Capturing handshakes is one of the core steps in wireless pentesting. A handshake contains the cryptographic information exchanged when a client connects to a WPA/WPA2/WPA3 transition-mode network. For WPA2-PSK networks, capturing the 4-way handshake allows offline password cracking. For PMKID-based captures, the handshake can be collected even without clients connected. Understanding both methods is essential for successful Wi-Fi attacks.

Understanding the 4-Way Handshake

When a client connects to a WPA/WPA2 network:

1. The AP and client exchange nonces

2. They generate the Pairwise Transient Key (PTK)

3. The client confirms the key

4. The AP installs encryption keys

This exchange is visible in the air and can be captured when a device connects.

The handshake does not contain the password, but it allows offline attempts to guess the password.

Preparing the Wireless Adapter

Before capturing any handshake, the wireless adapter must be placed in monitor mode.

Enable Monitor Mode

sudo airmon-ng start wlan0

Monitor mode allows capturing raw 802.11 frames.

Confirm Monitor Mode

iwconfig

Look for wlan0mon as the new interface.

Scanning for Targets

Identify the target access point (AP), its channel, and connected clients.

Scan with Airodump-ng

sudo airodump-ng wlan0mon

Note:

• BSSID (AP MAC)

• Channel

• Encryption (WPA/WPA2)

• Connected clients (STATION column)

Clients are needed for capturing a handshake unless performing a PMKID attack.

Focused Handshake Capture

Capture only the target AP on its channel for stable results.

Focus Airodump-ng on One AP

sudo airodump-ng -c <channel> --bssid <AP_MAC> -w capture wlan0mon

This writes all traffic, including handshakes, to capture.cap.

Capturing the Handshake Through Natural Reconnection

If a client naturally disconnects and reconnects, a handshake is captured automatically.

Capture indicators in Airodump-ng:

• WPA handshake: followed by the AP MAC

• Screen updates showing [WPA Handshake: <AP_MAC>]

However, waiting for natural reconnections can be slow.

Forcing Handshake Capture (Deauthentication)

A controlled deauth forces clients to reconnect, generating a handshake instantly.

Send Deauth Packets

sudo aireplay-ng --deauth 10 -a <AP_MAC> wlan0mon

If a specific client is known:

sudo aireplay-ng --deauth 10 -a <AP_MAC> -c <CLIENT_MAC> wlan0mon

Clients reconnect, and the handshake appears in Airodump-ng within seconds.

PMKID Capture (No Clients Needed)

Some routers leak a PMKID during the first interaction, allowing a handshake-like capture without clients.

PMKID Capture with hcxdumptool

sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

Extract PMKID

sudo hcxpcapngtool -o pmkid.txt pmkid.pcapng

PMKID attacks help when:

• No clients are connected

• Deauth protection is enabled

• WPA3 transition mode is used

Validating the Handshake

Before cracking, ensure the handshake is valid.

Validate with Aircrack-ng

sudo aircrack-ng capture.cap

Aircrack-ng will confirm:

• MIC presence

• Handshake completeness

• Matching MAC addresses

Valid handshakes are essential for successful cracking.

Saving Captures for Later

Handshakes are stored in .cap or .pcapng files. These can be analyzed or cracked offline.

Convert Capture for Hashcat

sudo hcxpcapngtool -o hash.hc22000 capture.cap

This prepares the handshake for cracking attempts.

Why Capturing Handshakes Matters

Handshake capture is the most important phase of WPA/WPA2 pentesting. Attackers use it to:

• Perform offline password attacks

• Evaluate password strength

• Test network resilience

• Identify weak configurations

• Bypass live protections (rate limits, lockouts)

Capturing a handshake is the first required step before attempting to break WPA2-PSK security.

Intel Dump

• Handshakes allow offline password cracking

• Monitor mode required for capture

• Airodump-ng focuses on AP and clients

• Aireplay-ng forces reconnection with deauth

• PMKID capture works even without clients

• Handshake validation ensures usable captures