Capturing and Cracking a Handshake
airodump to watch, aireplay to deauth, hashcat to crack. The full WPA2 capture pipeline end to end.
What you will learn
- -Capture a WPA2 handshake with airodump-ng and a targeted deauth
- -Convert the capture to a hashcat-ready format
- -Run hashcat mode 22000 against the capture with a wordlist
Three tools, one line of attack: find the target, knock a off so it reconnects, catch the handshake it sends on the way back, then crack it on your GPU. This is the whole aircrack-ng workflow, and it is the single most-run wireless attack in the field. Set up a WPA2 test AP with a passphrase from rockyou.txt and follow along against that.
Start in monitor mode from the first lesson. Confirm wlan0mon is up with iw dev, then survey the air to pick a target.
Find the target
$sudo airodump-ng wlan0monYou want three facts: the AP's BSSID, its channel, and ideally the MAC of one associated client (shown in the STATION column of the lower table). Now lock airodump to that channel and BSSID and write to a file. Locking the channel is not optional. Hopping across channels while you wait for a handshake is how captures missed.
$sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0monLeave that running. The top-right of the screen shows a WPA handshake banner the moment you catch one. To get it fast, you make a client reconnect.
Force the handshake
A deauth frame tells a client to disconnect. It reassociates within seconds and the four-way handshake replays, right into your open capture. In a second terminal:
$sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon$sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0monSend a small burst, five is plenty. Prefer the targeted -c version: it hits one device instead of knocking everyone off, which is quieter and less disruptive. Watch the airodump window for WPA handshake: AA:BB:CC:DD:EE:FF in the top corner. That is your capture. Stop airodump.
Common causes: no client was actually connected (a deauth with no victim produces nothing), you were on the wrong channel, or your card cannot inject. Verify injection with sudo aireplay-ng --test wlan0mon. If it reports 0 injected, the chipset or driver is the problem, not your commands.
Crack it
Modern hashcat wants the 22000 format, not the raw .cap. Convert it with hcxpcapngtool, then run it. Mode 22000 is WPA-PBKDF2-PMKID+EAPOL, the current mode for both handshake and PMKID captures.
$hcxpcapngtool -o hash.22000 capture-01.cap$hashcat -m 22000 hash.22000 /usr/share/wordlists/rockyou.txt$hashcat -m 22000 hash.22000 --showIf you prefer the classic tool, aircrack-ng -w rockyou.txt capture-01.cap cracks straight from the .cap on CPU. It works, but hashcat on a GPU is an order of magnitude faster and takes rules, which the next module covers. Reach for hashcat.
The passphrase either falls to your wordlist in minutes or it does not fall at all. That is the honest outcome of WPA2 cracking: it beats reused and human-memorable and loses to random ones. Your job on an engagement is to prove the runs the former.
Deauthentication is an active denial-of-service against every client you hit, and capturing a handshake is interception. Run this entire pipeline only against an AP you own or one named in a signed . There is no gray area here.
In one word, what state do you force a connected client into so it replays the four-way handshake you want to capture?
The deauth frame drops the client. When it reconnects, the handshake replays into your open airodump capture.