{"id":13307208,"url":"https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking","last_synced_at":"2025-03-10T14:32:37.651Z","repository":{"id":190386021,"uuid":"682466875","full_name":"ZeroDayArcade/capture-handshake-wpa-wifi-hacking","owner":"ZeroDayArcade","description":"A python script for capturing 4-way handshakes for WPA/WPA2 WiFi networks.","archived":false,"fork":false,"pushed_at":"2023-09-24T22:48:50.000Z","size":83,"stargazers_count":20,"open_issues_count":0,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-07-29T18:44:15.556Z","etag":null,"topics":["handshake","handshake-capture","hash-line","hashcat","hashline","hc22000","packet-capture","password","python3","script","wifi-hacking","wifi-hacking-script"],"latest_commit_sha":null,"homepage":"https://zerodayarcade.com/tutorials","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ZeroDayArcade.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-24T08:26:38.000Z","updated_at":"2024-07-26T21:54:24.000Z","dependencies_parsed_at":"2023-09-25T01:56:29.802Z","dependency_job_id":null,"html_url":"https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking","commit_stats":null,"previous_names":["zerodayarcade/capture-handshake-wpa-wifi-hacking"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ZeroDayArcade","download_url":"https://codeload.github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242868592,"owners_count":20198508,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["handshake","handshake-capture","hash-line","hashcat","hashline","hc22000","packet-capture","password","python3","script","wifi-hacking","wifi-hacking-script"],"created_at":"2024-07-29T17:59:34.964Z","updated_at":"2025-03-10T14:32:37.397Z","avatar_url":"https://github.com/ZeroDayArcade.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Capturing a 4-Way Handshake from WPA/WPA2 WiFi Networks with a Python Script\nA python script for capturing 4-way handshakes for WPA/WPA2 WiFi networks.\n\nTo crack passwords from the captured handshake data obtained by this script, see our other repo:\n\u003ca href=\"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake\"\u003eCracking WPA/WPA2 WiFi Passwords from a Captured Handshake\u003c/a\u003e\n\nThis script will produce hash lines in the hashcat hc22000 format that can be cracked with hashcat or with the script referenced above. It is built for simplicity and comprehension and is meant to help those looking to build their own hacking tools get started with a bare-bones example.\n\nYou will need a WiFi adapter capable of monitor mode. I tested this with three different adaptors including \u003ca href=\"https://www.amazon.com/GenBasic-Wireless-Network-Dongle-Adapter/dp/B0BNFKJPXS/\"\u003ethis one for less than $10 on Amazon\u003c/a\u003e. I recomend running this script on a Linux distribution, and have successfully tested it with Kali Linux on Intel and Raspian on a Raspberry Pi 4 (ARM). If you are running macOS or Windows, then you can use the script with a Virtual Machine running Kali or other distributions with VirtualBox or VMWare. \n\n***Reminder:** Only ever hack a network that you own and have legal permission to hack. Any hacking skills/knowledge gained from this repository should only be used within the context of security research, penetration testing, password recovery, and education.* \n\n## Setting up a test WiFi Network\n\n`capture_handshake.py` will work with many common wireless routers as well as access points created with development boards like the ESP8266 NodeMCU. Depending on your exact setup you may have to tweak some variables in the script slightly, but I have tested it on several systems successfully.\n\nOne of the cheapest and easiest ways to practice WiFi hacking is with an ESP8266 NodeMCU development board. These boards can be picked up from Amazon and other sites for just a few dollars and there are a ton of online examples and tutorials for them. They are compatable with the Arduino IDE and can act as a soft Access Point with just a few lines of code. In other words, you can use them to create WiFi networks that you can then hack. This makes them ideal for anyone wanting to start practicing WiFi network penetration testing without breaking the bank. Here is a link to the \u003ca href=\"https://www.amazon.com/KeeYees-Internet-Development-Wireless-Compatible/dp/B07HF44GBT/\"\u003eexact ESP8266 NodeMCUs\u003c/a\u003e I used to test this script with, only ~$5 per unit at the time of this writing. Larger packs can be as low as $2.50 a unit.\n\nI've included an optional Arduino IDE compatable `ZDA_WiFi.ino` file with this project that you can upload to an ESP8266 NodeMCU to create a test WiFi network to practice with. It is set with SSID = `ZDA WiFi` and password = `12345678`. You can use it with the instructions below to practice capturing and cracking 4-way handshakes just like you would with a commercial wireless router. For instructions on compiling and uploading code to these boards with the Arduino IDE 2.0 see \u003ca href=\"https://randomnerdtutorials.com/installing-esp8266-nodemcu-arduino-ide-2-0/\"\u003ethese instructions\u003c/a\u003e, select board **NodeMCU 1.0 (ESP-12E Module)** in the Arduino IDE when compiling/uploading.\n\n## Getting and running the script\nClone the project:\n```\ngit clone https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking.git\n```\ncd into project directory:\n```\ncd capture-handshake-wpa-wifi-hacking\n```\nPut your WiFi adapter into monitor mode. Let's say your WiFi interface is called `wlan1`:\n```\nsudo ifconfig wlan1 down\n```\n```\nsudo iwconfig wlan1 mode monitor\n```\n```\nsudo ifconfig wlan1 up\n```\nWith a WiFi network setup up for penetration testing, you can run this script to capture a handshake and crack the resulting hash line to get the password of the network. Let's say you've set up a test WiFi network with SSID = `ZDA WiFi` and password = `12345678`. Before you run the script, verify that you can connect to the AP with the password `12345678` on a seperate device such as a phone or with the internal WiFi adapter of your computer (the one you're not using for monitor mode!). Once you've confirmed the AP is set up correctly and you can connect to it, disconnect your phone/extra device from the AP for the test. Then run `capture_handshake.py` and wait for a handshake with:\n```\nsudo python3 capture_handshake.py wlan1 \"ZDA WiFi\"\n```\n**Note:** this assumes there is only one network in range with that name. If more than one, you can specify the MAC address with:\n```\nsudo python3 capture_handshake.py wlan1 \"ZDA WiFi\" \u003cMAC_ADDRESS_AP\u003e\n```\nThis will listen for devices connecting to `ZDA WiFi`. Reconnect to the network with your seperate device. When you do, the script will take packets/frames from the 4-way handshake and then print a hashcat hc22000 format hash line in Terminal once captured. The hash line will also be saved/create a file named hashline.txt containing the hash line from the captured handshake. You can then use that hash line with hashcat or our \u003ca href=\"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake\"\u003ehandshake cracking script\u003c/a\u003e to crack the password of the network which should yield the `12345678` password in this example. Of course you can always have someone else set the password so you don't know what it is before hand, and then try to capture and crack a handshake from the network for the unknown password.\n\n## Using a Half-Handshake vs. Full Handshake\n\nThe script will construct the hash line from the first 2 messages of the handshake. This is sufficient in most cases. Assuming the connecting device (phone/extra device in the example above) is connecting with the correct password, it will be possible to crack the resulting hash line to get the real password of the network. If the connecting device attempts to connect with the wrong password, the script will run normally but the hash line will obviously not contain the real password. \n\nYou can easily modify the script to use the `mic` and `eapol_client` from the 4th message instead. If you want to use the data from the 4th message and still crack the handshake with `crack_handshake.py` and `passlist.txt` from the \u003ca href=\"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake\"\u003eCracking WPA/WPA2 WiFi Passwords from a Captured Handshake\u003c/a\u003e repo, you'll need to pass in all the variables to `crack_handshake()` explicitly instead of using the hash line.\n\nFor example, if `crack_handshake.py` and `passlist.txt` are in the same directory as `capture_handshake.py`, you can add the following lines to `capture_handshake.py` under `elif message_num == 4 and data_from_cl:`\n```\nsys.argv = [sys.argv[0]]\nimport crack_handshake as ctools\neapol_client = b''.join([eapol_frame_before_mic, bytearray(16), wpa_length])\nctools.crack_handshake(mic, mac_ap, mac_cl, bytes(essid, 'utf-8'), nonce_ap, nonce_cl, eapol_client)\n```\nto capture *and* crack the handshake when you run `capture_handshake.py`.\n\nYou do this when cracking with message 4 data instead of running `crack_handshake.py` with a hash line because `crack_handshake.py` pulls `nonce_cl` from the `eapol_client` part of the hash line before running the cracking function. Doing this works when cracking with message 2 because `nonce_cl` is included in the `eapol_client` of message 2, but `nonce_cl` is not in the `eapol_client` of message 4 and thus `nonce_cl` must be passed in explicitly.\n\u003cbr/\u003e\n\n# More Zero Day Arcade Tutorials:\n**Learn Reverse Engineering, Assembly, Code Injection and More:**  \n🎓  \u003ca href=\"https://zerodayarcade.com/tutorials\"\u003ezerodayarcade.com/tutorials\u003c/a\u003e \n\n**More WiFi Hacking with Simple Python Scripts:**  \n\u003ca href=\"https://github.com/ZeroDayArcade/capture-pmkid-wpa-wifi-hacking\"\u003eCapturing PMKID from WiFi Networks\u003c/a\u003e  \n\u003ca href=\"https://github.com/ZeroDayArcade/wpa-password-cracking-with-pmkid\"\u003eCracking WiFi Passwords with PMKID\u003c/a\u003e   \n\u003ca href=\"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake\"\u003eCracking WPA/WPA2 Passwords with 4-Way Handshake\u003c/a\u003e  \n\n\n\n\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FZeroDayArcade%2Fcapture-handshake-wpa-wifi-hacking/lists"}