offensive-wpa2-psk

WPA/WPA2-PSK Attacks

The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).

Quick Workflow

1. Identify the target BSSID, channel, and encryption (see offensive-wifi-recon)
2. Try PMKID first (fast, no client interaction)
3. Fall back to four-way handshake capture if PMKID isn't yielded
4. Convert capture to hashcat-compatible format
5. Crack offline with appropriate wordlist + rules + masks

PMKID Attack (Preferred When Possible)

The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.

# Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set

targets.txt contains BSSIDs (one per line) you're authorized to attack.

If hash.hc22000 is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.

Four-Way Handshake Capture

If a client is associated:

The handshake will appear in airodump's top-right corner as WPA handshake: AA:BB:CC:DD:EE:FF.

Why one client at a time: broadcast deauth (no -c) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.

Verifying the Capture

If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.

Cracking

Dictionary + Rules

Useful wordlists:

• rockyou.txt (classic)
• weakpass_3 / weakpass_4 (huge breach corpus)
• crackstation.txt
• Targeted: company name, products, locations

Mask Attacks for Common Default Patterns

Vendor Default Generators

Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:

802.11r FT Cracking

If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.

Tuning Cracking Performance

Opportunistic Key Cache (OKC)

When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.

Detection Considerations

To minimize: PMKID with --filtermode=2 (only target your authorized list), single targeted deauth bursts, randomize source MAC between captures.

Engagement Cheatsheet

Key References

• hashcat docs (mode 22000): hashcat.net/wiki/doku.php?id=cracking_wpawpa2
• hcxtools: github.com/ZerBea/hcxtools
• ZerBea PMKID research (original 2018 disclosure)
• 802.11i-2004 (WPA2 spec)
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md