WiFi & Wireless Hacking

Both the access point and the client derive the same key from the passphrase and network name, and the proofs they exchange are computed from that key. An attacker captures one of those proofs, then guesses passphrases offline, recomputing the key for each guess until one reproduces the captured value. Nothing contacts the network during guessing, so there is no rate limit.

The PMKID attack captures crackable WiFi material from the access point's own early response, without waiting for a client to connect. Because the access point can leak a PMKID value derived from the key in a single frame, the attack is called clientless: no connected device and no deauthentication are needed to begin offline cracking.

A four-way handshake is captured as a client connects and contains EAPOL messages with a MIC; it often needs a connected client, sometimes forced with a deauth. A PMKID can come from the access point alone with no client. Both are derived from the same master key, so the offline cracking step is identical, and hashcat handles both with mode 22000.

Capturing a handshake or PMKID only enables offline guessing; it does not break the encryption. A long, random passphrase pushes the number of required guesses so high that no attacker hardware finishes in a useful time. Passphrase length and randomness, not the WPA2 label, decide whether a network resists cracking.

Only capture or crack networks you own or have explicit written permission to test. Attacking the WiFi of others is illegal in virtually every country. This course uses a capture file from a lab network so you can learn the technique without touching real networks around you.

Divide the keyspace by your guess rate. The keyspace is the number of candidates you will try (the wordlist line count, or the alphabet size raised to the length for brute force), and the guess rate is how many WPA guesses per second your hardware manages for hashcat mode 22000. If the result is years, switch to a better wordlist and rules instead of waiting.