9 WiFi Penetration Testing Tools Current for 2026 (WPA3-Ready)

Last updated: August 2026. Written by Josh Hutcheson, OnlineCourseing editor. Every tool below was checked for current maintenance status before publication — two of our previous nine were retired. See our review methodology.

QUICK VERDICT

Searches for “wifi penetration testing” mostly return methodology guides, not tool lists — and that split is informative. WiFi security testing is one of the few pentesting disciplines where the attack has changed shape in the last few years. The tools that defined the field for a decade — Aircrack-ng, Reaver, Cain & Abel — were built against WEP and early WPA, and WEP is now essentially extinct. What matters today is WPA2 and, increasingly, WPA3, and the tooling around them looks different.

This guide covers both: what wireless penetration testing actually involves, why WPA3 changes the standard playbook, and the tools that are still current in 2026 — with the two that are not documented rather than quietly dropped.

What wireless penetration testing involves

A wireless assessment tests three things that have nothing to do with the wired network behind them: whether the encryption protecting the network can be broken, whether a rogue access point can trick clients into connecting to it instead of the real one, and whether devices leak information — SSIDs they have previously joined, credentials, unencrypted traffic — simply by being nearby.

The standard sequence: put a wireless adapter into monitor mode so it captures all traffic in range rather than only traffic addressed to it, survey the area to identify targets and their encryption type, capture the handshake or identifier needed for offline cracking, then attempt to recover the key with a dictionary or mask attack. Everything downstream of the capture step happens offline, on hardware far more powerful than anything the target network can see — which is exactly why the capture step, not the cracking step, is where WPA3 changes the picture.

The phases of a wireless assessment

A wireless test moves through distinct, ordered phases, and skipping the order costs time rather than saving it — you cannot meaningfully attack a target you have not yet identified.

1. Passive reconnaissance. Put an adapter into monitor mode and listen without transmitting anything. Kismet is built for exactly this: it maps every access point, client and hidden network in range, and because it never sends a packet, nothing on the network has any way to notice the survey is happening.
2. Active scanning. Where passive listening leaves gaps — a network that only beacons rarely, or a client you need to interact with to fingerprint — active tools like airodump-ng or Bettercap probe directly. This is noisier and, unlike passive recon, detectable by anything watching for unusual wireless activity.
3. Capture. Grab what the crack stage needs: a PMKID via hcxdumptool where the AP offers one, or a 4-way handshake, forced with a deauthentication if necessary. This is the one step every offline attack below depends on.
4. Offline attack. Convert the capture with hcxtools and crack it with hashcat, entirely disconnected from the target and with no rate limit to worry about. This is also where WPA3-SAE breaks the pattern, since there is no equivalent offline artefact to walk away with.
5. Client-side and rogue AP testing. Independent of whether the encryption itself can be broken: can Wifiphisher or Bettercap trick a device into joining a network it should not trust, or a user into handing over credentials directly? This finds the weaknesses that no amount of strong encryption fixes.
6. Reporting. Which SSIDs were tested, what was recovered, how long it took, and what a defender should change — typically stronger passphrase policy, WPS disabled, and a move off WPA2-only where the hardware supports WPA3.

Why WPA3 breaks the old playbook

The Wi-Fi Alliance states plainly that “WPA3 is mandatory for Wi-Fi CERTIFIED devices,” and describes WPA3-Personal as delivering “increased protections from password guessing attempts” over WPA2. The mechanism behind that claim is the part most tool lists skip.

WPA2-Personal’s 4-way handshake is captured once and cracked entirely offline — an attacker gets one shot at the capture, then unlimited guesses against it on a GPU farm with no rate limit and no way for the network to notice. WPA3-Personal replaces that handshake with SAE (Simultaneous Authentication of Equals), sometimes called Dragonfly. SAE is designed so each guess requires a fresh interaction with the access point — there is no static handshake to walk away with and crack later, which removes the offline dictionary attack that made WPA2 crackable in the first place. A weak passphrase on a WPA3 network is still weak, but attacking it now means an online, rate-limited guess against a live device, not an offline batch job.

In practice this means most of the networks a tester encounters are still WPA2, or WPA3 running in transition mode alongside WPA2 for backward compatibility — and transition mode reintroduces the WPA2 attack surface. Genuine WPA3-only deployments are the case where the classic toolkit stops working, and that gap is exactly what pushed the field toward PMKID capture, covered next.

Common wireless vulnerabilities

Most wireless findings fall into a small number of recurring categories. Knowing them going in is what turns a tool run into a methodology.

The KRACK row is worth a second look because it is the exception to “WPA2 is fine, WPA3 is the future.” KRACK is a flaw in the WPA2 protocol itself — researchers describe it as tricking “a victim into reinstalling an already-in-use key” by manipulating the 4-way handshake — and while it has been patchable since 2017, the fix requires both the client and the access point to be updated. An unpatched device on a patched network, or the reverse, is still exposed. It is worth checking rather than assuming a 2017 vulnerability is irrelevant nine years later.

The client-probing row is easy to underestimate. A phone or laptop broadcasting the SSIDs it remembers is invisible to the user carrying it, which is precisely what makes it effective — the device does the trust decision automatically, before a person is ever prompted to approve anything. It is also why rogue-AP testing belongs in every wireless assessment even when the target network’s own encryption is genuinely strong: the client’s own history can undermine it regardless of what protocol the real network runs.

The 9 tools, current for 2026

Capture and key recovery

1. Aircrack-ng suite

The Aircrack-ng project describes itself as a “complete suite of tools to assess WiFi network security,” and it is still the entry point for most testers: airmon-ng puts an adapter into monitor mode, airodump-ng captures and can target a single access point by BSSID and channel to cut through noise on a busy site, aireplay-ng can force a deauthentication to speed up a handshake capture, and aircrack-ng itself does the cracking. Its dictionary-attack cracking against WPA/WPA2 still works and is well documented, but for anything beyond a small wordlist most testers now hand the capture to hashcat instead, which is dramatically faster on a GPU. Aircrack-ng also still fully supports WEP, which is worth knowing only because WEP is now rare enough in the wild that testing for it is mostly a compliance checkbox rather than a live threat.

2. hcxdumptool and hcxtools

This pair is the biggest gap in older versions of this guide, and the reason is that it is what made the PMKID attack practical. hcxtools is described in its own package listing as “tools for converting captures to use with hashcat or John the Ripper,” and its core utility explicitly handles PMKID and EAPOL conversion into hashcat’s format.

The PMKID attack matters because it does not require capturing a client’s handshake at all — many access points broadcast the PMKID (Pairwise Master Key Identifier) to any device that requests it, including a device that never actually associates. That removes the deauthentication step entirely, which was previously both the most detectable part of a wireless attack and the part most dependent on a client being active at the right moment. hcxdumptool captures it directly from the AP.

3. hashcat

hashcat is where the actual cracking happens once a PMKID or handshake has been converted. Its own documentation specifies hash mode 22000 (WPA-PBKDF2-PMKID+EAPOL) as the current mode for WPA/WPA2 attacks, replacing the older 2500/16800 modes that earlier guides still reference — if a tutorial tells you to use mode 2500, it predates the current hcxtools/hashcat pipeline. On GPU hardware, hashcat’s speed advantage over CPU-bound cracking in Aircrack-ng is not marginal; it is the reason the modern workflow is capture with hcxdumptool, convert with hcxtools, crack with hashcat, rather than doing all three in Aircrack-ng. Two attack modes matter most for a WiFi passphrase: a straight dictionary attack against a wordlist of likely passwords, and a mask attack, which brute-forces a defined pattern (eight digits, for instance, common on routers that generate a default numeric passphrase printed on a sticker). Knowing which mode fits the target before you start is the difference between a crack that finishes in minutes and one that never finishes at all.

4. Reaver

Reaver brute-forces the WPS PIN on routers that still have WPS enabled, and a recovered PIN yields the WPA/WPA2 passphrase regardless of its strength — which is what made WPS the preferred target on consumer routers for years. The original project has been dormant for some time; the actively maintained fork is t6x’s reaver-wps-fork-t6x on GitHub, which is also what ships in Kali. Its relevance has narrowed as vendors have restricted or disabled WPS by default, so check whether WPS is even enabled before reaching for this one — it is often not.

Reconnaissance, rogue APs and analysis

5. Bettercap

Kali describes Bettercap as “the Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.” For wireless work specifically it handles scanning, deauthentication and PMKID/handshake capture from a single interactive console, and its scope well beyond WiFi — Bluetooth Low Energy, ARP and DNS spoofing — makes it the tool testers reach for when an assessment is not purely wireless. It has a steeper learning curve than a single-purpose tool, which is the trade-off for that breadth.

6. Wifiphisher

Wifiphisher automates rogue access point attacks: it clones a target network, deauthenticates clients off the real one, and serves them a convincing captive portal designed to harvest the WiFi password or other credentials. This tests something the cryptographic attacks above cannot — whether users can be socially engineered into handing over credentials directly, which sidesteps encryption strength entirely. It is actively maintained and, notably, its approach is unaffected by whether the target network runs WPA2 or WPA3, since it never attacks the encryption at all — the Known Beacons technique covered in the vulnerabilities section below makes this even less dependent on the target’s own wireless configuration, since it exploits the client device’s own connection history rather than anything the access point does.

7. Kismet

Kismet is a purely passive wireless detector and intrusion-detection tool — it never transmits, which makes it the right choice for mapping an environment (access points, clients, hidden networks) without alerting anyone that a survey is underway. Its scope has grown well beyond WiFi into Bluetooth and other radio protocols, and it works with most adapters used for pentesting, though passive capture-only work still benefits from a card that supports monitor mode cleanly.

8. Wireshark

Wireshark is not wireless-specific, but every capture produced by the tools above eventually gets opened in it to inspect what actually happened — confirming a handshake was captured cleanly, checking whether a deauthentication frame landed, or examining what a rogue AP’s clients sent it. Learning its 802.11 display filters is what turns a raw capture into an answer.

9. OmniPeek

OmniPeek, now sold by LiveAction, is a commercial network and wireless analysis platform aimed at enterprise troubleshooting and compliance work rather than offensive testing — think WLAN performance and spectrum analysis dashboards rather than a cracking tool. It earns a place here because larger organisations doing continuous wireless monitoring often already own it, and it can complement a pentest by showing what the network’s own visibility tooling would or would not have caught during the engagement. Its distinguishing feature next to the open-source tools above is spectrum analysis — identifying non-WiFi interference (microwave ovens, cordless phones, Bluetooth congestion) that degrades a network independently of any security issue, which is a class of problem none of the offensive tools in this guide are built to diagnose. It is not the tool to reach for as an individual tester; it is quote-only and licensed at an enterprise scale.

Two tools we removed, and why

Both appeared in our previous version of this guide. Both are still recommended on other sites. Neither should be, for the same reason: they target encryption that has been obsolete for years.

One tool from the old list survived with a caveat rather than a removal: coWPAtty, Kali’s own listing for which reads “brute-force WPA dictionary attack” against WPA/WPA2-PSK using a captured handshake. It still works, but it is functionally superseded by the hcxtools-to-hashcat pipeline above — hashcat on a GPU will out-crack it on anything but a tiny wordlist, so we have folded it out of the main nine rather than counting it twice.

Is it legal to test a wireless network?

Installing these tools is legal. Capturing, deauthenticating, or attempting to crack the credentials of a network you do not own or have written permission to test is not, and wireless testing carries a wrinkle wired testing does not: signals cross property lines. A deauthentication attack aimed at your test network can disrupt a neighbouring network you were never authorised to touch, and in the US the FCC has taken enforcement action against organisations that jammed or disrupted WiFi outside their own scope. In the United States the relevant statute for unauthorised access is the Computer Fraud and Abuse Act; the United Kingdom has the Computer Misuse Act 1990.

A written, signed scope that names the specific SSIDs and physical premises in bounds is not optional here the way it might feel for a purely digital test — the physical range of a signal is not something a scope document can fully contain, so agree on it explicitly rather than assuming. To practise, build a lab access point you control rather than testing anything you can merely see from your window. Our network pentesting checklist covers scoping in more detail.

How to learn wireless pentesting

Start with the modern pipeline, not the historical one: get comfortable putting an adapter into monitor mode, capture a PMKID with hcxdumptool against a network you control, convert it with hcxtools, and crack it with hashcat. Once that loop makes sense, the older Aircrack-ng-only workflow is easy to pick up as a variant rather than a separate skill. A cheap USB adapter with confirmed monitor-mode and injection support matters more than any single piece of software here — check compatibility before buying, since many built-in laptop cards do not support it, and confirming that ahead of an engagement is far cheaper than discovering it on-site.

• Best penetration testing courses — hands-on training that covers wireless alongside web and network testing.
• Best Kali Linux tools — every tool above ships in Kali by default or via a single package install.
• Network pentesting checklist — where wireless testing fits into a broader network assessment.
• Best cyber security courses — the foundation employers hire for.

Compare Penetration Testing Courses →

Choosing a wireless adapter

Every tool in this guide is limited by the adapter underneath it. Most laptops’ built-in WiFi chipsets do not support monitor mode, packet injection, or both — and a tool cannot capture what the hardware will not let it capture, regardless of how current the software is.

Aircrack-ng maintains its own hardware compatibility guidance, and its current recommendation is specific rather than generic: the Alfa AWUS036AXML (a/b/g/n/ac/ax, WiFi 6E) as “the best performing card, with a stable driver,” with the AWUS036AXM close behind, “reported as a bit less sensitive.” For anyone on an older or more stable kernel, the project names the AWUS036ACM as “the highest performing of the STABLE devices, but it requires kernel 4.19.5 or higher” — worth checking before assuming the newest adapter is automatically the right one for your setup.

A few things to confirm before buying anything: monitor mode support alone is not enough — attacks like handshake capture also need injection support, and a card can offer one without the other depending on its driver. USB adapters are the practical default over an internal card, since they can be swapped between a laptop and a virtual machine without touching internal hardware, and a virtualised Kali install needs the adapter passed through directly rather than relying on the host OS’s own WiFi stack. Budget MiniPCIe options built around Atheros ath9k chipsets remain a well-supported, low-cost path into monitor mode if a USB adapter is not available, though they lack the WiFi 6E range of the current Alfa cards.

Frequently asked questions

Can WPA3 be cracked the same way as WPA2?

No. WPA2’s 4-way handshake can be captured once and cracked offline with unlimited attempts. WPA3-Personal replaces it with SAE, which requires a fresh interaction with the access point for every guess, turning the attack into a slow, detectable, online process instead of a fast offline one. Many networks run WPA3 in a transition mode alongside WPA2 for compatibility, and that mode still carries the WPA2 attack surface — check which mode is actually running before assuming WPA3 protects a network completely.

What is a PMKID attack and why does it matter?

The PMKID is broadcast by many access points to any device requesting it, without needing a client to be connected or a deauthentication attack to force a handshake. Capturing it with hcxdumptool and converting it with hcxtools for hashcat removes the most detectable, client-dependent step from the classic attack, which is why it has largely replaced handshake capture as the default first move.

Is Aircrack-ng still worth learning in 2026?

Yes, as the foundation, even though the current cracking workflow has moved on to hashcat for speed. Aircrack-ng’s airmon-ng and airodump-ng are still how most testers put an adapter into monitor mode and capture traffic in the first place; hashcat only enters once you already have a capture to convert.

Do I need special hardware for wireless pentesting?

A wireless adapter that supports monitor mode and packet injection, which many built-in laptop cards do not. A USB adapter with a chipset known to support both is a modest, worthwhile purchase before you need to rely on it during an engagement. Beyond that, the cracking stage benefits from a capable GPU if you are running hashcat locally rather than in the cloud.

Should I still test for WEP?

Rarely, and only if the scope specifically calls for it — WEP has been considered fundamentally broken for two decades and is rare in any environment that has been touched in the last several years. If it does turn up, Aircrack-ng handles it without needing a dedicated tool like Airsnort.

Is it legal to deauthenticate devices during a test?

Only with explicit written authorisation covering the specific network and premises, and even then with care — deauthentication signals do not respect property boundaries the way a scoped web application does, and disrupting a neighbouring network you were never authorised to touch is a real risk regulators have acted on. Agree the physical scope, not just the SSID, before testing.

The bottom line

Learn the current pipeline — monitor mode, PMKID capture with hcxdumptool, conversion with hcxtools, cracking with hashcat — before the historical, WEP-era toolkit; the historical version is a smaller variant of the same skill, not a separate one. Add Bettercap or Wifiphisher when the engagement calls for reconnaissance breadth or a social-engineering angle, and treat WPA3 as a real change in what “crackable” means rather than a checkbox to tick past. Confirm adapter compatibility before every engagement, not once at the start of your career — drivers and firmware move, and a card that supported injection two kernel releases ago is not guaranteed to still work today.

Related reading: Kali Linux tools · penetration testing tools · network pentesting checklist · network security threats · best penetration testing courses · penetration testing methodology

Related guides

Most wireless capture work happens from a laptop — see pentest tools for Windows for what runs natively on Windows and what needs a Linux VM. For web targets, see web application pentesting tools.