Skip to main content

AI-Driven Wireless Penetration Testing. One Promt WIFI cracking

Lab Metadata

Ecosystem Fit​

This page mirrors the original Medium lab content into the 1200km knowledge base so it remains available inside the 1200km.com documentation ecosystem. Use the linked repository when one exists; otherwise use the deployment commands and configuration blocks preserved below as the lab source of truth.

Deployment Requirements​

The full prerequisites, deployment flow, validation commands, screenshots, and operational notes are preserved from the article below. Review the repository metadata above first, then follow the article sections in order.

Using Aircrack-ng with HexStrike-AI and Gemini-CLI​

Article screenshot

Introduction​

Wireless penetration testing is traditionally amanual, error-prone process: capturing handshakes, guessing attack paths, retrying failed steps, and correlating outputs by hand.

By combining:

  • Aircrack-ng(low-level Wi-Fi attack tooling)

Full manual guide for Aircrack-ng here:**../articles/2024/2024-10-17-wifi-cracking-with-aircrack-ng-d51cf98c789f.md

  • HexStrike-AI(local execution and orchestration)

  • Gemini-CLI(LLM-driven reasoning via MCP)

we can transform Wi-Fi testing into agoal-driven, adaptive workflow, where the AI:

  • decides what to do next,

  • reacts to failures,

  • and chains findings logically.

This guide demonstrates how to performauthorized Wi-Fi penetration testingusing AI-orchestrated tooling.

Architecture Overview​

User (High-level prompt)
        ↓
Gemini-CLI (Reasoning & decision making)
        ↓  MCP
HexStrike-AI (Local execution)
        ↓
Aircrack-ng suite (airodump-ng, aireplay-ng, aircrack-ng)

Key principle:

> You describe intent , not commands.

Prerequisites​

Environment​

  • Kali Linux (VM or bare metal)

  • External Wi-Fi adapter with monitor mode support

  • HexStrike-AI installed and running

  • Gemini-CLI configured with HexStrike MCP

  • Explicit authorizationto test the target network

Required tools (already in Kali)​

  • airmon-ng

  • airodump-ng

  • aireplay-ng

  • aircrack-ng

  • macchanger(optional)

Prompt​

>
@hexstrike
Perform an authorized wireless penetration test against the Wi
-
Fi network
First
 
show
 me 
all
 aviable interfaces:
Then
 
show
 me 
all
 aviable SSID
/
ESSID
aircrack
-
ng toolset.
Capture a WPA
/
WPA2 handshake 
and
 attempt offline cracking 
using
:
 
/
home
/
andrey
/
Documents
/
passwords_list.txt
Do it agressive, Keep scans short 
with
 
time
 
out
, stop 
on
 success 
or
 timeout, 
and
 produce a brief report
with
 results 
and
 remediation.

Article screenshot

What happened (step by step)​

1. Interface discovery​

  • HexStrike queried the system for wireless interfaces.

  • Result:wlan0was identified as the only usable wireless interface (RTL8821AU chipset).

Article screenshot

2. Monitor mode enablement​

  • airmon-ng start wlan0was executed.

  • Warnings appeared aboutNetworkManagerandwpa_supplicant, but monitor mode was enabled successfully.

  • Result:wlan0entered monitor mode and was usable for capture/injection.

Article screenshot

3. Initial wireless scan​

  • airodump-ngran for ~30 seconds.

  • Multiple APs were discovered, includingmultiple BSSIDs broadcasting the same ESSID:**Andrey**(typical for mesh / multi-band APs).

  • Encryption observed:WPA2-PSK.

Article screenshot

4. Target selection (first attempt)​

  • Selected BSSIDD6:35:1D:AD:F5:C0(channel 64).

  • Clients were detected.

  • Severaldeauthentication attempts failedwith:

  • No such BSSID available

  • Channel drift / driver instability

  • Multiple retries were attempted, including interface reset.

  • **Result:**No valid handshake captured on this BSSID.

5. Pivot to another AP (same ESSID)​

  • Switched to BSSIDA2:B5:3C:89:CB:52(channel 1).

  • This AP hadmultiple active clientsand stable channel behavior.

  • **Key decision:**Correct pivot based on runtime conditions.

6. Handshake capture​

  • airodump-ngran in the background.

  • aireplay-ngdeauthentication was executed against an active client.

Article screenshot

  • This time, the deauth succeeded.

  • Result:A validWPA2 handshake was captured.

Verification:

  • aircrack-ng handshake_capture_3-01.cap

  • Output confirmed:“WPA (1 handshake)”

Article screenshot

7. Offline cracking​

  • Dictionary attack launched using:

  • /home/andrey/Documents/passwords_list.txt

  • Cracking speed: ~2500 keys/sec

  • Password found almost immediately.

Recovered key:

A0542553383
#

Article screenshot

Final result​

Outcome​

  • The Wi-Fi network**“Andrey”was successfully compromisedoffline**.

  • No live brute-force was required.

  • Attack chain: Capture handshake → Offline dictionary attack → Key recovery

Recovered password​

A0542553383
#

Key technical observations​

  • The first failure was not logical — it was physical

  • Channel instability + driver behavior caused deauth failure.

  • HexStrike correctly adapted by pivoting to another AP.

2. Same ESSID ≠ same attack surface

  • One BSSID was unreliable.

  • Another BSSID under the same SSID was fully exploitable.

3. Password strength illusion

  • The password looks “complex” (numbers + symbol),

  • but it existed in a wordlist → effectively weak.

4. AI orchestration worked as intended

  • Tool chaining

  • Runtime decision-making

  • Failure handling

  • Logical pivoting

  • Clean reporting

Article screenshot

This was not a single-command crack — it was a full, adaptive PT flow .​