OSWP · Module 9

Cracking Wireless Authentication Hashes

Crack WPA/WPA2 PSKs from a handshake or PMKID and enterprise MSCHAPv2 hashes with aircrack-ng, hashcat, and asleap.

~2 h 3 resources Last updated September 27, 2026

Capturing wireless authentication material is only half the attack: you still have to recover the key or credential offline. PEN-210 covers cracking the WPA/WPA2 pre-shared key from a captured four-way handshake, the clientless PMKID attack, and cracking enterprise MSCHAPv2 challenge-response hashes. The exam allows only the default Kali wordlists, so wordlist selection, rules, and mask strategy are what separate a recovered key from a timeout.

Cracking WPA/WPA2 PSK

With a verified handshake, you crack the PSK offline. aircrack-ng runs a straight dictionary attack; hashcat (after converting the capture to its format) is far faster on a GPU and supports rules, masks, and pre-computed PMK tables via airolib-ng. crunch generates targeted candidate lists, and coWPAtty offers an alternative engine. Applying rules to a base wordlist dramatically widens coverage against human-chosen passwords.

PMKID Capture and Cracking

The PMKID attack skips the handshake entirely: many APs leak a PMKID in the first message of the association, so hcxdumptool can capture crackable material without any connected client. Converting the capture to a hashcat mode and verifying the hash file yields the same offline crack as a handshake, but without needing to deauthenticate a client.

Cracking Enterprise MSCHAPv2

WPA Enterprise using PEAP or EAP-TTLS with MSCHAPv2 exposes a challenge-response hash that can be captured (via a rogue AP) and cracked. asleap and hashcat both crack MSCHAPv2, and applying rules improves coverage. Credentials can be extracted directly from a capture file when the exchange was recorded.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Mark Cracking WPA Handshakes and PMKIDs as done

Guide 5 min read
Cracking WPA Handshakes and PMKIDs
Focus on #Convert the Capture to Hashcat Format #Crack with aircrack-ng and a Wordlist #WPA Cracking with hashcat and a Wordlist #Apply Rules for Better Coverage #Generate Candidates with crunch #Pre-Computed PMK Tables with airolib-ng #Crack with coWPAtty
Mark PMKID Capture with hcxdumptool and hcxtools as done

Guide 3 min read
PMKID Capture with hcxdumptool and hcxtools
Focus on #Install hcxdumptool and hcxtools #Stop Interfering Services #PMKID Capture with hcxdumptool #Target a Single AP #Convert the Capture for Hashcat #Verify the Hash File #Check the Capture Metadata
Mark Cracking MSCHAPv2 with Asleap and Hashcat as done

Guide 3 min read
Cracking MSCHAPv2 with Asleap and Hashcat
Focus on #Crack MSCHAPv2 with asleap #Crack MSCHAPv2 with hashcat #Apply Rules for Better Coverage #Extract Credentials from a Capture File Directly #When MSCHAPv2 Cracking Fails