Tools

The classic WiFi security auditing suite — packet capture, deauthentication and injection, and WEP/WPA-PSK key cracking, in one tightly integrated toolset.

airmon-ng start wlan0\nairodump-ng wlan0mon\naircrack-ng -w rockyou.txt capture.cap

Menu-driven bash wrapper that ties together aircrack-ng, hcxtools, hostapd and other utilities into one guided Wi-Fi auditing workflow (handshake capture, WPS, evil twin, DoS).

sudo bash airgeddon.sh

A Swiss-army-knife framework for network attacks and monitoring — MITM, WiFi/BLE reconnaissance and attacks, and a scriptable, extensible core.

sudo bettercap -iface eth0

Lightweight BLE scanner for quickly enumerating nearby devices and their advertised services/characteristics from the command line, without a full GATT client.

bleah -t 5 -v

Bluetooth (Classic + BLE) device discovery service that logs and fingerprints everything it sees over time, aimed at long-running physical-security/asset-tracking style monitoring.

sudo blue_hydra

The interactive control shell shipped with Linux's BlueZ stack — scanning, pairing and GATT inspection without installing anything extra, and the first thing to reach for before pulling out dedicated BLE tooling.

bluetoothctl
[bluetooth]# scan on
[bluetooth]# devices
[bluetooth]# gatt.list-attributes <MAC>

Bluetooth reconnaissance framework covering Classic, LE and (some) mesh/Zigbee-adjacent radios in one CLI, aimed at building a fuller picture than a single-mode scanner.

bluing le scan

BLE sniffing and hijacking toolkit (needs a couple of cheap nRF51-based dongles) that can follow, jam and even take over an existing BLE connection.

btlejack -s

C reimplementation of the WPS brute-force PIN attack (an alternative to Reaver with different timing/retry behaviour against flaky APs).

bully -b AA:BB:CC:DD:EE:FF wlan0mon

Cracks the BLE Legacy Pairing key exchange from a captured connection and decrypts the traffic — the classic demonstration of why "Just Works" BLE pairing is not actually secure.

crackle -i capture.pcap -o decrypted.pcap

Targeted rogue-AP toolkit for attacking WPA2-Enterprise networks — evil twin EAP portals to harvest credentials or relay them, plus PMKID/handshake capture for the WPA2-PSK case.

./eaphammer -i wlan0 --channel 6 --auth wpa-eap --essid CorpWiFi --creds

Pocket multi-tool for RF/RFID/NFC/infrared/iButton with a Dolphin-themed UI — reads, emulates and replays sub-GHz, 125kHz LF and 13.56MHz HF tags, plus GPIO for basic hardware hacking.

Node.js BLE MITM/impersonation toolkit — scans and clones a target device's GATT profile so a fake peripheral can sit between a phone app and the real hardware.

node scan.js

Captures WPA/WPA2 handshakes and PMKIDs straight off the air (including from clientless APs) without needing a connected station to deauth.

sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

Converts hcxdumptool/airodump-ng captures into hashcat/John-crackable formats (22000, PMKID) — the modern replacement for the old cap2hccapx pipeline.

hcxpcapngtool -o hashes.22000 capture.pcapng

Official Kali Linux mobile penetration testing platform — runs a Kali chroot/rootfs alongside Android, with wireless injection support and NetHunter-specific apps on compatible devices.

A wireless network and device detector, sniffer and WIDS framework — covers WiFi, Bluetooth, and SDR-fed protocols well beyond what aircrack-ng alone monitors.

kismet -c wlan0

Community custom firmware for Flipper Zero focused on stability and quality-of-life features on top of the official stack (more protocols, UI tweaks, plugin support).

Nordic Semiconductor's free Android/iOS app for scanning BLE advertisements and browsing/writing GATT services and characteristics by hand — the everyday tool for poking at a smart-device's Bluetooth surface.

Offline WPS PIN recovery from a single handshake exchange (the "pixie dust" attack) against APs with weak random-number generation, instead of an online brute force.

pixiewps -e <PKE> -r <PKR> -s <E-Hash1> -z <E-Hash2> -a <Authkey> -n <E-Nonce>

netsh (built into every Windows install) will export every remembered WiFi profile with its cleartext key in one loop — a fast post-compromise wireless-credential grab.

netsh wlan show profiles | ForEach-Object { if ($_ -match "All User Profile\s*:\s(.+)") { netsh wlan show profile name="$($matches[1])" key=clear } }

The original online WPS PIN brute-forcer, kept alive as a community fork after the upstream project went unmaintained; still the reference implementation the WPS attack is named after.

reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

Open-source USB Bluetooth (Classic and BLE) monitoring hardware plus its host tools, for sniffing and following connections that a normal Bluetooth adapter's firmware hides.

ubertooth-btle -f -c capture.pcap

Hak5's dedicated rogue-AP/MITM hardware appliance — recon, karma/evil-twin attacks and traffic capture through a web dashboard and a modules ecosystem, built for field engagements.

Rogue access point framework built around social-engineering captive portals (fake firmware upgrade, router config pages) rather than brute-forcing the handshake.

sudo wifiphisher -aI wlan0 -jI wlan1 -p firmware-upgrade

Python rewrite of the "point it at every visible network" Wi-Fi auditing wrapper — automates monitor mode, handshake/PMKID capture and WPS attacks via aircrack-ng/hcxtools/reaver/bully.

sudo wifite --dict /path/to/wordlist.txt
# target one BSSID only:
sudo wifite -e "Target-SSID" --dict wordlist.txt

Crowd-sourced database and search engine of wireless networks (Wi-Fi, Bluetooth, cellular) mapped by GPS location, built from years of wardriving submissions.

Feature-maximalist community custom firmware for Flipper Zero — bundles extra sub-GHz frequencies/protocols, apps and unlocks beyond what the stock firmware ships.