Using Wifite for Automated WiFi Auditing

What Is Wifite?

Wifite is an automated wireless auditing tool that attacks multiple WPA/WPA2 and WPS encrypted networks in sequence. You point it at nearby networks, and it systematically attempts to capture handshakes, exploit WPS vulnerabilities, and crack passwords - all without manual intervention between targets.

The original Wifite was written by derv82 and became popular because it drastically reduced the number of commands needed to audit WiFi networks. Instead of running airmon-ng, airodump-ng, aireplay-ng, and aircrack-ng separately with their various flags and options, Wifite chains everything together automatically.

The current version, Wifite2, is a complete rewrite in Python 3 with better architecture, more attack types, and improved reliability. When people refer to "Wifite" today, they typically mean Wifite2.

As with all wireless auditing tools: only use Wifite on networks you own or have explicit written authorization to test. Unauthorized access to computer networks is a criminal offense.

Wifite2: The Current Version

Wifite2 is included in Kali Linux by default and can be installed on other Linux distributions from its GitHub repository. It's written in Python 3 and depends on the aircrack-ng suite plus several optional tools that extend its capabilities.

Core dependencies:

• Python 3
• aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng, aircrack-ng)
• iwconfig / iw

Optional dependencies that unlock additional attacks:

• tshark (Wireshark CLI) - Improved handshake detection and validation
• reaver - WPS PIN brute force attacks
• bully - Alternative WPS attack tool
• pixiewps - Offline WPS Pixie Dust attack
• hashcat - GPU-accelerated password cracking
• hcxdumptool / hcxpcapngtool - PMKID capture without deauthentication
• john (John the Ripper) - Alternative password cracker

Running Wifite2 is simple:

sudo wifite

That's it. Wifite automatically detects your wireless interface, puts it into monitor mode, starts scanning, and presents you with a list of detected networks. You select targets (or let it attack all of them), and it begins working through its attack sequence.

How Wifite Works Under the Hood

graph TD
    subgraph Init["Initialization"]
        A[Start Wifite] --> B[Detect Wireless Interfaces]
        B --> C[Enable Monitor Mode]
        C --> D[Start Scanning]
    end
    subgraph Scan["Target Discovery"]
        D --> E[Discover Networks]
        E --> F[Display Target List]
        F --> G[User Selects Targets]
    end
    subgraph Attack["Attack Sequence per Target"]
        G --> H{WPS Enabled?}
        H -->|Yes| I[Pixie Dust Attack]
        I -->|Failed| J[WPS PIN Brute Force]
        J -->|Failed| K[PMKID Capture]
        H -->|No| K
        K -->|Failed| L[WPA Handshake Capture]
        L --> L1[Deauth Clients]
        L1 --> L2[Wait for Handshake]
        L2 -->|Captured| M[Crack with Wordlist]
        L2 -->|Timeout| N[Move to Next Target]
        M -->|Success| O[Password Found]
        M -->|Failed| N
        I -->|Success| O
        J -->|Success| O
        K -->|Captured| M
    end
    subgraph Results["Output"]
        O --> P[Save to cracked.db]
        N --> Q[Next Target or Done]
    end

Wifite's automated attack sequence - it works through multiple attack types per target before moving on.

Wifite follows a prioritized attack sequence for each target. It starts with the fastest, least intrusive attacks and escalates to slower, more aggressive ones if the earlier attempts fail.

The general priority order is:

1. PMKID capture (if hcxdumptool is available) - No deauthentication needed, fast
2. WPS Pixie Dust (if reaver/bully and pixiewps are available) - Offline attack, takes seconds when vulnerable
3. WPS PIN brute force (if reaver/bully available) - Online attack, can take hours
4. WPA handshake capture - Requires deauthentication, then wordlist cracking

For each attack, Wifite sets a timeout. If the attack doesn't succeed within the timeout (configurable via command-line options), it moves to the next attack type or the next target. This approach maximizes results across multiple networks rather than spending unlimited time on a single stubborn target.

The Attack Flow

Here's what happens when you run Wifite against a target network:

1. Interface preparation. Wifite detects wireless interfaces, asks you to select one (if multiple exist), and puts it into monitor mode. If the interface is already in managed mode with an active connection, Wifite will kill interfering processes (like NetworkManager) to take control.

2. Scanning. Using airodump-ng, Wifite scans all channels (or specific channels if you specify with -c) and builds a list of networks with their SSIDs, BSSIDs, channel, signal strength, encryption type, and WPS status.

3. Target selection. Networks are displayed in a numbered list. You can select individual targets, ranges, or all networks. Wifite also supports command-line filters to auto-select targets (by encryption type, signal strength, WPS status, etc.).

4. Attack execution. For each target, Wifite works through the attack priority list. Between attacks, it provides status updates showing what it's attempting and whether it's succeeding.

5. Results. Successfully cracked passwords are displayed on screen and saved to a database file (cracked.db or cracked.json). Captured handshakes are saved as .cap files for later cracking with larger wordlists or GPU-powered tools.

WPA/WPA2 Attacks

Wifite's WPA/WPA2 attack follows the standard handshake capture and crack methodology:

Handshake capture: Wifite targets the selected network and sends deauthentication frames to connected clients. When a deauthenticated client reconnects, the 4-way handshake between the client and access point is captured. Wifite validates the captured handshake using multiple methods (including tshark if available) to ensure it's complete and usable.

Cracking: Once a valid handshake is captured, Wifite attempts to crack it using a wordlist. The default wordlist on Kali Linux is usually /usr/share/wordlists/rockyou.txt (a list of ~14 million real passwords from a data breach). You can specify a different wordlist with the --dict flag.

The cracking phase is the bottleneck. WPA/WPA2 uses PBKDF2 with 4096 iterations of HMAC-SHA1, making each password test computationally expensive. A CPU might test a few thousand passwords per second. A GPU with hashcat can test hundreds of thousands to millions per second, depending on the hardware.

If the password isn't in your wordlist, it won't be cracked. This is a fundamental limitation of dictionary attacks. Complex, random passwords that don't appear in any wordlist are effectively immune to this approach (though they can still be attacked with rule-based mutations or brute force, given enough time and computing power).

WPS Attacks

WiFi Protected Setup uses an 8-digit PIN for device enrollment. Due to a protocol design flaw, the PIN is verified in two halves: the first 4 digits are checked separately from the last 4 (with the 8th digit being a checksum). This reduces the maximum number of attempts from 100,000,000 to approximately 11,000.

Wifite leverages two tools for WPS attacks:

Pixie Dust (pixiewps): This offline attack exploits weak random number generation in certain WPS implementations. If the access point uses predictable nonces during the WPS exchange, pixiewps can compute the PIN without any brute forcing. The attack takes seconds and doesn't trigger rate limiting. It's by far the fastest WPS attack but only works on vulnerable implementations (certain Ralink, Broadcom, and Realtek chipsets).

Online PIN brute force (reaver/bully): If Pixie Dust fails, Wifite can fall back to systematically trying all possible PINs. This works against any WPS-enabled AP that doesn't implement lockout, but it's slow - potentially hours to days depending on rate limiting. Many modern routers lock out WPS after several failed attempts, making this attack impractical.

Wifite tries Pixie Dust first (fast, low footprint) and only falls back to online brute force if configured to do so.

PMKID Attacks

The PMKID attack, discovered in 2018, is a significant improvement over traditional handshake capture because it doesn't require deauthenticating any clients.

The Pairwise Master Key Identifier (PMKID) is included in the first message of the RSN (Robust Security Network) handshake. An attacker can obtain it simply by attempting to associate with the access point - no clients need to be connected or disrupted.

Wifite uses hcxdumptool to capture the PMKID and hcxpcapngtool to convert it to a format compatible with hashcat. The captured PMKID is then cracked using the same wordlist approach as handshakes.

Not all access points include PMKID in their responses (it's optional in the standard), but many do. When available, this attack is faster, stealthier, and less disruptive than traditional handshake capture.

Configuration and Options

Wifite's behavior is controlled through command-line flags:

# Target specific encryption types
sudo wifite --wpa        # Only WPA networks
sudo wifite --wps        # Only WPS-enabled networks

# Filter by signal strength (only strong signals)
sudo wifite --power 50   # Minimum signal power of 50 dBm

# Specify wordlist
sudo wifite --dict /path/to/custom_wordlist.txt

# Skip specific attacks
sudo wifite --no-wps     # Skip all WPS attacks
sudo wifite --no-pmkid   # Skip PMKID capture attempts

# Timeouts
sudo wifite --wpa-timeout 300  # Wait 5 minutes for handshake
sudo wifite --wps-timeout 600  # Wait 10 minutes for WPS attack

# Kill interfering processes automatically
sudo wifite --kill

# Channel specification
sudo wifite -c 1,6,11    # Only scan channels 1, 6, and 11

For most auditing scenarios, the defaults work well. The main customization you'll make is specifying a better wordlist and adjusting timeouts based on how long you can spend on the test.

What Wifite Cannot Do

Understanding Wifite's limitations is just as important as knowing its capabilities:

• It cannot crack passwords not in the wordlist. Dictionary attacks are only as good as the dictionary. If the network uses a truly random password, Wifite won't crack it regardless of how long you wait.
• It cannot bypass WPA3. WPA3 uses Simultaneous Authentication of Equals (SAE), which is resistant to offline dictionary attacks. Handshake capture doesn't work the same way against WPA3.
• It cannot defeat 802.11w (Management Frame Protection). If the target network uses PMF (Protected Management Frames), deauthentication attacks won't work. This means handshake capture via forced reconnection fails.
• It cannot do evil twin attacks. Wifite focuses on handshake/WPS attacks. For rogue AP testing, you need other tools (airgeddon, hostapd manually, or Fluxion).
• It cannot attack enterprise networks. WPA-Enterprise (802.1X) authentication is out of scope for Wifite.
• It doesn't guarantee results. Automation means convenience, not certainty. Some networks will resist all of Wifite's attack methods.
• Legal restrictions apply. Sending deauthentication frames is restricted or illegal in some regions. In the EU, for example, regulations under the Radio Equipment Directive restrict such transmissions.

Wifite vs Manual Testing

Wifite excels at breadth - quickly testing many networks in sequence. Manual testing excels at depth - spending time on a single target with creative approaches that automated tools might miss.

Use Wifite when:

• You need to audit multiple networks quickly (e.g., an office building assessment)
• You're checking for WPS vulnerabilities across a large number of access points
• You want to capture handshakes from multiple networks for offline cracking later
• Time is limited and you need a fast initial assessment

Use manual tools when:

• Wifite's automated attacks all fail and you need to investigate why
• You need fine-grained control over deauthentication timing or targeting
• The target environment requires custom approaches (e.g., client isolation, hidden SSIDs)
• You want to understand what's happening at the packet level
• You're troubleshooting adapter or driver issues

The professional approach is to use Wifite for the initial sweep, then switch to manual tools for targets that need more attention. Captured handshakes from Wifite can be moved to a dedicated cracking rig running hashcat with larger wordlists and complex rule sets.

For building real skills, start manually. Learn airmon-ng, airodump-ng, and aireplay-ng by typing the commands yourself. Understand monitor mode, channel hopping, and packet injection at a conceptual level. Then use Wifite as a productivity tool once you know what it's doing behind the scenes.

A portable WiFi auditing device like the BLEShark Nano takes a different approach entirely - running its own firmware for WiFi scanning, handshake capture, and BLE analysis without requiring a laptop running Linux. It's useful for quick field assessments where setting up Wifite isn't practical, and the captured data can be analyzed later with desktop tools.

Responsible Use

WiFi auditing tools exist in a legal gray area that becomes very clear-cut the moment you use them on someone else's network without permission. To stay on the right side:

• Get written authorization. Before any test, have a signed document specifying which networks are in scope, what attack types are permitted, and the testing window.
• Know your local laws. Regulations vary by country and even by state/province. Some jurisdictions restrict the mere possession of certain tools.
• Test your own equipment first. Set up a dedicated test access point, practice there, and build your skills before touching anything in a client environment.
• Document everything. Keep logs of what you tested, when, and what results you obtained. This protects both you and the client.
• Report responsibly. The goal of WiFi auditing is to improve security. Report findings with remediation recommendations, not just "I broke in."

WiFi security auditing is a valuable skill, and tools like Wifite make it more accessible. But accessibility doesn't remove the responsibility to use these tools ethically and legally.

Looking for a dedicated WiFi auditing device? The BLEShark Nano packs WiFi scanning, handshake capture, BLE analysis, and more into a pocket-sized package - with region-aware compliance features that disable restricted functions where local regulations require it.