snype — WPA Handshake Capture Utility

A modern terminal UI for the aircrack-ng / hcxtools workflow. snype streamlines wireless reconnaissance, handshake capture, deauthentication and wordlist cracking through a keyboard-driven TUI and sensible defaults.

Caution

This tool is provided for educational and legitimate security testing purposes only. The author assumes no responsibility for any damages or legal consequences arising from its use. Always obtain explicit authorization before performing any network assessment. Unauthorized use is strictly prohibited and may violate local, national and international laws.

---

Overview

snype wraps the standard wireless auditing toolchain behind a single interface:

• Modern TUI built with textual and rich — status bar, sidebar navigation, keybindings, modal dialogs.
• Automatic dual-terminal launcher — monitor and deauthentication run side by side in xterm, tmux or an embedded PTY pane, depending on the environment.
• Environment detection — transparent support for desktop Linux, headless/SSH sessions, and Kali NetHunter / Termux.
• Structured output — every capture is written to a per-session directory with a meta.json for reproducibility.
• CLI flags — every TUI action is also reachable from the command line for scripting.

---

Features

• Interactive TUI with contextual keybindings and live status bar.
• Network scanning and target selection via airodump-ng with CSV parsing.
• Targeted packet capture with deduplicated per-session output.
• Deauthentication module with configurable duration and target client.
• Automatic conversion from .cap to .hc22000 via hcxpcapngtool.
• Wordlist cracking wrapper on aircrack-ng with result persistence.
• One-shot migration from the legacy flat layout to the new snype-data/ tree.
• Detailed --help reference generated by argparse.

---

Requirements

System

• Linux-based operating system (desktop, SSH, or NetHunter / Termux).
• Wireless adapter supporting monitor mode and packet injection.
• Python 3.10 or higher.
• sudo / root privileges for monitor mode and injection.

External tools

• aircrack-ng suite: airmon-ng, airodump-ng, aireplay-ng, aircrack-ng.
• hcxtools: hcxpcapngtool, hcxdumptool.
• At least one of: tmux, xterm, kitty, gnome-terminal, konsole (optional — the embedded PTY backend is used as a fallback).

Python packages

Package	Version	Purpose
textual	>= 0.50	TUI framework (layout, widgets, keybindings)
rich	>= 13.0	Rich text and table rendering inside widgets

---

Installation

pipx (recommended)

pipx installs snype in an isolated environment and puts the snype command on your PATH.

git clone https://github.com/ente0/snype.git
pipx install ./snype

To pick up code changes after pulling:

pipx reinstall snype

To uninstall:

pipx uninstall snype

pip (alternative)

git clone https://github.com/ente0/snype.git
cd snype
pip install .

System dependencies

Debian / Ubuntu / Kali

sudo apt update
sudo apt install -y aircrack-ng hcxtools hcxdumptool tmux xterm \
                    python3 python3-pip pipx
pipx ensurepath

Fedora

sudo dnf install -y aircrack-ng hcxtools hcxdumptool tmux xterm \
                    python3 python3-pip pipx
pipx ensurepath

Arch Linux / Manjaro

sudo pacman -S aircrack-ng hcxtools hcxdumptool tmux xterm \
               python python-pip python-pipx
pipx ensurepath

Kali NetHunter / Termux

pkg install aircrack-ng hcxtools tmux python
pip install textual rich

snype auto-detects NetHunter and forces the tmux backend for the dual-terminal launcher.

---

Quick Start

sudo snype

The first run performs a one-shot migration: any legacy handshakes/ directory and the old selected_network.txt / interface_config.txt files are moved into the new snype-data/ layout. Nothing is deleted — the old files are relocated, not dropped.

Launch with pre-filled state:

sudo snype -i wlan0 -I wlan1 -b AA:BB:CC:DD:EE:FF -c 6

If running directly from the repository without installation:

sudo python3 snype.py

---

CLI Reference

Run snype --help for the authoritative list. The most relevant flags:

Flag	Argument	Purpose
-i, --interface	IFACE	Primary interface, used for monitoring.
-I, --inject	IFACE	Secondary interface for injection (defaults to primary).
-b, --bssid	MAC	Preselect a target BSSID.
-c, --channel	N	Preselect a channel.
-e, --essid	NAME	Preselect an ESSID (used for session naming).
-d, --data-dir	PATH	Override the data directory (default: ./snype-data).
-t, --term-mode	auto|xterm|tmux|pty	Force a specific dual-terminal backend.
--duration	SECONDS	Default duration for timed deauth attacks.
--dry-run		Print the external commands without executing them.
-v, --verbose		Enable verbose logging.
--version		Print version and exit.
-h, --help		Print the full help and exit.

---

TUI Guide

The TUI is divided into four regions:

+------------------------------------------------------------+
| status bar : iface, target, channel, cap/hc22000/pwd count |
+-----------+------------------------------------------------+
|  sidebar  |                                                |
|  Scan     |                  main pane                     |
|  Monitor  |       (tables, forms, progress, logs)          |
|  Deauth   |                                                |
|  Crack    |                                                |
|  Files    |                                                |
|  Settings |                                                |
+-----------+------------------------------------------------+
| footer : keybinding hints and last log line                |
+------------------------------------------------------------+

Global keybindings

Key	Action
s	Scan networks
m	Start targeted monitoring + deauth
d	Standalone deauthentication
c	Enter wordlist cracking view
f	Browse captured files
t	Settings (interfaces, terminal backend)
h	Return to welcome screen
?	Show help
q	Quit

View-specific keybindings

Scan

Key	Action
r	Start a scan
↑ / ↓	Move selection
Enter	Pick target
+ / -	Adjust scan duration

Deauth

Key	Action
Enter	Run deauth
+ / -	Adjust duration
c	Clear client MAC (target all)

Crack

Key	Action
r	Refresh capture list
↑ / ↓	Select capture file
w	Load wordlist from $SNYPE_WORDLIST
Enter	Run cracking

Settings

Key	Action
1	Set monitor interface
2	Set injection interface
3	Cycle terminal backend
f	Flush monitor-mode services

Typical workflow

1. Settings (t) — set monitor and optional injection interfaces.
2. Scan (s) — discover and pick a target from the live table.
3. Monitor + Deauth (m) — the launcher opens a dual-pane terminal so packet capture and deauthentication run concurrently. Close both panes when done.
4. Convert — .cap files are auto-converted to .hc22000 at the end of the session.
5. Crack (c) — set $SNYPE_WORDLIST, press w to load it, then Enter to crack.
6. Files (f) — browse captures, hashes and recovered passwords under snype-data/hs/.

---

Data Layout

All artefacts live under a single, portable tree. The default root is ./snype-data/, overridable with --data-dir or the SNYPE_DATA_DIR environment variable.

snype-data/
├── config.json                      # interface + last target state
├── hs/                              # captures organised by ESSID
│   └── <ESSID>/
│       ├── <YYYYMMDD-HHMMSS>/
│       │   ├── capture.cap
│       │   ├── capture.hc22000
│       │   └── meta.json            # BSSID, channel, start, stop, EAPOL count
│       └── passwords/
│           └── <ESSID>_password.txt
├── logs/
│   └── snype.log
└── found_passwords.jsonl            # append-only cracked keys

meta.json

Each session directory contains a self-describing metadata file. Example:

{
  "essid": "MyNetwork",
  "bssid": "AA:BB:CC:DD:EE:FF",
  "channel": 6,
  "started_at": "2026-04-14T14:32:01+00:00",
  "stopped_at": "2026-04-14T14:34:18+00:00",
  "duration_s": 137,
  "eapol_frames": 4,
  "handshake_complete": true,
  "capture": "capture.cap",
  "hashcat": "capture.hc22000"
}

---

Terminal Auto-Detection

When the user triggers "Monitor + Deauth", snype opens two terminals side by side so packet capture and deauthentication run at the same time. The backend is picked automatically; --term-mode can force a specific one.

Detection order (auto mode):

1. NetHunter / Termux ($TERMUX_VERSION set, or Kali-NetHunter bind mounts detected) — forces tmux.
2. Graphical desktop ($DISPLAY set) — uses xterm by default, falling back to the first of kitty, gnome-terminal, konsole found in PATH.
3. TTY with tmux available — creates a detached tmux session, splits horizontally and attaches.
4. Fallback — embedded PTY pane inside the TUI itself (multiplexed via pty.openpty and an asyncio reader).

The backend for the current session is reported in the status bar and in snype-data/logs/snype.log.

---

Recommended Companion: hashCrack

For GPU-accelerated cracking we recommend hashCrack, a companion tool designed to pair with snype.

Workflow:

1. Capture the handshake with snype and let it produce the .hc22000 artefact.
2. Feed the artefact to hashCrack:

hashcrack captured_handshake.hc22000

Benefits:

• GPU-accelerated attack modes via hashcat.
• Multiple prebuilt cracking strategies and masks.
• Extensive wordlist management.

Note

Always ensure you have proper authorization before attempting any password recovery.

---

Troubleshooting

Interface not found

• Confirm the adapter is physically connected.
• Check monitor-mode capability with iw list.
• Use the exact interface name as reported by ip link.

Permission denied

• Run snype with sudo.
• On NetHunter, ensure the chroot has access to the USB wireless device.

No networks found

• Verify the adapter is actually in monitor mode (iwconfig <iface>).
• Try pinning the channel manually via -c.
• Some adapters are region-locked; check iw reg.

Deauthentication ineffective

• Ensure you are in range of the target.
• Some clients implement 802.11w / PMF and will ignore deauth frames.
• Increase the duration with --duration or repeat the attack.

TUI rendering issues

• Make sure the terminal reports at least 100x30 characters.
• Force a specific backend with --term-mode tmux if your terminal emulator is exotic.
• Disable truecolor by exporting COLORTERM= if colors look off.
• If textual throws an error on startup, ensure Python 3.10+ is in use: python3 --version.

snype command not found after pipx install

• Run pipx ensurepath and restart your shell.
• Confirm pipx's bin directory (~/.local/bin) is in $PATH.

---

Educational Resources

• 4-Way Handshake Explanation
• Radiotap Introduction
• Aircrack-ng Documentation

---

License

This project is licensed under the GPL-3.0. See the LICENSE file for details.

---

Support

• Report issues

---

Related Projects

• hashCrack
• hashcat-defaults
• wpa2-wordlists
• paroleitaliane
• SecLists