} \tn % Row Count 3 (+ 1) % Row 3 \SetRowColor{white} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 5 (+ 2) % Row 4 \SetRowColor{LightBackground} `-b` & {\emph{bssid}} & MAC address, Access Point \tn % Row Count 7 (+ 2) % Row 5 \SetRowColor{white} `-d` & {\emph{dmac}} & MAC address, Destination \tn % Row Count 9 (+ 2) % Row 6 \SetRowColor{LightBackground} `-s` & {\emph{smac}} & MAC address, Source \tn % Row Count 10 (+ 1) % Row 7 \SetRowColor{white} `-m` & {\emph{len}} & minimum packet length \tn % Row Count 11 (+ 1) % Row 8 \SetRowColor{LightBackground} `-n` & {\emph{len}} & maximum packet length \tn % Row Count 12 (+ 1) % Row 9 \SetRowColor{white} `-u` & {\emph{type}} & frame control, type field \tn % Row Count 14 (+ 2) % Row 10 \SetRowColor{LightBackground} `-v` & {\emph{subt}} & frame control, subtype field \tn % Row Count 16 (+ 2) % Row 11 \SetRowColor{white} `-t` & {\emph{tods}} & frame control, To DS bit \tn % Row Count 18 (+ 2) % Row 12 \SetRowColor{LightBackground} `-f` & {\emph{fromds}} & frame control, From DS bit \tn % Row Count 20 (+ 2) % Row 13 \SetRowColor{white} `-w` & {\emph{iswep}} & frame control, WEP bit \tn % Row Count 21 (+ 1) % Row 14 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 21 (+ 0) % Row 15 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{{\bf{Replay Options}}} \tn % Row Count 22 (+ 1) % Row 16 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 24 (+ 2) % Row 17 \SetRowColor{white} `-x` & {\emph{nbpps}} & number of packets per second \tn % Row Count 26 (+ 2) % Row 18 \SetRowColor{LightBackground} `-p` & {\emph{fctrl}} & set frame control word (hex) \tn % Row Count 28 (+ 2) % Row 19 \SetRowColor{white} `-a` & {\emph{bssid}} & set Access Point MAC address \tn % Row Count 30 (+ 2) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.9 cm} x{1.444 cm} x{4.256 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aireplay-ng (cont)}} \tn % Row 20 \SetRowColor{LightBackground} `-c` & {\emph{dmac}} & set Destination MAC address \tn % Row Count 2 (+ 2) % Row 21 \SetRowColor{white} `-h` & {\emph{smac}} & set Source MAC address \tn % Row Count 3 (+ 1) % Row 22 \SetRowColor{LightBackground} `-e` & {\emph{essid}} & For fakeauth attack or injection test, it sets target AP SSID. This is optional when the SSID is not hidden. \tn % Row Count 8 (+ 5) % Row 23 \SetRowColor{white} `-j` & {\emph{none}} & arpreplay attack, inject FromDS pkts \tn % Row Count 10 (+ 2) % Row 24 \SetRowColor{LightBackground} `-g` & {\emph{value}} & change ring buffer size (default: 8) \tn % Row Count 12 (+ 2) % Row 25 \SetRowColor{white} `-k` & {\emph{IP}} & set destination IP in fragments \tn % Row Count 14 (+ 2) % Row 26 \SetRowColor{LightBackground} `-l` & {\emph{IP}} & set source IP in fragments \tn % Row Count 16 (+ 2) % Row 27 \SetRowColor{white} `-o` & {\emph{npckts}} & number of packets per burst (-1) \tn % Row Count 18 (+ 2) % Row 28 \SetRowColor{LightBackground} `-q` & {\emph{sec}} & seconds between keep-alives (-1) \tn % Row Count 20 (+ 2) % Row 29 \SetRowColor{white} `-y` & {\emph{prga}} & keystream for shared key auth \tn % Row Count 22 (+ 2) % Row 30 \SetRowColor{LightBackground} `-B or \seqsplit{–bittest`} & {\emph{none}} & bit rate test (Applies only to test mode) \tn % Row Count 24 (+ 2) % Row 31 \SetRowColor{white} `-D` & {\emph{none}} & disables AP detection. Some modes will not proceed if the AP beacon is not heard. This disables this functionality. \tn % Row Count 30 (+ 6) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.9 cm} x{1.444 cm} x{4.256 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aireplay-ng (cont)}} \tn % Row 32 \SetRowColor{LightBackground} `-F or –fast` & {\emph{none}} & chooses first matching packet. For test mode, it just checks basic injection and skips all other tests. \tn % Row Count 5 (+ 5) % Row 33 \SetRowColor{white} `-R` & {\emph{none}} & disables /dev/rtc usage. Some systems experience lockups or other problems with RTC. This disables the usage. \tn % Row Count 10 (+ 5) % Row 34 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 10 (+ 0) % Row 35 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{{\bf{Source options}}} \tn % Row Count 11 (+ 1) % Row 36 \SetRowColor{LightBackground} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 13 (+ 2) % Row 37 \SetRowColor{white} `iface` & {\emph{none}} & capture packets from this interface \tn % Row Count 15 (+ 2) % Row 38 \SetRowColor{LightBackground} `-r` & {\emph{file}} & extract packets from this pcap file \tn % Row Count 17 (+ 2) % Row 39 \SetRowColor{white} \mymulticolumn{3}{x{8.4cm}}{} \tn % Row Count 17 (+ 0) % Row 40 \SetRowColor{LightBackground} \mymulticolumn{3}{x{8.4cm}}{{\bf{Attack modes}}} \tn % Row Count 18 (+ 1) % Row 41 \SetRowColor{white} {\bf{Syntax}} & {\bf{Parameters}} & {\bf{Description}} \tn % Row Count 20 (+ 2) % Row 42 \SetRowColor{LightBackground} `-{}-deauth` & {\emph{count}} & deauthenticate 1 or all stations (-0) \tn % Row Count 22 (+ 2) % Row 43 \SetRowColor{white} `-{}-fakeauth` & {\emph{delay}} & fake authentication with AP (-1) \tn % Row Count 24 (+ 2) % Row 44 \SetRowColor{LightBackground} `-{}-interactive` & {\emph{none}} & interactive frame selection (-2) \tn % Row Count 26 (+ 2) % Row 45 \SetRowColor{white} `-{}-arpreplay` & {\emph{none}} & standard ARP-request replay (-3) \tn % Row Count 28 (+ 2) % Row 46 \SetRowColor{LightBackground} `-{}-chopchop` & {\emph{none}} & decrypt/chopchop WEP packet (-4) \tn % Row Count 30 (+ 2) \end{tabularx} \par\addvspace{1.3em} \vfill \columnbreak \begin{tabularx}{8.4cm}{x{1.9 cm} x{1.444 cm} x{4.256 cm} } \SetRowColor{DarkBackground} \mymulticolumn{3}{x{8.4cm}}{\bf\textcolor{white}{Aireplay-ng (cont)}} \tn % Row 47 \SetRowColor{LightBackground} `-{}-fragment` & {\emph{none}} & generates valid keystream (-5) \tn % Row Count 2 (+ 2) % Row 48 \SetRowColor{white} `-{}-test` & {\emph{none}} & injection test (-9) \tn % Row Count 3 (+ 1) \hhline{>{\arrayrulecolor{DarkBackground}}---} \end{tabularx} \par\addvspace{1.3em} % That's all folks \end{multicols*} \end{document}