Four Frames and a Funeral

Wireless Penetration Testing: WPA2 4-Way Handshake Capture

This project documents a wireless penetration testing lab focused on capturing the WPA2 4-way handshake. The goal is to demonstrate the process of identifying a WPA2 network, forcing re-authentication, then capturing the handshake, and finally cracking the hash.

Prerequisites

• You will need a Wi-Fi adapter that is capable of using monitor mode in oder to inject packets.
• Use linux, and you will need the software: airodump-ng, aircrack-ng, aireplay-ng and airmon-ng.

Step 1: Setup your Compatible Wi-Fi Adapter

1. Plugin and get drivers for your adapter if you need to.
2. Run: airmon-ng start wlan0 This puts your device into monitor mode
3. Run: airodump-ng start wlan0
4. If you are seeing data output on the screen from the Wireless networks around you then you move on.

Step 2: Capturing the 4-way Handshake

1. After looking at the output identify your lab network device, and note down the BSSID, ESSID, and channel.c
2. Now that you know more parameters you can tune your command to be more specific and ignore the other unneeded data. airodump-ng -c -b

TODO