# Cracking Wireless Authentication Hashes

> Crack WPA/WPA2 PSKs from a handshake or PMKID and enterprise MSCHAPv2 hashes with aircrack-ng, hashcat, and asleap.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/cracking-authentication-hashes
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 2
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

Capturing wireless authentication material is only half the attack: you still have to recover the key or credential offline. PEN-210 covers cracking the WPA/WPA2 pre-shared key from a captured four-way handshake, the clientless PMKID attack, and cracking enterprise MSCHAPv2 challenge-response hashes. The exam allows only the default Kali wordlists, so wordlist selection, rules, and mask strategy are what separate a recovered key from a timeout.

## Cracking WPA/WPA2 PSK

With a verified handshake, you crack the PSK offline. aircrack-ng runs a straight dictionary attack; hashcat (after converting the capture to its format) is far faster on a GPU and supports rules, masks, and pre-computed PMK tables via airolib-ng. crunch generates targeted candidate lists, and coWPAtty offers an alternative engine. Applying rules to a base wordlist dramatically widens coverage against human-chosen passwords.

## PMKID Capture and Cracking

The PMKID attack skips the handshake entirely: many APs leak a PMKID in the first message of the association, so hcxdumptool can capture crackable material without any connected client. Converting the capture to a hashcat mode and verifying the hash file yields the same offline crack as a handshake, but without needing to deauthenticate a client.

## Cracking Enterprise MSCHAPv2

WPA Enterprise using PEAP or EAP-TTLS with MSCHAPv2 exposes a challenge-response hash that can be captured (via a rogue AP) and cracked. asleap and hashcat both crack MSCHAPv2, and applying rules improves coverage. Credentials can be extracted directly from a capture file when the exchange was recorded.

## Study material

- [Cracking WPA Handshakes and PMKIDs](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking.md) (read, core)
- [PMKID Capture with hcxdumptool and hcxtools](https://hackindex.io/platforms/wireless/enumeration/pmkid-capture-with-hcxdumptool.md) (read, core)
- [Cracking MSCHAPv2 with Asleap and Hashcat](https://hackindex.io/platforms/wireless/exploitation/cracking-mschapv2-with-asleap-and-hashcat.md) (read, core)