AirScope: I Got Sick of Typing airmon-ng at 2AM, So I Built a Robot to Do It (Wifi Hacking 2026).

⚠️ Heads up: AirScope is still in dev. Rough edges everywhere. Bugs I know about, bugs I don't. This is a build log, not a product launch.

Every WiFi assessment, same routine. airmon-ng, then airodump-ng, then squint at a wall of green text, then aireplay-ng, then hcxdumptool, then switch to Wireshark to actually read the RSN tag, then back to the terminal for wash, then hashcat if I'm lucky.

Seven tools. Seven terminal tabs. One tired me, fat-fingering aireplay-ng for the fourth time that week.

So I built the thing that does it for me. AirScope. Here's what it does, screen by screen.

Step 1: The Hardware

Not every WiFi chipset can listen to the air. Most are built to talk to one network and ignore everything else. You need the right chip, in monitor mode.

Also — don't put your only radio into monitor mode, or you lose internet mid-test. Keep the laptop's built-in card on a real network and point the USB stick at everything else.

Step 2: Setup Check

First screen of AirScope. No scanning yet — just a sanity check. Am I root? Are all the underlying tools where they should be? Which adapters can go into monitor mode?

One click on Enable Monitor runs airmon-ng start wlan1 for me. Nothing new, just one less thing to typo at 11pm.

Step 3: Listening to the Air

Here's the part that still gets me. Point the adapter at empty air, and the air starts talking.

Twenty-six access points. Twenty-five clients. Nobody connected to anything, nobody tapped a button. Every WiFi device in range is broadcasting itself ten times a second, assuming nobody's listening.

My own test network is sitting there on channel 6, highlighted, waiting its turn.

Step 4: Risk Scoring

A raw list of 26 networks tells me nothing. The next screen scores every single one based on what's already visible in the beacon — open encryption, weak cipher, WPS left on.

My target is in green, selected, ready to promote. Everything else stays untouched — it isn't in my engagement scope and the tool makes sure I don't accidentally forget that.

Step 5: Passive Audit (Zero Attacks Sent)

Favorite screen in the whole app. Passive Audit runs 14 separate checks against the target and transmits exactly zero attack frames. It reads beacons. Sends one tiny clientless probe. That's the whole budget.

One finding came back warm: the network isn't protecting its own management messages. In English — anyone nearby can tell any device on this network to disconnect, and the network has no way to tell the real signal from the fake one. The other 13 checks came back clean.

Caught in under a second. Used to take me ten minutes in Wireshark.

Step 6: Attack Mode — 14 Modules

This is where it gets loud. 14 different ways to pick on a WiFi network, each one a thin wrapper around a real underlying tool.

Here's what each one actually does, in plain words:

· Deauthentication — forge a "disconnect" message, send it to a target. Their device believes it. Repeat as needed.

· Handshake Capture — kick a device off, wait for it to reconnect, record the four little messages exchanged during reconnect. Those messages hide a fingerprint of the password.

· Offline Handshake Cracking — take that fingerprint, run millions of password guesses against it until one fits.

· WPS Attack — if that "push the button to connect easily" feature is still enabled, the 8-digit PIN can be guessed in roughly 11,000 tries.

· Evil Twin AP — stand up a second network with the exact same name as the real one. Devices get confused.

· Captive Portal — Evil Twin plus a fake login page. We'll come back to this. It's the mean one.

· Rogue Access Point — open network, tempting name ("Free Airport WiFi"). Wait. People come.

· PMKID Extraction — shortcut version of handshake capture. No reconnect needed; some routers hand over the fingerprint just for asking.

· KRACK — a real, named flaw (CVE-2017–13077) in how WiFi handshakes work. Still unpatched on a worrying number of devices.

· Hole196 — a device already on the network messing with the other devices on it. Insider move.

· Enterprise Evil Twin — same trick, but aimed at the corporate WiFi setups with username and password logins.

· EAP Downgrade — nudges a device into using a weaker login method, then cracks the weaker method.

· PEAP Relay — intercepts a corporate login mid-air, forwards it to the real server, keeps a copy.

· EAP Credential Crack — the "take it home and crack it later" version of the above.

Every single one of these hits a locked door first:

A checkbox. Every run. Not once per session. Not "trust me." Every single time.

Step 7: 40 Seconds to a Handshake

Checkbox ticked. Handshake Capture running. Here's the log:

[+] Target BSSID=08:97:58:3B:69:4E CH=6 iface=mon0 [] t+1s deauth broadcast [?] t+15s no handshake yet [] t+40s deauth broadcast [?] t+40s HANDSHAKE PRESENT [+] Handshake captured.

Forty seconds. A nearby device got the "disconnect" signal, reconnected on its own because that's what phones do, and AirScope caught the four messages the instant they crossed the air.

Step 8: The Password Was 12345678

Handshake in hand, one click sends it to Offline Password Cracking — aircrack-ng against a wordlist, with the capture path and BSSID already filled in.

Password cracked: 12345678. I set that one myself for the test, but that's exactly the point. An 8-digit, all-numeric password doesn't need a nation-state. It needs a coffee break and a wordlist everyone's had since 2009.

Step 9: Becoming the Network

Last one. Captive Portal. No cracking — I just become the network, and let the user hand me the WiFi password.

Here's the full idea in one breath: I spin up a fake WiFi network with the exact same name as the real one. Any nearby device sees two networks called "Wifi Testing" and doesn't know which one is real — it just picks the one with the stronger signal, which is mine. The moment the user tries to connect, I throw a login page at them that looks like a normal "sign in to WiFi" screen. They type in the WiFi password (the password to the real network) because they think they're reconnecting. I write it down. Done.

Under the hood, AirScope broadcasts an SSID with the exact same name. Then it lies to the device about where every website lives. google.com? Me. Any address the device asks for? Me. Every page the device tries to load lands on my fake login page.

And on the test device itself, the whole trick looks like this:

A login box. Says "secured connection" at the bottom, which is a lie the phone just believes. The user types in the WiFi password — the same password they type into the real network every day — and sends it straight to me.

Two flavors of this attack in AirScope:

· Captive Portal — plain version, for a home or shared WiFi where everyone types the same password.

· Enterprise Evil Twin + Captive Portal — the corporate version, where WiFi logins are a username and password per person. The portal collects those instead.

Nobody got hacked. Nobody got breached. Someone just typed the WiFi password into what looked like a normal login screen. That's the whole attack.

Why I Built It

The old tools aren't bad. aircrack-ng, hcxdumptool, hostapd, reaver — all excellent, and AirScope just drives them. But somewhere around assessment number thirty, the bottleneck stopped being knowledge and became typing speed and short-term memory.

A tool can't make you understand why WiFi is fragile. But it can delete the seven terminal tabs between knowing and proving.

It's a dev build. It's rough. Half the modules work great, the other half I'm still fixing. But it already saves me an hour per assessment, and I built it in a weekend.

If you need tool link just comment.