Install Pyrit on Kali Linux

Deepak Prasad
Tested on Kali GNU/Linux Rolling 2026.2 (kali-rolling)
Package pyrit 0.5.1
python2 2.7.18-3
python2-dev 2.7.18-3
libssl-dev 3.6.3-1
libpcap-dev 1.10.6-2
libcrypt-dev 1:4.5.1-1+b1
Applies to Kali Linux
Lab environment Isolated Kali VM with USB Wi-Fi for capture — pentest lab setup
Privilege sudo for package installs and setup.py install
Scope Build Pyrit 0.5.1 from GitHub with Python 2.7, apply AES-NI and GCC workarounds, verify with pyrit -h, list_cores, and benchmark. Does not cover handshake capture, GPU modules, or full Wi-Fi password attacks.
Short on time?Beta Get the gist of this 8-minute read in seconds, then ask follow-up questions

Pyrit speeds up WPA/WPA2-PSK testing by precomputing PMKs with CPU (and optional GPU) cores. Kali no longer publishes a pyrit apt package, so this guide builds the upstream JPaulMora/Pyrit tree on a fixed commit that still targets Python 2.7.

IMPORTANT
Use Pyrit only on wireless networks you own or have written permission to assess. PMK databases and handshake attacks against third-party WLANs are illegal without authorization.

What is Pyrit in ethical hacking?

Pyrit is a WPA/WPA2-PSK helper that precomputes Pairwise Master Keys (PMKs) from ESSIDs and passwords, then matches them against captured four-way handshakes faster than naive password loops. It complements Aircrack-ng capture tools and wordlist crackers such as John the Ripper in authorized Wi-Fi security labs.

Typical workflow after install:

  • Capture a WPA handshake with airodump-ng in monitor mode
  • Import or analyze the PCAP with pyrit analyze
  • Run attack_passthrough, attack_db, or cowpatty-compatible exports
  • Optionally build a PMK database with batch for repeat tests

The project is mature and lightly maintained. Upstream master now carries an incomplete Python 3 port; on Kali Rolling 2026.2 the reliable path is the last Python 2.7 commit plus the build fixes below.

Compare Pyrit install methods on Kali

Method Best for Notes
apt pyrit Fast package install Not in default Kali 2026.2 repos (python3-pyrituals is unrelated)
GitHub build at f0f1913 Current Kali labs Python 2.7 tree; needs AES-NI sed and GCC CFLAGS on GCC 14+
Latest master with Python 3 Future upstream C extension port incomplete on Kali 2026.2; use the pinned commit instead

The walkthrough uses the pinned Git commit path because it produced a working pyrit binary in this refresh.

Kali lab setup

Set directory and commit variables once. I clone into ~/Pyrit and pin commit f0f1913, which predates the broken Python 3 migration on master.

bash
export PYRIT_DIR="${HOME}/Pyrit"
export PYRIT_COMMIT="f0f1913"

You need outbound HTTPS to GitHub for git clone. For handshake capture you also need monitor mode on a USB Wi-Fi adapter — install airmon-ng on Kali when wlan interfaces are missing in a VM.

Install build dependencies

Install compilers, Python 2 headers, OpenSSL, libpcap, and libcrypt headers. Kali 2026.2 requires libcrypt-dev so Python.h can include crypt.h during the C extension build.

bash
sudo apt update

Refresh finishes with no errors when indexes are reachable.

Install the dependency set:

bash
sudo apt install -y git python2 python2-dev libssl-dev libpcap-dev libcrypt-dev build-essential

Confirm the packages from the intro table are on the system:

bash
dpkg-query -W python2 python2-dev libssl-dev libpcap-dev libcrypt-dev build-essential git
output
python2 2.7.18-3
python2-dev 2.7.18-3
libssl-dev 3.6.3-1
libpcap-dev 1.10.6-2
libcrypt-dev 1:4.5.1-1+b1
build-essential 12.12
git 1:2.53.0-1

Clone Pyrit from GitHub

Remove any old tree, clone the repository, and check out the pinned commit. Shallow clones need enough depth to reach f0f1913.

bash
rm -rf "${PYRIT_DIR}"
git clone --depth=100 https://github.com/JPaulMora/Pyrit.git "${PYRIT_DIR}"
bash
cd "${PYRIT_DIR}" && git checkout "${PYRIT_COMMIT}"
output
HEAD is now at f0f1913 Update README.md

That commit keeps Python 2 syntax in pyrit_cli.py while master mixes Python 3-only wrappers that fail under python2.

Patch the CPU extension for AES-NI

Without this sed change, pyrit can fail at runtime with undefined symbol: aesni_key after a successful compile. The patch disables the AES-NI compile path in cpyrit/_cpyrit_cpu.c.

bash
sed -i 's/COMPILE_AESNI/COMPILE_AESNIX/' "${PYRIT_DIR}/cpyrit/_cpyrit_cpu.c"

The command exits silently when the substitution succeeds.

Build Pyrit with Python 2

Modern GCC treats legacy CPython extension warnings as errors. Export CFLAGS before build and install so the _cpyrit_cpu module links on Kali’s default compiler.

bash
export CFLAGS='-Wno-error=incompatible-pointer-types -Wno-incompatible-pointer-types -Wno-int-conversion -Wno-error=int-conversion'
cd "${PYRIT_DIR}"
python2 setup.py clean

Clean removes prior build/ artifacts so the AES-NI patch and CFLAGS apply to a fresh compile.

Run the compile:

bash
python2 setup.py build

A successful build ends with changing mode of build/scripts-2.7/pyrit and no error: lines from gcc.

Install system-wide:

bash
sudo CFLAGS="${CFLAGS}" python2 setup.py install

setup.py install copies pyrit to /usr/local/bin and the cpyrit modules into /usr/local/lib/python2.7/dist-packages/.

Leave the source directory so Python does not import modules from the build tree by accident:

bash
cd "${HOME}"

Verify Pyrit installation

Check the CLI banner and command list:

bash
pyrit -h
output
Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Usage: pyrit [options] command

Recognized options:
  -b               : Filters AccessPoint by BSSID
  -e               : Filters AccessPoint by ESSID
  -h               : Print help for a certain command
  ...
Recognized commands:
  analyze                 : Analyze a packet-capture file
  attack_batch            : Attack a handshake with PMKs/passwords from the db
  attack_cowpatty         : Attack a handshake with PMKs from a cowpatty-file
  attack_db               : Attack a handshake with PMKs from the db
  attack_passthrough      : Attack a handshake with passwords from a file
  batch                   : Batchprocess the database
  benchmark               : Determine performance of available cores

The version line and analyze / attack_passthrough commands confirm the CPU core loaded.

List compute cores Pyrit can schedule:

bash
pyrit list_cores
output
Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

The following cores seem available...
#1:  'CPU-Core (SSE2)'
#2:  'CPU-Core (SSE2)'

This lab VM exposed two SSE2 CPU cores. GPU OpenCL or CUDA cores appear only after you build optional modules and have compatible hardware.

Run a short performance calibration. The spinner runs for about one minute while PMK/s stabilizes:

bash
pyrit benchmark
output
Pyrit 0.5.1 (C) 2008-2011 Lukas Lueg - 2015 John Mora
https://github.com/JPaulMora/Pyrit
This code is distributed under the GNU General Public License v3+

Calibrating...
Computed 2036.39 PMKs/s total.
#1: 'CPU-Core (SSE2)': 1058.1 PMKs/s (RTT 2.7)
#2: 'CPU-Core (SSE2)': 1087.4 PMKs/s (RTT 2.9)

Your PMK/s total depends on CPU cores and VM load. Record the number when comparing bare metal versus virtualized labs.

Optional GPU modules (CUDA and OpenCL)

Pyrit can load cpyrit_cuda or cpyrit_opencl when you build the submodules under modules/ and have a supported GPU plus headers. Most pentest VMs lack passthrough GPUs, so CPU-only Pyrit is the common lab outcome.

High-level optional steps when you have NVIDIA hardware and toolkit headers:

  • Install nvidia-cuda-toolkit or OpenCL ICD headers from your driver vendor
  • Build inside modules/cpyrit_cuda/ or modules/cpyrit_opencl/ with the same CFLAGS export
  • Toggle use_CUDA or use_OpenCL in ~/.pyrit/config after install

GPU builds are fragile on rolling kernels and often fail without matching driver versions. Treat GPU acceleration as an advanced add-on after CPU Pyrit works. Full handshake capture and crack flow lives in hack Wi-Fi password on Kali.

Remove Pyrit from Kali

Stop using the CLI, then remove the installed files and source tree.

bash
sudo rm -f /usr/local/bin/pyrit
sudo rm -rf /usr/local/lib/python2.7/dist-packages/cpyrit /usr/local/lib/python2.7/dist-packages/cpyrit_*.egg-info /usr/local/lib/python2.7/dist-packages/pyrit_cli.py /usr/local/lib/python2.7/dist-packages/pyrit-0.5.1.egg-info
rm -rf "${PYRIT_DIR}"

Delete ~/.pyrit/ as well if you created PMK databases or config files during lab work.

Pyrit install troubleshooting

Symptom Likely cause Fix
fatal error: crypt.h: No such file or directory Missing libcrypt headers on Debian/Kali sudo apt install libcrypt-dev and rebuild
TypeError: super() takes at least 1 argument on build Building a newer commit with Python 2 Checkout f0f1913 or patch setup.py to call build_ext.build_extension(self, ext)
incompatible-pointer-types or int-conversion from gcc Strict GCC 14 defaults Export the CFLAGS string from the build section before python2 setup.py build
undefined symbol: aesni_key at runtime AES-NI object linked incorrectly Apply the COMPILE_AESNI → COMPILE_AESNIX sed on _cpyrit_cpu.c and rebuild
SyntaxError on print( when running pyrit Installed from master with Python 3 syntax Remove install, checkout f0f1913, rebuild with python2
ImportError for _cpyrit_cpu Partial install or mixed Python versions python2 setup.py clean, rebuild with CFLAGS, reinstall, run from $HOME not source dir
No GPU cores in list_cores CPU-only build or no GPU modules Expected on CPU-only VMs; build CUDA/OpenCL modules only when GPU passthrough exists

References

Summary

Kali Rolling 2026.2 does not ship Pyrit in apt, so you cloned JPaulMora/Pyrit at commit f0f1913, patched the AES-NI compile guard in cpyrit/_cpyrit_cpu.c, and built with Python 2.7 plus relaxed CFLAGS for GCC 14. Installing libcrypt-dev alongside python2-dev, libssl-dev, and libpcap-dev avoids the crypt.h compile failure common on current Debian-based images.

After python2 setup.py install, pyrit -h showed version 0.5.1, list_cores listed SSE2 CPU workers, and benchmark reported about 2036 PMKs/s on this two-core lab VM. That confirms the CPU extension loads; handshake import and cracking belong in your Wi-Fi capture workflow after monitor-mode captures.

Pyrit remains a legacy Python 2 tool with an unfinished Python 3 port on master. Pin the commit, keep the build flags, and run simulations only on authorized WLANs inside an isolated lab.

Frequently Asked Questions

Is Pyrit available in Kali apt repositories?

Kali Rolling 2026.2 does not ship a pyrit package in the default apt indexes. The unrelated python3-pyrituals package is for Rituals perfume hardware, not WPA cracking. Build Pyrit from the JPaulMora GitHub repository with Python 2.7 as shown in this guide.

Why does Pyrit fail with undefined symbol aesni_key?

The CPU extension tried to compile AES-NI intrinsics that your toolchain or CPU path rejects. Apply the sed fix that renames COMPILE_AESNI to COMPILE_AESNIX in cpyrit/_cpyrit_cpu.c before building, then rebuild with python2 setup.py clean and build.

Why does python2 setup.py build fail on modern GCC?

GCC 14 and newer treat legacy CPython extension pointer warnings as errors. Export CFLAGS with -Wno-error=incompatible-pointer-types and related flags before build and install. Install libcrypt-dev so Python.h can find crypt.h on current Debian-based images.

Should I clone the latest Pyrit master branch?

The current master tree targets an incomplete Python 3 port and does not build cleanly on Kali 2026.2 with python3. Check out commit f0f1913, the last stable Python 2.7 tree, then build with python2 as documented here.

WPA PMK precomputation and handshake attacks are appropriate only on networks you own or are explicitly authorized to test. Capturing handshakes or running Pyrit against neighbor or employer WLANs without permission violates computer misuse laws in most countries.

Finished reading?Beta Get the key takeaways in seconds, then ask follow-up questions
Kennedy Muthii

Information Security Analyst

Accomplished professional proficient in Python, ethical hacking, Linux, cybersecurity, and OSINT. With a track record including winning a national cybersecurity contest, launching a startup in Kenya, and holding a degree in information science, he is currently engaged in cutting-edge research in ethical hacking.

Expertise
  • Python (programming language)
  • Certified Ethical Hacker
  • White Hat (Computer Security)
  • Linux
  • Penetration Testing

Related Articles

security

Android Insecure Data Storage Testing: SharedPreferences, SQLite & Files

Find InsecureShop cleartext SharedPreferences credentials on rooted Genymotion, then practice SQLite and file …

18 min readsecurity

Apktool Tutorial: Decompile, Modify, Rebuild and Sign APKs

Install Apktool 3.0.3 on Kali, decode InsecureShop into resources and Smali, make a harmless label change, …

15 min readsecurity

Drozer Android Pentesting Tutorial

Install Drozer 3.1.0 and the matching Agent on Kali and Genymotion, enumerate InsecureShop components, start …

15 min read