How I built a cross-platform Wi-Fi auditor in Python with no monitor-mode setup

Udhay Bhat — Sat, 26 Sep 2026 21:09:07 +0000

Skip to "Try it without hardware" to try it in your browser in 60 seconds — no adapter needed.

The problem
Every Wi-Fi security tool I used required Linux. wifite2, aircrack-ng, reaver — all depend on kernel monitor-mode drivers that don't exist on Windows or macOS. If you wanted to audit a network on macOS you needed a Linux VM, a compatible adapter, and hours of driver setup.

I wanted to fix that.

The solution — userland USB drivers
Instead of relying on the OS wifi stack, airscope ships its own lightweight USB drivers written in Python. These are ports of the Linux kernel wifi drivers that talk directly to USB hardware via PyUSB bulk and control transfers.

The result: the entire 802.11 MAC layer runs in Python userspace. Monitor mode, packet injection, beacon parsing, the 4-way handshake state machine, WPS protocol, SAE commit/confirm frames — all in Python, no kernel involvement whatsoever.

This means it runs identically on Linux, macOS, and Windows. No kernel modules. No NDIS wall on Windows. One-time USB permission prompt and you're scanning.

Tech stack
Python 3.11+ with asyncio throughout
PyUSB for direct USB bulk/control transfers to wifi chipsets
Textual for the terminal UI
FastAPI + uvicorn + WebSockets for the local web backend
Svelte + Vite for the web frontend
PyInstaller for cross-platform binaries (macOS universal2, Linux x64/arm64, Windows x64)
Features
Reconnaissance:

Real-time scanner with 2.4GHz + 5GHz channel hopping
AP vendor fingerprinting and router model detection from WPS beacons
Hidden network decloaking via BSSID correlation
Multi-adapter aggregation
Attacks:

WPA/WPA2 handshake capture + PMKID harvesting
WPS PixieDust (offline PIN recovery), PIN brute-force, PBC capture
WPA3 SAE handshake capture
EvilTwin downgrade attack with real-time MIC verification — when someone types their password into the fake network, it validates against the captured handshake in real time and recovers the plaintext PSK directly
WEP ARP replay, ChopChop, fake auth, PTW recovery
Post-capture:

Built-in hashcat/aircrack-ng cracking path from the vault UI
Batch multi-target automation with smart attack chain ordering
Export to CSV, Kismet netXML, HTML audit report
The web dashboard
Alongside the Textual terminal UI, there's a local web dashboard built with Svelte + FastAPI + WebSockets. It mirrors every feature of the TUI and has a full demo mode for trying it without hardware.

It runs locally on your machine at localhost:8765 — the wifi hardware still needs to be physically attached, but the interface is a proper web app with live-updating tables, sparkline charts, and a command palette.

Try it without hardware
The demo mode lets you explore every screen with no adapter:

macOS:


bash
xattr -d com.apple.quarantine ~/Downloads/airscope-macos-universal2
chmod +x ~/Downloads/airscope-macos-universal2
~/Downloads/airscope-macos-universal2 --web --demo
Linux:


bash
chmod +x ./airscope-linux-x64
./airscope-linux-x64 --web --demo
Windows:


airscope-windows-x64.exe --web --demo
A browser tab opens automatically showing a simulated live scan. Every screen works — scanner, attacks, vault, cracking, reports. Nothing touches your actual network.

The EvilTwin implementation
The most technically interesting part was implementing a proper EvilTwin attack. Most tools that claim "EvilTwin" just deauth clients and capture whatever handshake they send back to the real AP — which is just a regular handshake capture with extra steps.

The real attack works differently:

Capture the real WPA2 handshake first (mandatory prerequisite)
Stand up a fake AP broadcasting the same SSID with WPA2-only (dropping the SAE AKM for transition-mode targets)
Simultaneously deauth clients from the real AP every 0.5s
When a client connects to the fake AP and types their password, run the AP-side 4-way handshake and validate the MIC against the reference handshake captured in step 1
MIC matches = correct password, saved to vault as plaintext PSK
MIC mismatch = send disconnect, device shows "Incorrect password", user tries again
This is the documented WPA3-transition downgrade — transition-mode APs use the identical password for both SAE and WPA2-PSK, so the downgrade directly recovers the real network password.

Hardware requirement
At least one supported USB wifi adapter is required for live use. About 20 chipsets are currently supported including Realtek RTL8812AU, MediaTek MT7921AU, Atheros AR9271, and others. Full list in the docs.

This is the honest trade-off vs aircrack-ng: aircrack-ng works with any monitor-mode card, airscope works with ~20 specific USB chipsets but runs on any OS.

GitHub

udhaybhat00 / airscope

Cross-platform USB Wi-Fi security auditor: WPA/WPA2 handshake + PMKID capture, WPS PixieDust, WPA3 SAE, EvilTwin, hashcat cracking — terminal UI + web dashboard

airscope

The only Wi-Fi security auditor that runs natively on Windows, macOS, and Linux — no monitor-mode setup, no kernel drivers, no aircrack-ng dependency.

What is airscope?

airscope is a Wi-Fi security auditing tool that runs on your laptop. It connects to a USB Wi-Fi adapter and helps you:

See all nearby Wi-Fi networks in real time
Capture the cryptographic "handshake" that proves a password was used
Test whether your network is vulnerable to real-world attacks
Report everything in formats your team can use

Think of it as a stethoscope for your Wi-Fi network: it listens, analyzes, and tells you what is wrong, in plain English.

Who is this

…

View on GitHub

Binaries for all platforms: https://github.com/udhaybhat00/airscope/releases/latest

⚠️ For authorized use only — networks you own or have explicit permission to test.

DEV Community: Udhay Bhat