Typorithm · hard

WPA Handshake Capture

wpa-crackingpentestwpahandshakeaircrack

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn WPA Handshake Capture

Wireless

A deauthentication frame (aireplay-ng -0) forces a client to reconnect, letting airodump capture the WPA 4-way handshake. It is then cracked offline against a wordlist with aircrack-ng or hashcat mode 22000. This demonstrates weak-PSK risk; the fix is a long random passphrase or WPA2/3-Enterprise (802.1X).

To capture a WPA handshake you need a client to authenticate. aireplay-ng -0 5 -a AA:BB:CC wlan0mon sends five deauthentication frames to the in-scope AP, knocking a client off so it reconnects and replays the 4-way handshake on the air.

airodump, already locked to that channel and BSSID, records the handshake into the capture file. From here everything is offline — you never touch the AP again, so cracking does not depend on the network.

aircrack-ng -w rockyou.txt cap.cap tries each candidate passphrase against the captured handshake; converting the capture to hc22000 lets hashcat -m 22000 do the same on a GPU much faster. Success means the pre-shared key was guessable, so the defense is a long random passphrase or, better, WPA2/3-Enterprise (802.1X) where each user authenticates individually.

aireplay-ng -0 deauths a client to force a reconnect.

airodump captures the WPA 4-way handshake.

aircrack-ng / hashcat -m 22000 crack it offline.

aireplay-ng -0 5 -a AA:BB:CC wlan0mon
# capture the WPA 4-way handshake in airodump
aircrack-ng -w rockyou.txt cap.cap
hashcat -m 22000 cap.hc22000 rockyou.txt

Read the implementation

Connect each part of the code to the concept before you type.

1. Deauth to force reconnect

aireplay-ng -0 5 sends five deauthentication frames to the AP so a client reconnects, replaying the 4-way handshake on the air.

aireplay-ng -0 5 -a AA:BB:CC wlan0mon

2. Capture the handshake

While the client reconnects, airodump records the WPA 4-way handshake into the capture file.

# capture the WPA 4-way handshake in airodump

3. Crack offline

aircrack-ng tests each word in rockyou.txt against the captured handshake; it never talks to the AP again.

aircrack-ng -w rockyou.txt cap.cap

4. GPU cracking

hashcat mode 22000 cracks the converted WPA handshake on a GPU, far faster than CPU dictionary attacks.

hashcat -m 22000 cap.hc22000 rockyou.txt

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.