Airwave Teardown Wireless Auditing
One WiFi tool. Two radios. Zero mercy for a weak password.
A real 2-in-1 WiFi pentesting and cracking engine — attack and crack from one interface, one native codebase. This is the last WiFi pentesting tool you'll ever need.
# clone and go
git clone https://github.com/KiMiGuel/ATWA-NG.git
cd ATWA-NG && pip install -e .
atwa gui
// note from the guy who built it
N2-NG did its job for about a year, but it only ever had one radio, and that radio had to do everything — scan, deauth, capture, all queued up and fighting each other for airtime. I lost more handshakes to my own tool timing itself out than I ever did to a locked-down AP.
ATWA-NG is the rebuild. Same mission, but this time the second radio actually pulls its own weight instead of sitting idle. Full changelog's in the repo — the short version is everything hits harder now.
— KiMiGuEL
What it does
Every other tool makes you choose. This one doesn't.
Scan or attack. Listen or strike. One radio doing one job badly at a time — the scan stutters the second you fire a deauth, the handshake drops a frame because your only adapter just got yanked onto another channel to send a packet. That's not a workflow, that's a compromise dressed up as software. ATWA-NG is built from scratch to end that compromise.
Attack + crack, one tool
Capture and crack live in the same interface — John the Ripper (jumbo) as the primary engine, aircrack-ng wired in as an alternate. One click, or point it at a whole folder of captures and let it merge, convert, and crack the lot unattended.
Built, not wrapped
PMKID, handshake capture, WPS, WEP and portal-free rogue-AP workflows are real from-scratch implementations on scapy — not subprocess.run() gambles around other CLI tools.
Captures you can trust
An AUTHORIZED-vs-challenge-only verification gate on every handshake — you know it's crackable the second it lands on disk.
The feature nothing else has
PINCER — a real dual-radio attack
PINCER is an optional dual-Alfa mode: it stays greyed out and unusable unless two compatible Alfa adapters are detected. The known lab pair is the AWUS036ACHM (MediaTek scanner/listener) and AWUS1900/RTL8814AU (3×3 attacker), auto-detected by chipset. Other Alfa USB adapters and Alfa-compatible re-badged MediaTek hardware can also enable PINCER through USB vendor-ID detection, with the first detected interface assigned to scanning and the second to attacking. Plug both in, lock a target, hit PINCER. From that instant, neither radio ever pauses, hops, or time-shares to do the other one's job — and it's not just "two radios instead of one," it's an attack that gets more aggressive the longer a target holds out.
- Radio A never stops listening — and races for PMKID too. Parked on the target's channel, full-time, waiting for the handshake. A second sniffer thread on the same radio hunts a clientless PMKID in parallel; the instant one shows up, the whole attack stops dead and hands you a crack-ready
.22000file — no deauth round ever needed. - Radio B never stops striking — and it escalates. Deauth starts at a conservative 8-frame burst and only ramps up (16 → 32 → 64) after three rounds produce nothing. It targets the two strongest-signal clients specifically, times bursts to land right after the AP's own beacon, and uses the selected channel's advertised TX limit, up to 30 dBm where BO permits it.
- No time-sharing, no dropped frames. The listener is always listening exactly when the deauth actually lands — that's the whole trick.
- A real pincer. Two adapters, two jobs, closing on the target from both sides at once, only escalating as hard as the target actually forces it to.
Everything else in the box
A full, modern attack suite — every one of it native
The primary scan, handshake, WPS, WEP, and rogue-AP paths are native implementations. The explicit wps-oneshot alternate is the documented managed-mode exception because it drives wpa_supplicant directly.
| Attack | What it actually does |
|---|---|
| Smart Attack | Auto-routes: PMKID first, falls back to deauth + handshake if the target is clientless-immune |
| OMNI Attack | Full adaptive chain — profile → PMKID → handshake → online guess → crack, one click |
| PMKID | Clientless — no connected client needed. Native scapy, PMF-aware |
| Handshake Capture | Native EAPOL sniff with an AUTHORIZED-vs-challenge-only verification gate |
| Deauth | Reason-code cycling, burst control, and a TX-power check so a silent radio doesn't look like a broken attack |
| CHAOS | The whole flood suite against one target — beacon, EAPOL, auth, deauth, channel-steer and TKIP-MIC — escalating in tiers, reporting only what actually had an effect |
| WPS | Null-PIN, Pixie-Dust, and Bruteforce — Bruteforce tries a free null-PIN first and bails on a locked AP instead of burning 10,000 attempts |
| WEP | Fake-auth + ARP replay + native PTW key recovery, plus Caffe Latte and IBSS Hirte for client-only attacks |
| Portal-free rogue APs | WPA3-transition downgrade, OWE-transition downgrade, and PMF-bypass reconnect workflows — no credential portal |
| Dragonblood | SAE timing side-channel wordlist pruning (CVE-2019-9494) — unpatched pre-2.10 APs only |
| Online Password Guess | Live, real per-password 4-way handshake attempts straight against the AP |
| Cracking | Miguel and aircrack-ng wired in — one-click crack, or point it at a folder of captures to merge, convert, and crack the lot |
| Hidden SSID de-cloaking | Automatic, the moment a probe response reveals it |
Using it
What the buttons actually do
First tool to put scanning and pentesting in one window. Launch with atwa gui (needs root) — here's the flow, start to finish.
Pick an adapter, Start Monitor
Puts your WiFi card into monitor mode. A second adapter in AP iface unlocks PINCER or the portal-free rogue-AP workflows.
Start Scanning
Channel-hops and fills the target list live — BSSID, SSID, channel, security, signal.
Click a target
Locks the channel, starts the signal graph, and starts a real capture against just that AP.
Run an attack
Deauth, PMKID, Handshake, Smart/OMNI, WEP, WPS, and portal-free rogue-AP workflows — from the Attack menu or button stack.
Captures tab
Inspect, Convert to 22000, Fix, Merge and Crack Selected — all in the one panel.
Crack
Point it at captures and a wordlist, pick a backend — John or Aircrack-ng — and run. Stop Cracking actually kills the process; the password lands on screen and in creds.json next to the capture.
Full CLI reference (23 subcommands) → README.md
How it works
Modern techniques, built from scratch
No black boxes. Here's the actual mechanics behind ATWA-NG.
Not time-shared
PINCER dedicates one radio to capture and one to attack — permanently, for the whole session. No single adapter is ever asked to scan and strike at once.
Built on scapy, from scratch
PMKID extraction, EAPOL handshake sniffing, and PTW WEP key recovery are all written natively — not thin wrappers piping output from other tools.
OMNI routes itself
Profile the target first, then route automatically: PMKID attempt → handshake capture → online guessing → cracking — no manual mode-switching.
No guesswork on captures
Handshakes are checked against an AUTHORIZED-vs-challenge-only gate before they're reported — a capture on disk is one you can actually crack.
Offline, over brute force
WPS Bruteforce checks for a free null-PIN and bails immediately on a locked AP; Pixie-Dust exploits weak nonce generation offline instead of grinding 10,000 online attempts.
Chipset-aware pairing
PINCER identifies the AWUS036ACHM/MediaTek as the scanner-listener and the AWUS1900/RTL8814AU 3×3 as the attacker by chipset. For other Alfa USB adapters and Alfa-compatible re-badged MediaTek hardware it uses USB vendor-ID detection and assigns the first detected interface to scanning and the second to attacking.
Get started
Install
Clone and install
git clone https://github.com/KiMiGuel/ATWA-NG.git
cd ATWA-NG && pip install -e .
Launch the GUI
atwa gui
The full experience — needs root.
Or drive it from the terminal
atwa scan wlan0
atwa smart wlan0 <bssid>
atwa omni wlan0 <bssid> --wordlist rockyou.txt
Requirements: Linux, Python 3.10+, a WiFi adapter capable of monitor mode + injection — a pair of compatible Alfa adapters to unlock PINCER.