Wifite: Auditing WPA/WPA2 Wireless Networks from the Command Line

Wireless networks are among the most common entry points in security assessments, yet auditing them by hand is slow and error-prone — monitor mode, channel sweeps, and frame capture demand a long chain of commands. Wifite removes most of that friction. It is an automated wireless auditing tool that wraps the aircrack-ng suite and other proven utilities into a single menu-driven workflow, taking a tester from scan to attack in minutes. This guide covers how Wifite works, how to install and run it, and what its results mean for your network. Wifite is an offensive tool; use it only against networks you own or have written authorization to test.

What Wifite Is and How It Works

Wifite is an open-source Python script that automates the attacks most commonly performed during wireless penetration tests. It does not replace tools such as aircrack-ng, Reaver, or hashcat; it orchestrates them, placing a compatible interface into monitor mode, scanning for access points and clients, and running the attack appropriate to the encryption it finds. Wifite sweeps every channel and presents a sorted list of access points with signal strength and encryption type. When you select a target, the tool adapts: for WEP networks it collects initialization vectors until a statistical attack can recover the key; for WPA networks it sends deauthentication frames to force a client reconnect and captures the four-way handshake; for WPS-enabled networks it attempts PIN recovery. Captured handshakes, PMKIDs, and IV streams are saved to disk and passed to a cracking tool, usually aircrack-ng for WEP and hashcat for WPA.

The real value is consistency: steps a tester would otherwise need to remember, type correctly, and repeat for each target are automated — useful for broad internal audits and re-testing after infrastructure changes.

Wifite is a dual-use tool. Running it against a network you do not own, without written permission, is illegal in most jurisdictions.

Key Features of Wifite

• Automated WEP attacks. Wifite drives the full WEP cracking cycle, from IV collection to statistical key recovery — useful when legacy hardware still runs the obsolete protocol.
• WPA handshake capture and cracking. Wifite deauthenticates a connected client, captures the WPA four-way handshake, and runs a dictionary attack against it, with optional handoff to hashcat for GPU-accelerated cracking.
• WPS PIN recovery. For networks with Wi-Fi Protected Setup enabled, Wifite tries the offline Pixie Dust attack first, then falls back to online PIN brute forcing through Reaver or Bully.
• PMKID capture. The --pmkid option obtains a WPA2 hash from the access point directly, with no client connected.
• Menu-driven targeting. Targets are sorted by signal strength and filtered by encryption type, so one command covers most scenarios.

Installing Wifite

Wifite ships with Kali Linux and most Debian-based security distributions:

sudo apt update
sudo apt install wifite

On other systems, clone the maintained repository and run the script directly:

git clone https://github.com/kimocoder/wifite2.git
cd wifite2
sudo pip install -r requirements.txt
sudo python3 Wifite.py

Wifite depends on external tools it calls under the hood: the aircrack-ng suite, tshark for packet parsing, and Reaver or Bully for WPS attacks; hcxdumptool and hashcat handle PMKID capture and GPU-accelerated WPA cracking. You also need an adapter that supports monitor mode and packet injection — built-in laptop radios are unreliable for injection, so an external USB adapter is recommended. See our guide to the best wireless adapters for security testing.

Running Wifite Step by Step

The plain command launches the interactive workflow:

sudo wifite

From there, Wifite walks through these stages:

1. Interface selection. Wifite lists detected wireless interfaces and places the chosen one in monitor mode. With multiple adapters, specify one with -i, for example -i wlan0mon.
2. Scanning. The tool sweeps all channels and lists nearby access points. Press Ctrl+C to stop the sweep and freeze the target list.
3. Target selection. Enter the number of one target, or a comma-separated list to attack several in sequence.
4. Attack and capture. For WPA targets, Wifite sends deauthentication frames to force a reconnect and captures the handshake to a .cap file.
5. Cracking. Captured material is cracked automatically — supply a wordlist with --dict, or Wifite falls back to its built-in lists.

Three targeted invocations cover most engagements — WPA networks with a custom wordlist:

sudo wifite --wpa --dict /usr/share/wordlists/rockyou.txt

Grab PMKIDs without waiting for clients:

sudo wifite --pmkid

WPS implementations, starting with the offline Pixie Dust attack:

sudo wifite --wps --pixie

Two flags help before the first run: --kill stops network-manager and other processes that interfere with monitor mode, and -c N limits scanning to one channel. If an online WPS PIN brute force becomes necessary, expect it to be slow by design: the WPS protocol validates each half of the eight-digit PIN separately, shrinking the maximum search space from ten million combinations to roughly 11,000 attempts — still hours against a live network, which is why Pixie Dust runs first.

Practical Guidance for Authorized Testing

Wifite answers one question: how easily could an attacker break into your wireless network? Use it inside a disciplined process.

• Get authorization in writing. Define which SSIDs, channels, and time windows are in scope, and schedule tests for maintenance windows — deauthentication briefly knocks clients offline.
• Reconnoiter first. Passive tools such as Kismet map channels, clients, and neighboring networks before any active attack — see our guide to wireless reconnaissance with Kismet.
• Keep evidence. Save .cap files, PMKIDs, and screen output as proof for the report and an audit trail.
• Act on results. A recovered passphrase is the start of remediation, not the end of the test. Fix the weakness, then re-test to confirm.

When Wifite succeeds, remediation is usually straightforward. Disable WPS on every access point unless a business requirement demands it; WPS remains one of the most reliable ways into an otherwise hardened network. Eliminate WEP entirely and ensure WPA2 networks use AES-CCMP, never TKIP. Enforce passphrases of 20 or more characters that do not appear in public wordlists, and enable 802.11w protected management frames where supported to blunt deauthentication attacks. Segment guest and IoT devices onto separate SSIDs and VLANs so a compromised device cannot reach production systems.

When Wifite Is Not Enough

Wifite automates the common attack paths, but it is not the final word in wireless testing. When automated attacks fail, manual work takes over: aircrack-ng offers fine-grained control over injection and capture, and hashcat supports rules and masks far beyond a plain dictionary attack. If you prefer another automated option with a graphical interface, Fern WiFi Cracker covers similar ground — our guide to Fern walks through it. Wifite also tests only the radio and authentication path: networks with 802.1X, client isolation, and wireless intrusion detection need a broader assessment than any single tool provides.

Conclusion

Wifite earns its place in the wireless auditor’s toolkit by turning an error-prone manual process into a reliable, repeatable workflow. It automates WEP, WPA, and WPS attacks from monitor mode to cracking, without sacrificing the power of the tools underneath. The boundary is non-negotiable: test only networks you are authorized to test. Within that boundary — followed by genuine remediation of every weakness it exposes — Wifite is one of the fastest ways to answer the question every security team should ask: how easy is our wireless network to break?