📶four frames and a funeral

Four Frames and a Funeral

Capturing and cracking a WPA2-PSK handshake on a network I am legally allowed to be mean to.

Category: Wireless / WPA2-PSK Target: SpectrumSetup-E8 — a decoy AP I stood up myself, mimicking the local Charter/Spectrum/Netgear default SSID naming. BSSID 74:93:DA:XX:XX:XX (masked) Authorization: Every AP here is my own decoy. I live rural — one real network in radio range, not a Spectrum gateway, not touched. Rig: Parrot OS + Realtek RTL8812AU (88XXau driver) in monitor mode Toolchain: airmon-ng · airodump-ng · aireplay-ng · hcxpcapngtool · hashcat Body count: four EAPOL frames, one deauthed doorbell, one recovered passphrase Date: 2026-04-30

A word from my lawyer

Before anyone gets ideas: every access point in this writeup is one I built. I live deep enough into the countryside that my radio neighborhood contains exactly one real network, and it isn't a Spectrum gateway and isn't anywhere in these captures. The SpectrumSetup-* APs you see are decoys I stood up myself — same default SSID naming the local ISP gear uses, same weak-passphrase pattern (much more on that below) — so I could practice against a realistic regional target surface without ever touching anyone else's network. The deauthed client is my own Ring doorbell. The passphrases are mine, seeded on purpose.

If you run any of this against a network that isn't yours, the only writeup you'll be publishing is your statement to a judge. Capturing a handshake off someone else's AP and cracking it is unauthorized access, full stop, and "it was for my portfolio" has never once worked as a defense. Build your own range. Then be as mean to it as you like.

Disclaimer over. On with the funeral.

The premise

Here's the dirty secret WPA2-PSK has been keeping in plain sight since 2004: the entire security of the network rests on one passphrase. Capture the four-way handshake — the little cryptographic handshake-of-trust a client and AP perform when the client joins — and the AP has effectively handed you an IOU. You take that IOU home and brute-force it offline, on your own time, on your own GPU, where the AP can't rate-limit you, can't lock you out, and will never know it happened.

My friend insists his wifi is uncrackable because the password is "really long." My friend's password is his dog's name and the year he graduated. We'll come back to my friend.

For this lab the target is one of my decoys, SpectrumSetup-E8, seeded with a passphrase that follows the template the real gear out here loves: adjective + noun + three digits. (Yes, that's a real convention. Yes, it's as bad as it sounds. There's a whole section on it below.) I'm not here to prove I can crack a password I already know. I'm here to show how little stands between a captured handshake and a recovered key the moment the key follows a guessable template — and how an entire ISP footprint can end up sharing that one template.

Four frames. One funeral. Let's go.

Step 1 — Monitor mode (teaching the card to mind everyone's business)

A normal Wi-Fi card only listens to traffic addressed to it, like a polite guest. Monitor mode tells the card to stop being polite and start reading the whole room.

$ sudo airmon-ng

PHY     Interface       Driver  Chipset
phy0    wlx00c0cab11d8a 88XXau  Realtek RTL8812AU 802.11a/b/g/n/ac 2T2R DB WLAN Adapter

$ sudo airmon-ng start wlx00c0cab11d8a

airmon-ng immediately rats out two processes — wpa_supplicant and NetworkManager — which exist for the sole purpose of undoing whatever you just did, by helpfully flipping your card back to managed mode and channel-hopping at the worst possible moment. Send them to the funeral early:

$ sudo airmon-ng check kill

Bringing the RTL8812AU up in monitor mode

(monitor mode enabled) — the card is now reading the whole neighborhood. Onward.

Step 2 — Recon (find the body before you bury it)

$ sudo airodump-ng wlx00c0cab11d8a

This dumps every AP and client in earshot. Worth noting how loud a residential block is — a dozen-plus networks, half of them ISP-default SpectrumSetup-XX gateways, all broadcasting their BSSIDs to anyone who asks. (I've left the neighbors' identifiers in the screenshot because BSSIDs are broadcast publicly anyway, but if you publish your own version, crop to your target. Be a good neighbor; don't be a WiGLE entry.)

airodump-ng — the whole noisy block, target in the pile

The one that matters is mine:

BSSID                 CH   ENC   CIPHER  AUTH   ESSID
74:93:DA:XX:XX:XX     6    WPA2  CCMP    PSK    SpectrumSetup-E8

Note the channel (6) and the BSSID — those tune the next command so I stop drinking from the firehose and point airodump at exactly one network:

$ sudo airodump-ng -c 6 --bssid 74:93:DA:XX:XX:XX -w capture wlx00c0cab11d8a

Now I'm parked on channel 6, recording only my own AP, writing everything to capture-01.cap. And I wait for a client to authenticate — or, because I'm impatient and this is a funeral after all, I make one.

Step 3 — The funeral (deauth)

WPA2 has a charming design quirk: management frames aren't authenticated. That means I can forge a deauthentication frame that looks like it came from the AP and politely inform a client that it's been kicked off. The client, being trusting, believes me, drops the connection — and then immediately tries to reconnect, performing a brand-new four-way handshake right in front of my recording.

I don't wait for the handshake. I schedule the funeral and the handshake shows up for it.

$ sudo aireplay-ng --deauth 5 -a 74:93:DA:XX:XX:XX -c 90:48:6C:XX:XX:XX wlx00c0cab11d8a

-a is the AP (my gateway).
-c is the client I'm evicting — in this case my own Ring doorbell, which has now been rebooted more times for science than for any actual doorbell-related reason.

Five frames of "you're not on the guest list" and the doorbell scrambles to reconnect.

Step 4 — Four frames

The reconnection triggers the four-way handshake. Four EAPOL frames — Message 1 through Message 4 — and the part I actually need lives in the first two. I confirm the capture in Wireshark with the world's simplest display filter:

eapol

The four-way handshake — all four EAPOL frames, captured

There they are: Message 1 of 4, 2 of 4, 3 of 4, 4 of 4, between the AP and the doorbell. This is the titular four frames. Everything before this was logistics; this is the handshake that turns into a crackable hash. The doorbell never knew it attended its own funeral.

Step 5 — Cracking it (the offline part where the AP can't help anymore)

hashcat wants the handshake in its 22000 format, not raw pcap. Convert it:

$ hcxpcapngtool -o handshake.hc22000 capture-01.cap

Then point hashcat at it. The realistic attack — the one that works without knowing the word in advance — is a hybrid: feed the adjective+noun combinations from NetgearKiller.dict and let hashcat staple a 3-digit mask onto each one:

$ hashcat -m 22000 handshake.hc22000 -a 6 NetgearKiller.dict '?d?d?d'

-m 22000 → WPA-PBKDF2-PMKID+EAPOL
-a 6 → hybrid wordlist + mask
NetgearKiller.dict → the adjective+noun base words modeling the regional pattern
?d?d?d → the three trailing digits, all 1,000 combinations per word

(In the screenshot below I cut a corner for time — since it's my own decoy and I knew the exact base word, I ran it as a pure mask <word>?d?d?d, which is why hashcat reports a 1,000-candidate keyspace and a 0-second crack. Let NetgearKiller.dict do the word-guessing instead and the keyspace becomes len(dict) × 1000 — still trivial, just less of a layup. Math's in the threat model.)

hashcat: Status...... Cracked (passphrase redacted — it's my live network)

Status.....: Cracked. Search space was 1,000 candidates. Time elapsed: 0 seconds. The GPU didn't break a sweat — Temp: 65c, which is cooler than it runs playing a YouTube video. The passphrase is redacted not because it's precious but because the pattern is the finding, not the specific word — and printing a working example just hands the next person a copy-paste.

Threat model: the NetgearKiller pattern

Here's the part actually worth your attention — and the reason I built a whole street of fake Spectrum APs instead of just one.

Out here on the East Coast, a lot of the ISP-provisioned and consumer gear — Netgear units, Charter/Spectrum-branded ones — ends up with passphrases that follow a recognizable template:

adjective + noun + ###

brightcanyon402. coldriver118. chillyspoon232. Human-memorable, vendor-encouraged, and catastrophic for the defender, because it converts a theoretically enormous keyspace into a tiny, structured one. That structure is exactly what NetgearKiller.dict exists to exploit.

The keyspace math. A genuinely random 12-character passphrase lives in a space of roughly 95¹² ≈ 5.4 × 10²³ candidates — not happening on a home rig before the sun burns out. The pattern above is a different universe:

candidates ≈ (#adjectives × #nouns) × 10³

NetgearKiller.dict holds the adjective+noun combinations; the ?d?d?d hybrid mask supplies the final three digits (1,000 options each). Even a generous list — a few thousand word-pairs — lands you in the low millions of candidates total. At the ~6,500 H/s this modest Realtek-plus-CPU combo managed, that's seconds to a couple of minutes. On a real cracking rig it's a rounding error.

Why the convention is the vulnerability, not the password. The failure here isn't one bad passphrase — it's that a naming-and-passphrase convention shared across an ISP's footprint means one wordlist generalizes to thousands of homes. Read the SSID (SpectrumSetup-XX tells you the gear and the region) and you already know which list to reach for before you've captured a single frame. That's the part that should keep a defender up at night: the attacker isn't guessing your password, they're guessing your vendor's habit — and you inherited it whether you knew or not.

What actually breaks it: a long random passphrase (kills the dictionary), WPA3-SAE (kills the offline attack outright), and — for the vendors — not shipping a guessable template in the first place.

Findings

(Humor's done. This part's straight, because the lesson is the whole point.)

WPA2-PSK is only as strong as its passphrase. The protocol crypto is fine; the captured handshake is not directly reversible. The weakness is entirely in human-chosen passphrases. A real word plus a few digits collapses to a trivially small search space — here, 1,000 candidates cracked instantly.
The four-way handshake is offline-crackable once captured. No further interaction with the AP is needed after capture. Rate-limiting, lockouts, and AP-side monitoring are irrelevant to an offline attack.
Deauthentication makes capture cheap. Unauthenticated management frames let an attacker force a re-handshake on demand rather than waiting for an organic client connection. 802.11w (Protected Management Frames) mitigates this, but it is not universally enabled.
IoT clients are reliable handshake sources. Always-on devices (cameras, doorbells, plugs) reconnect predictably after a deauth, giving an attacker a dependable trigger.

Mitigations

Use a long, random passphrase (20+ characters, no dictionary words). This is the single highest-impact control and defeats both wordlist and mask attacks by exploding the search space.
Move to WPA3-SAE where supported. SAE (Dragonfly) is resistant to offline dictionary attacks against captured exchanges.
Enable 802.11w / Protected Management Frames to blunt deauthentication attacks.
Treat the SSID/BSSID as semi-public and don't reuse a guessable passphrase pattern across networks.

Housekeeping / OPSEC notes

Every AP in this writeup is a decoy I stood up myself; the BSSID and recovered passphrase are still masked/redacted, since the point is the pattern, not any specific credential.
The decoys and their capture artifacts are disposable lab gear — nothing here is a live production network or a real person's credentials.
The wifite run from this session is deliberately left out: it automates the whole chain into one command, and the manual aircrack-ng workflow above is both more instructive and the better story. (It hit another of my own SpectrumSetup-* decoys, not anyone else's gear.)

Epilogue: my friend

Remember my friend, the one with the uncrackable "really long" password that turned out to be his dog's name and a graduation year? That's a twelve-character dictionary-word-plus-digits passphrase. That's a mask attack with a wordlist prefix. That's a Tuesday.

I didn't crack my friend's network, because my friend's network isn't mine and I've already given that speech once in this document. But I did show him this writeup. He changed his password.

It's now his other dog's name and a graduation year.

We're going to talk about my friend again in the next lab.