Airgorah: Rust/GTK4 graphical WiFi security auditing software
A GTK4 tool for Linux security staff auditing owned WiFi networks, capturing traffic, handshakes, and PMKIDs rather than merely scanning networks.
GitHub martin-olivier/airgorah Updated 2026-11-15 Branch main Stars 5.9K Forks 1.0K
Rust GTK4 WiFi security auditing Linux

🧭 Decision Guide

Try it if you

  • You need to audit traffic, clients, handshakes, or PMKIDs on a WiFi network you own
    The README states that Airgorah can capture nearby WiFi traffic, discover clients, and capture handshakes and PMKIDs, while emphasizing use on networks you are the owner of
  • Your test environment is Linux and you have a wireless card supporting monitor mode and packet injection
    The README Requirements section explicitly says the software only works on linux and requires a wireless card supporting monitor mode and packet injection
  • You want a GTK4 graphical interface with polkit handling privileged operations
    The README says the graphical part uses GTK4, and the Requirements section says airgorah-agent is launched through polkit

Skip it if you

  • You need to run a WiFi auditing tool on Windows or macOS
    The README Requirements section explicitly says: This software only works on linux
  • Your wireless card does not support monitor mode or packet injection
    The README Requirements section lists both capabilities as required
  • Your target is an unauthorized third-party WiFi network
    The README Legal section warns that attacking networks you do not own is illegal in almost all countries

Requirements

  • The runtime environment must be Linux: "This software only works on linux."
  • The wireless card must support "monitor mode" and "packet injection."
  • The graphical interface supports X11 and Wayland and runs as a normal user.
  • When privileged operations are needed, the system launches "airgorah-agent" through polkit and prompts for authentication.

Watch out

  • Installation and usage instructions are not included in the README; they require the Wiki's Installation and Usage pages
    The README Installation and Usage sections only provide links to the GitHub Wiki
  • Deauthentication, handshake capture, and PMKID capture are high-risk operations; the README describes unauthorized use as illegal
    The README Legal section explicitly states that attacking non-owned WiFi networks is illegal in almost all countries
  • Although the graphical interface runs as a normal user, privileged operations still trigger polkit authentication
    The README Requirements section says airgorah-agent is launched and requests authentication when privileged operations are needed

Not stated in the README

  • The Installation Wiki content is not included, so concrete installation commands, distributions, and dependency versions are unknown.
  • The Usage Wiki content is not included, so the exact procedures for traffic capture, deauthentication, handshake capture, and password cracking are unknown.
  • The README does not list supported wireless-card models or chipsets, so compatibility with an existing card cannot be determined.
  • The README does not specify the password-cracking algorithms, dictionary formats, hardware acceleration, or performance.
  • The README does not specify minimum versions for GTK4, polkit, Linux distributions, or Rust.
  • The materials show 3 contributors, 5 releases, and 10 recent commits, but these figures are insufficient to determine long-term maintenance or issue-response capability.

💡 Deep Analysis

6
Yes I maintain a GTK4 Linux desktop tool that must support both X11 and Wayland, and I do not want the entire GUI to run continuously as root. Does Airgorah fit this permission and desktop architecture constraint?
For: A GTK4 engineer maintaining a Linux desktop application that must support both X11 and Wayland without running the GUI continuously as root

Yes, because the README explicitly uses a normal-user GUI with a polkit privileged agent and states support for both X11 and Wayland.

  • The GUI runs as a normal user, so the entire GTK4 process does not need to remain root.
  • Privileged operations are handled by airgorah-agent, launched through polkit with one authentication prompt; this matches a design that separates privileged logic from the UI process.
  • The project is written in Rust and uses GTK4 for its graphical part; project data records Rust as the main language with 268,830 lines in the language distribution.
  • This is a native Linux desktop approach, not a cross-platform Windows or macOS desktop solution.

The README does not provide polkit action files, the agent API, the GTK4 version, or packaging details for different distributions, so integration effort cannot be estimated from the README alone.

  • README "Requirements": "The graphical interface runs as a normal user"
  • README "Requirements": "it works under both X11 and Wayland" and launches "airgorah-agent" via polkit
  • README "Airgorah": "written in Rust and uses GTK4"
  • Project data: main language is Rust; Rust distribution count is 268,830
Not stated in the README:Minimum versions for GTK4, polkit, and Linux distributions are not stated;The airgorah-agent interface, permission rules, and error handling are not documented;Specific limitations for wireless operations under Wayland sessions are not stated
It depends I need to deploy Airgorah in a Linux graphical session and must verify wireless drivers, monitor mode, packet injection, polkit, and X11/Wayland compatibility. Is the README sufficient for a deployment decision?
For: A system administrator deploying a wireless-auditing tool in a Linux graphical session while handling NetworkManager, driver, and privileged-agent compatibility issues

It depends: the README is sufficient to identify the system prerequisites and permission model, but not sufficient by itself for a cross-hardware and cross-distribution deployment decision.

  • Requirements explicitly limit the software to Linux and require a wireless card supporting monitor mode and packet injection; these are mandatory hardware and driver checks.
  • The GUI supports X11 and Wayland and runs as a normal user; privileged operations launch airgorah-agent through polkit and request authentication once.
  • Installation instructions are not contained in the README and instead link to the Installation Wiki; usage instructions similarly link to the Usage Wiki, placing important deployment details outside the main document.
  • Project data identifies v0.9.0 as the latest release with five releases. The target version is clear, but the README makes no long-term compatibility commitment.

The README does not document distribution package names, kernel or driver versions, NetworkManager conflict handling, polkit troubleshooting, or rollback procedures.

  • README "Requirements": "only works on linux" and requires "monitor mode" and "packet injection"
  • README "Requirements": supports "X11" and "Wayland" and launches "airgorah-agent" through polkit
  • README "Installation": installation instructions link to the Installation Wiki
  • README "Usage": usage documentation links to the Usage Wiki
  • Project data: latest_release is v0.9.0; release_count is 5
Not stated in the README:Supported Linux distributions, kernels, and wireless-driver versions are not listed;Handling of NetworkManager or other wireless services occupying the interface is not described;Recovery from polkit configuration failure, agent startup failure, and installation rollback are not documented
Yes I perform authorized testing of my own WiFi network on Kali Linux and have one wireless card supporting monitor mode and packet injection. Can Airgorah cover discovery, capture, handshake or PMKID collection, and deauthentication testing?
For: An authorized wireless penetration tester using Kali Linux with one USB adapter that supports monitor mode and packet injection

Yes, because the README combines these wireless-auditing steps in one Linux GUI, provided that the adapter and authorization requirements are satisfied.

  • The README says it can capture nearby WiFi traffic, discover clients connected to access points, capture handshakes and PMKIDs, and perform deauthentication attacks.
  • Requirements explicitly state that the wireless card must support monitor mode and packet injection; compatibility cannot be assumed for an ordinary adapter.
  • The GUI runs as a normal user, while privileged operations launch airgorah-agent through polkit and prompt for authentication once.
  • The Legal section limits use to testing networks owned by the user; unauthorized deauthentication or capture is outside the intended use.

The README does not specify a Kali version, chipset and driver matrix, or guarantee that every WPA/WPA2/WPA3 configuration will yield crackable material.

  • README "Airgorah": "capture nearby WiFi traffic, discover clients connected to access points, perform deauthentication attacks, capture handshakes and PMKIDs, and crack the password"
  • README "Requirements": "only works on linux" and the wireless card must support "monitor mode" and "packet injection"
  • README "Legal": "networks you are owner of"
  • Project data: topics include "kali"; latest release is v0.9.0
Not stated in the README:The specific Kali Linux version and supported adapter chipsets are not stated;No driver compatibility matrix, WPA3 coverage, or complete failure diagnostics are provided;The cracking backend, wordlist format, and performance requirements are not specified
It depends I teach in a Linux lab using a GTK4 GUI and want students to see the full flow from WiFi discovery to handshake or PMKID capture and password verification. Is Airgorah suitable for this course?
For: A wireless-security instructor using a GTK4 graphical tool in a Linux lab to teach the relationship between handshakes, PMKIDs, and password wordlists

It depends: the GUI can centralize the wireless-auditing steps needed for teaching, but the course still needs suitable Linux hardware, permissions, and an authorized lab network.

  • The README says the project uses GTK4 and supports WiFi traffic capture, client discovery, handshake and PMKID capture, and access-point password cracking, making the workflow visible to students.
  • Requirements require Linux and a wireless card supporting monitor mode and packet injection; every lab machine must satisfy these prerequisites.
  • The GUI runs as a normal user while privileged operations authenticate through polkit once. This can demonstrate privilege boundaries, but also adds system-configuration content.
  • The Legal section prohibits attacks against networks the user does not own, so the class must use an owned or explicitly authorized isolated network.

The README provides no teaching material, sample topology, lab data, cracking-time expectations, or coverage plan for different authentication protocols.

  • README "Airgorah": uses GTK4 and supports traffic capture, client discovery, handshake/PMKID capture, and password cracking
  • README "Requirements": Linux only; the card must support "monitor mode" and "packet injection"
  • README "Requirements": the GUI runs as a normal user and privileged operations use polkit authentication
  • README "Legal": "Performing attacks on WiFi networks you are not owner of is illegal"
Not stated in the README:The README provides no lesson procedures, sample topology, or distributable test data;Supported WPA/WPA2/WPA3 teaching scenarios are not specified;Cracking performance and resource consumption on lab hardware are not stated
It depends I want to reuse an MIT-licensed Rust project in an internal Linux wireless-auditing tool. Does Airgorah allow customization, while avoiding the mistake of treating it as an enterprise continuous-monitoring platform?
For: An enterprise security engineer evaluating an MIT-licensed Rust project for reuse or customization in an internal Linux security tool

It depends: the MIT license is suitable for code study and internal customization, but the project is a local Linux WiFi-auditing GUI and does not establish enterprise continuous-monitoring capabilities.

  • The README License section states that the project is released under the MIT license, lowering the licensing barrier for reuse and modification, while still requiring normal license-text compliance.
  • The README describes nearby traffic capture, client discovery, handshake/PMKID capture, deauthentication, and password cracking—an audit workflow rather than a monitoring platform.
  • The project insight explicitly distinguishes it from an enterprise centralized wireless-detection platform and from a general wireless-management tool.
  • Project data shows five releases and latest release v0.9.0. This is a reason to review maturity before adoption, not proof of quality by itself.

The README does not specify API stability, logging and report formats, centralized deployment, audit trails, support lifetime, or an enterprise SLA.

  • README "License": "This project is released under MIT"
  • README "Airgorah": lists traffic capture, client discovery, deauthentication, handshake/PMKID capture, and password cracking
  • Project insight "usage_limitations": it is better suited to local single-host auditing and is not equivalent to enterprise wireless intrusion detection or continuous monitoring
  • Project data: release_count is 5; latest_release is v0.9.0
Not stated in the README:The README does not list third-party dependency licenses or enterprise distribution requirements;It does not state whether a stable reusable library API, CLI, or automation interface exists;Maintenance lifetime, vulnerability response, and centralized auditing capabilities are not specified
Yes I validate enterprise WiFi password policies and plan to capture handshakes or PMKIDs from authorized access points before offline cracking. Can Airgorah serve as the unified entry point for this audit workflow?
For: A security auditor validating enterprise WiFi password policies and passing captured material to an offline-cracking workflow without promising password recovery

Yes, as an entry point for the workflow, but it should not be treated as a tool that guarantees recovery of any WiFi password; results depend on the captured material, password policy, and offline-cracking conditions.

  • The README explicitly supports capturing handshakes and PMKIDs and cracking access-point passwords, covering the main entry points from material collection to password validation.
  • The Legal section limits use to networks owned by the user; enterprise audits therefore require explicit authorization, especially when active deauthentication is involved.
  • Project insight states that cracking results depend on wordlist quality, computing resources, and the target password policy, and that strong passwords may not be recovered in an acceptable time.
  • The project is a local Linux security-auditing tool, not an enterprise centralized password-compliance or reporting platform.

The README does not specify the offline-cracking engine, wordlist interface, GPU support, result-export format, or audit-reporting capabilities, so integration with an existing compliance workflow cannot be confirmed.

  • README "Airgorah": "capture handshakes and PMKIDs" and "crack the password of access points"
  • README "Legal": intended for testing flaws in "networks you are owner of"
  • Project insight "common_pitfalls": results depend on wordlist quality, computing resources, and target password policy
  • Project insight "usage_limitations": it should not be treated as an enterprise centralized wireless-detection, asset-management, or compliance-reporting platform
Not stated in the README:The offline-cracking engine and its version are not specified;GPU or CPU parallelism and wordlist/rule configuration are not documented;The README does not state whether reports can include time, target, and authorization-scope fields

✨ Highlights

  • Written in Rust with GTK4 providing the graphical interface
  • Captures WiFi traffic and discovers clients connected to access points
  • Can perform deauthentication attacks and capture handshakes and PMKIDs
  • Has 5,868 GitHub stars and the latest release is 0.9.0

🔧 Engineering

  • Airgorah captures nearby WiFi traffic and discovers access point clients
  • The tool supports deauthentication, handshake and PMKID capture, and access-point password cracking
  • The GTK4 interface runs as a normal user, while privileged operations use a polkit agent

⚠️ Risks

  • The README explicitly warns that attacking non-owned WiFi networks is illegal in almost all countries
  • It only supports Linux, and the wireless card must support monitor mode and packet injection
  • Privileged operations launch airgorah-agent through polkit and request authentication

👥 For who?

  • Linux security engineers auditing WiFi networks they own
  • Testers with a wireless card supporting monitor mode and packet injection
  • GTK4 desktop users running X11 or Wayland