airgeddon is an open-source bash script, free to use, that audits wireless networks by driving other Linux wireless tools through a menu-based command-line interface. It is aimed at penetration testers and wireless auditors rather than casual users, since it assumes a compatible wireless adapter and a working Linux setup rather than installing one for you. Its scope covers WPAWPAA Wi-Fi authentication and encryption standard maintained by the Wi-Fi Alliance, replacing WEP; cyber tools target it to audit wireless network credentials and key exchange handshakes./WPA2/WPA3WPA3The third generation of the Wi-Fi Protected Access authentication and encryption standard, maintained by the Wi-Fi Alliance, offering stronger handshake protection and per-session encryption compared to WPA2. handshake and PMKIDPMKIDA 128-bit identifier derived from a PMK, the access point MAC, and the client MAC in WPA2 handshakes, allowing offline cracking of Wi-Fi passwords without capturing a full four-way handshake. capture, WPA-Enterprise identity and certificate capture, WEP cracking, evil twin captive portal attacks, and deauthentication, with a plugin system for extending attack menus rather than pointing to a single comparable product. Development is active: it started in 2016, has drawn 66 contributors, and shipped 90 releases in the tracked window, the latest 39 days ago, with recent work adding WPA3 downgrade attacks and 6 GHz adapter support.
airgeddon is a multi-use bash script for Linux systems to audit wireless networks.
Which nearby networks are actually vulnerable to a handshake or PMKID capture instead of just visible?
walks the chosen adapter through a scan of the surrounding networks, then drives the capture tools against the target and reports back a captured handshake or PMKID file for offline cracking
Can this WPA3 network be forced down to a weaker handshake I can attack?
launches a downgrade attack against WPA2/WPA3 Transitional networks so a WPA3-only target falls back to a mode whose handshake can be captured
Will a captive portal actually get a user's credentials on this network?
stands up an evil twin access point with a captive portal page, shows in real time whether the connected client reached the portal and whether they are still on the network, and hands back whatever was submitted
Is this WPA-Enterprise network exposed through its identities or certificates?
captures the identity exchange and certificates presented during WPA-Enterprise authentication and runs certificate analysis over what was captured, flagging which fields identify the network's weaknesses
Which of my adapters can actually run these attacks on 6 GHz or newer standards?
detects the connected adapter's supported standards and 6 GHz capability at startup and only offers the scans, attacks, and fake-AP options that adapter can support
Did the deauthentication attack actually knock the target client off the network?
shows live detection of whether the targeted client is still present after the deauthentication attempt, rather than assuming it worked once the attack is sent
English, Arabic, Catalan, Chinese (Simplified), French, German, Greek, Italian, Polish, Portuguese, Russian, Spanish, Turkish
Release notes: English, Arabic, Catalan, Chinese (Simplified), French, German, Greek, Italian, Polish, Portuguese, Russian, Spanish, Turkish
Chinese (Simplified) added in v11.21 (Sep 13, 2023) · Arabic added in v10.30 (Oct 17, 2020) · Turkish added in v8.11 (Aug 21, 2018) · German added in v8.01 (Mar 31, 2018) · Polish added in v7.23 (Dec 2, 2017)
Features
23 capabilities
Built from airgeddon's releases, docs, README and our own runs.
“Seen” marks the month we first spotted a release the vendor didn't date.
Group names and tags are our labels.
+Toolchain and environment compatibilityshippedManages configuration, detects operating systems and chipsets, verifies dependencies like hashcat and X window, and supports persistent settings.28 releases · 1 other source · first seen Sep 2017▸
release
28 total
Adds iptables/nftables NAT support validation, extending compatibility to systems using the modern nftables firewall framework.
v12.02 · Sep 2026
· source
· release history
Improves internet interface validation for VPN compatibility.
v11.61 · Jan 2026
· source
· release history
Adds automatic detection of Virtual Machine environments at startup.
v11.61 · Jan 2026
· source
· release history
Extends compatibility to Puppy Linux and CachyOS Linux
v11.51 · Aug 2025
· source
· release history
Adds consistent network device naming detection check upon interface selection
v11.20 · Jun 2023
· source
· release history
Improves graphics system and resolution detection for better UI adaptation on various displays
v11.11 · Mar 2023
· source
· release history
example
Run airgeddon and rely on the new detection check when selecting network interfaces to ensure consistent naming.$ airgeddon
v11.20 · Jun 2023
· source
+Evil Twin attack modesshippedExecutes Evil Twin attacks using captive portals or BeEF/sslstrip2 exploitation frameworks with optional internet access or DNS tricks.18 releases · 2 other sources · first seen Sep 2017▸
release
18 total
Improves Evil Twin stability by forcing NetworkManager to terminate before the fake AP launches when enabled.
v12.01 · Jul 2026
· source
· release history
Modifies lighttpd web server configuration during Evil Twin captive portal attacks to enable plugin integration
v11.60 · Nov 2025
· source
· release history
New option to disable ESSID stripping during Evil Twin attacks, preserving the full network name.
v11.52 · Sep 2025
· source
· release history
Adds ESSID stripping using invisible characters to bypass Apple SSID grouping in Evil Twin attacks
v11.51 · Aug 2025
· source
· release history
Improves captive portal HTML and JS to work inside Apple CNA (Captive Network Assistant), capturing credentials from iOS/macOS clients
v11.51 · Aug 2025
· source
· release history
Evil Twin fake APs now advertise 802.11n/802.11ac/802.11ax capabilities when the adapter supports them
v11.50 · Jun 2025
· source
· release history
example
Configure the optional advanced captive portal with vendor logos during an Evil Twin attack setup.$ airgeddon --eviltwin
v11.20 · Jun 2023
· source
Capture a wireless handshake and save it in the hccapx format for use with modern hashcat versions.$ ./airgeddon.sh -w <interface> ... (capture) -> check output directory for .hccapx file
v7.11 · Sep 2017
· source
+Offline password decryption and crackingshippedPerforms dictionary, brute-force, and rule-based attacks on captured handshakes using integrated aircrack-ng or external cpu hashcat.13 releases · 1 other source · first seen Sep 2017▸
Also counts toward: Offline mode
release
13 total
Supports Handshake and PMKID hashcat hash files in the personal offline decryption menu
v11.60 · Nov 2025
· source
· release history
Improves hashcat usage by forcing -m 22000 for handshake cracking on modern versions
v11.02 · Aug 2022
· source
· release history
Improvement hashcat use forcing it to use -m 22000 instead of old -m 2500 over handshakes cracking for hashcat modern versions
11.02 · Aug 2022
· source
· release history
Adds GPU support for hashcat to accelerate WPA handshake cracking
v11.0 · Jan 2022
· source
· release history
Changes default PMKID hash format to use hashcat mode 22000 instead of 16800.
10.31 · Dec 2020
· source
· release history
Replaces deprecated hcxpcaptool with hcxpcapngtool for PMKID hash extraction.
10.31 · Dec 2020
· source
· release history
example
Access the new feature to generate WPS pins offline using a database.$ Run airgeddon and navigate to the menu option: 'WPS offline PIN generation and database'
v7.22 · Oct 2017
· source
+WPA3 assessmentshippedProvides WPA3-targeted capabilities including MFP status analysis and a dynamic plugin menu for flexible WPA3 attack workflows.12 releases · 1 other source · first seen Sep 2017▸
Also counts toward: Plugin system
release
12 total
Adds WPA3 MFP (Management Frame Protection) status analysis feature for targeted WPA3 assessments.
v12.01 · Jul 2026
· source
· release history
Adds dynamic WPA3 plugin menu options without fixed slots, enabling flexible WPA3 attack menu composition.
v12.01 · Jul 2026
· source
· release history
Adds dynamic WPA3 plugin menu options without fixed slots, enabling flexible plugin-driven WPA3 attack workflows.
v12.01 · Jul 2026
· source
· release history
Expands WPA3 menu to support additional WPA3 plugins.
v11.61 · Jan 2026
· source
· release history
Adds downgrade attack against WPA2/WPA3 Transitional (Mixed Mode) networks in the WPA3 menu
v11.60 · Nov 2025
· source
· release history
Adds a WPA3 attacks menu exposed as a hookable function to enable WPA3 support in existing plugins.
v11.52 · Sep 2025
· source
· release history
example
Identify the WPS implementation version of a target network to determine compatible attack vectors.$ # In the standard or WPS network selection menu, look for the WPS Version field next to each network entry
v11.22 · Feb 2024
· source
+Wi-Fi band context displayshippedShows the active Wi-Fi band (2.4 GHz, 5 GHz, or 6 GHz) across Evil Twin, WEP, and WPS attack interfaces as well as trophy files.8 releases · 2 other sources · first seen Sep 2017▸
release
8 total
Adds band data display to Evil Twin and WEP control windows, WPS attacks, and trophy files for richer target context.
v12.01 · Jul 2026
· source
· release history
Displays band data (2.4 GHz / 5 GHz / 6 GHz) in Evil Twin and WEP control windows, WPS attack screens, and trophy files for clearer session context.
v12.01 · Jul 2026
· source
· release history
Adds 6 GHz partial support: some scans, some attacks, capable adapter detection, option toggle, and validations.
v12.0 · May 2026
· source
· release history
Shows the WPS version (e.g., 1.0, 2.0) in the network selection menu specifically for WPS-enabled networks
v11.22 · Feb 2024
· source
· release history
Adds filters enabled on scannings based on menu or kind of attack
v8.01 · Mar 2018
· source
· release history
Added 5Ghz full support (scans, attacks, card detection, etc.)
v8.0 · Feb 2018
· source
· release history
example
Initiate a custom Evil Twin attack where airgeddon handles the AP creation and credentials harvesting, while an external tool like Wireshark captures the raw traffic.$ # Launch airgeddon, select the new 'Evil Twin' option from the menu, # then specify the external sniffer binary path (e.g., /usr/bin/wireshark) # in the configuration prompt to link the tools.
v4.0 · Sep 2017
· source
Capture a wireless handshake and save it in the hccapx format for use with modern hashcat versions.$ ./airgeddon.sh -w <interface> ... (capture) -> check output directory for .hccapx file
v7.11 · Sep 2017
· source
+User interaction and safety controlsshippedProvides confirmation prompts for target selection, custom PIN configuration, verbose debugging modes, and session abort capabilities.8 releases · 1 other source · first seen Sep 2017▸
release
8 total
Adds beep sound alerts during Evil Twin attacks to signal key events.
v11.61 · Jan 2026
· source
· release history
New option to disable audio playback during Evil Twin attacks for silent operation.
v11.61 · Jan 2026
· source
· release history
Adds a flag to distinguish and validate personal vs. enterprise networks before launching attacks
v11.41 · Mar 2025
· source
· release history
Implements guardrails preventing enterprise attacks from running against personal networks and vice versa
v11.41 · Mar 2025
· source
· release history
Added tab autocompletion for every path input
v9.22 · Sep 2019
· source
· release history
Added interactive confirmation prompts before starting attacks when no target has been selected
v7.11 · Sep 2017
· source
· release history
example
Prevent accidental attacks by ensuring the tool asks for confirmation when no target is selected.$ ./airgeddon.sh (without -d or -m) -> observe confirmation prompt before proceeding
v7.11 · Sep 2017
· source
+Wireless network auditingshippedProvides a multi-use bash script for Linux systems to audit wireless networks.5 releases · 3 other sources · first seen Sep 2017▸
Also counts toward: Command-line interface, Scripting language support
release
Adds WEP besside-ng attack as a new automated WEP cracking method.
v11.40 · Dec 2024
· source
· release history
Replaces mdk3 attack module with mdk4 for deauthentication attacks
v9.10 · Mar 2019
· source
· release history
Adds a trophy file for WPS decrypted networks to document successful attacks.
v8.10 · Jun 2018
· source
· release history
Adds automatic check on Handshake capture during the attack process.
v8.10 · Jun 2018
· source
· release history
docs
7.9k Home Jump to bottom Óscar Alfonso Díaz edited this page Jul 13, 2026 · 99 revisions This is a multi-use bash script for Linux systems to audit wireless networks.
seen 20260714T1
· source
Multi-use bash script for Linux to audit wireless networks, supporting various attack and analysis modes.
example
Run the tool on a CentOS system where previous versions may not have been supported.$ ./airgeddon.sh
v3.32 · Sep 2017
· source
+Modular plugin systemshippedAllows the cyber tooling to be extended via a modular plugins architecture for custom functionality and dependency management.5 releases · first seen Nov 2019▸
Also counts toward: Plugin API support, Plugin system
release
Adds dynamic WPA3 plugin menu options without fixed slots, enabling flexible WPA3 attack menu composition.
v12.01 · Jul 2026
· source
· release history
Enables multiple hooks from different plugins on the same hookable function, expanding plugin composition capabilities
v11.51 · Aug 2025
· source
· release history
Adds helper functions to simplify hooking menus and hints from plugins
v11.50 · Jun 2025
· source
· release history
Adds a helper function to simplify hooking language strings from plugins
v11.41 · Mar 2025
· source
· release history
Adds a plugins system allowing modular extensions
v10.0 · Nov 2019
· source
· release history
+Enterprise network assessmentshippedDetects and targets WPA-Enterprise networks, capturing identities and certificates with support for CMAC authentication and configurable guardrails.5 releases · first seen Mar 2025▸
release
Enhances enterprise certificate analysis and identity capture capabilities.
v11.52 · Sep 2025
· source
· release history
Supports detection of enterprise networks that report CMAC as their authentication method
v11.50 · Jun 2025
· source
· release history
Adds DoS to the enterprise identities capture process to improve reliability of credential harvesting
v11.50 · Jun 2025
· source
· release history
New enterprise certificate analysis feature for inspecting certs captured from WPA-Enterprise networks
v11.50 · Jun 2025
· source
· release history
New enterprise identities capture feature for attacking WPA-Enterprise networks
v11.41 · Mar 2025
· source
· release history
+WPS attack algorithms and integrationshippedSupports WPS PIN generation using multiple algorithms (Zhao Chunsheng, EasyBox, Arcadyan) and integrates Pixie Dust attacks via reaver and bully.4 releases · 1 other source · first seen Sep 2017▸
Also counts toward: Command-line interface, Offline mode
release
Integrates Arcadyan WPS PIN generation algorithm
v7.22 · Oct 2017
· source
· release history
-wps-pin-algorithm flag now supports ComputePIN (Zhao Chunsheng) for WPS offline brute force.
v5.10 · Sep 2017
· source
· release history
Integrates Pixie Dust attacks using both reaver and bully tools into the WPS attack workflow
v5.0 · Sep 2017
· source
· release history
-wps-pin-algorithm flag now supports EasyBox (Stefan Viehböck) for WPS offline brute force.
v5.10 · Sep 2017
· source
· release history
example
Use the new Arcadyan algorithm for WPS PIN generation during an attack.$ Run airgeddon and select the option utilizing the 'Arcadyan WPS PIN generation algorithm'
v7.22 · Oct 2017
· source
+Interactive display enhancementsshippedImproves the user interface experience through mouse support in terminal multiplexers, dynamic window sizing based on desktop metrics, and audio alerts during operations.4 releases · first seen Sep 2017▸
release
Adds dynamic xterm sizing and positioning based on actual desktop and window metrics.
v12.02 · Sep 2026
· source
· release history
+DoS band hoppingshippedEnables Denial of Service pursuit mode to automatically hop between 2.4 GHz and 5 GHz bands to track mobile targets.2 releases · first seen Sep 2026▸
release
Adds 5GHz band hopping support to DoS pursuit mode, enabling pursuit of targets across both 2.4GHz and 5GHz bands.︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄
v12.02 · Sep 2026
· source
· release history
Added 5GHz band hopping support to DoS pursuit mode
v12.02 · Sep 2026
· source
· release history
+Interrupt and session controlshippedAllows users to immediately abort operations via Ctrl+C or by closing a worker window without waiting for timeouts.2 releases · first seen Jul 2026▸
release
Improves interrupt handling so Ctrl+C or closing a worker window aborts immediately without waiting for timeouts.
v12.01 · Jul 2026
· source
· release history
Improves interrupt handling so Ctrl+C or closing worker windows aborts operations immediately without waiting for timeouts.
v12.01 · Jul 2026
· source
· release history
+PMKID capture and conversionshippedEnables detection and transformation of captured PMKID files into standard aircrack-ng .cap format for downstream processing.2 releases · first seen Jun 2020▸
release
Improves PMKID capture performance with faster command execution and a reduced default timeout
v11.31 · Sep 2024
· source
· release history
Enables transformation of captured PMKID files into .cap aircrack-ng file format.
v10.21 · Jun 2020
· source
· release history
+Custom ESSID configuration for hidden networksshippedAllows manual specification of an ESSID name when targeting hidden networks not broadcasting their names.1 release · 1 other source · first seen Feb 2024▸
release
Adds capability to manually specify an ESSID name for selected hidden networks instead of relying solely on probe requests
v11.22 · Feb 2024
· source
· release history
example
Manually define an ESSID when targeting a hidden network that is not broadcasting its name.$ # Select the hidden SSID in the menu, then choose the option to enter a custom ESSID
v11.22 · Feb 2024
· source
+Wi-Fi 6E (6 GHz) supportshippedEnables partial scanning, attack capabilities, and adapter detection for the 6 GHz band with configurable validation toggles.1 release · first seen May 2026▸
release
Adds 6 GHz partial support: some scans, some attacks, capable adapter detection, option toggle, and validations.
v12.0 · May 2026
· source
· release history
+Wi-Fi standard tag displayshippedDisplays the specific 802.11 standard (e.g., n/ac/ax/be) associated with a selected network interface in both the selection menu and interface labels.1 release · first seen May 2026▸
release
Displays WiFi standard tag in the selected interface label and in the interface selection menu.
v12.0 · May 2026
· source
· release history
+Enterprise Evil Twin compatibilityshippedEnhances the stability and integration of Evil Twin attacks specifically for enterprise network environments.1 release · first seen Nov 2025▸
release
Improves Enterprise fake AP compatibility for Evil Twin attacks
v11.60 · Nov 2025
· source
· release history
+Wi-Fi standard advertisement capabilitiesshippedEnables fake access points to advertise 802.11n/ac/ax/be standards and exposes adapter support for these standards.1 release · first seen Sep 2025▸
release
Improves 802.11be (Wi-Fi 7) standard detection for adapters and enables Evil Twin fake APs to advertise 802.11be when the adapter supports it.
v11.52 · Sep 2025
· source
· release history
+Network decloakingshippedReveals hidden SSIDs using multiple detection methods.1 release · first seen Dec 2024▸
release
Adds network decloaking feature using two methods to reveal hidden SSIDs.
v11.40 · Dec 2024
· source
· release history
+Concurrent multi-instance executionshippedLaunches multiple instances of the tool simultaneously for parallel operations.1 release · first seen Jul 2024▸
+Wayland display server compatibilityshippedProvides support for the Wayland graphical system protocol in addition to existing windowing environments.1 release · first seen Nov 2018▸
Lines in monospace are the tool's own words: help text
parsed from its source, or an endpoint from its API document. Under
release, a line is our summary of a dated release. Under
docs, it is quoted from the tool's own documentation or
website. Each links back to the source it came from.
Command line
View
Source
No command matches.
load a captured run
composed command
No matchesTry a different search, or clear a filter to see more.
option surface across analysed releases
options at that releaseadded, per releaseremoved, per release
option
found in
since
description
No matchesTry a different search, or clear a filter to see more.
option changes per release — drag across the rail to set a range
→
Values are placeholders taken from each option’s declared default.
Nothing is executed here — the output shown is a recording of a run
that already happened.
Score card
Shipping velocityreleases a month, last 12 months
Documentation qualityrelease-notes rubric, 0–100
Breaking-change disciplinehow rarely a release breaks users, and notice given
Maintenance riskquiet time against its own cadence, maintainers
Innovation & surfacenew capabilities, API and MCP surface
Community health
Contributor trenddistinct committers, this year against last
Maintainer concentrationbus factor now against a year ago
Issue backlog trendissues closed per issue opened, 12 months
Responsivenessmedian time to a maintainer’s first reply
Nine scores for airgeddon, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Each score is 0–100 on a published rubric, derived from data this site already shows.
A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
Documentation quality — the release-notes rubric published on the analytics page, unchanged.
Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail airgeddon puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Issue, contributor and maintainer activity in v1s1t0r1sh3r3/airgeddon, 2023-10 – 2026-09,
as of 2026-09-25. Twelve-month figures first; the trend lines run
the whole window.
Contributors18+3 vs prior 12 months
Maintainers2+1 joined · −0 left, last 12 months
Bus factor1committers behind half the commits
Community-filed100%of issues opened, last 12 months
Median time to close< 1 dayfirst maintainer reply 0.4 hours
Open backlog0of 481 issues ever filed
Issues opened / month2 · 0communitymaintainers
Open backlog0
Contributors / month11
Commits / month39
Stars8,008
Issue themes, last 12 months
bugs 17%
features 25%
questions 21%
other 37%
Counts from the project's public repository and git history; no individuals
are identified. Maintainers are the committers covering 80% of the last year's
commits. how we measure this
Articles
1 article
· updated Nov 4, 2026
Where airgeddon turns up in what others publish: how-tos, attack reports that
name it, and incident write-ups. A row says why it is here and quotes where the
article names it; the link goes to the publisher.
You’ll discover how to use airgeddon for Wi-Fi hacking in this article.
2 more quotes
Table of Content Install Airgeddon & Usage Capturing Handshake & Deauthentication Aircrack Dictionary Attack for WPA Handshake Airacrack Brute Force Attack for WPA Handshake Hashcat Rule-Based Attack for WPA Handshake…
Install Airgeddon & Usage Airgrddon Features: Full support for 2.4Ghz and 5Ghz bands Assisted WPA/WPA2 personal networks Handshake file and PMKID capturing Interface mode switcher (Monitor-Managed) Offline password…
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can
follow every release here.