{"id":13307207,"url":"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake","last_synced_at":"2025-03-10T14:32:37.340Z","repository":{"id":190087617,"uuid":"681895807","full_name":"ZeroDayArcade/cracking-wpa-with-handshake","owner":"ZeroDayArcade","description":"A python script for cracking WPA/WPA2 PSK passwords with a captured handshake","archived":false,"fork":false,"pushed_at":"2023-09-24T22:46:31.000Z","size":67,"stargazers_count":9,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-07-29T18:44:16.077Z","etag":null,"topics":["handshake","handshake-cracker","handshake-cracking","hashcat","hashline","hc22000","password","password-cracking","python","script","wifi-hacking","wifi-hacking-script","wpa2-cracking"],"latest_commit_sha":null,"homepage":"https://zerodayarcade.com/tutorials","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ZeroDayArcade.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-08-23T02:04:36.000Z","updated_at":"2024-07-16T13:10:30.000Z","dependencies_parsed_at":"2023-09-25T01:55:16.057Z","dependency_job_id":null,"html_url":"https://github.com/ZeroDayArcade/cracking-wpa-with-handshake","commit_stats":null,"previous_names":["zerodayarcade/cracking-wpa-with-handshake"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcracking-wpa-with-handshake","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcracking-wpa-with-handshake/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcracking-wpa-with-handshake/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ZeroDayArcade%2Fcracking-wpa-with-handshake/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ZeroDayArcade","download_url":"https://codeload.github.com/ZeroDayArcade/cracking-wpa-with-handshake/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":242868590,"owners_count":20198507,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["handshake","handshake-cracker","handshake-cracking","hashcat","hashline","hc22000","password","password-cracking","python","script","wifi-hacking","wifi-hacking-script","wpa2-cracking"],"created_at":"2024-07-29T17:59:34.957Z","updated_at":"2025-03-10T14:32:37.021Z","avatar_url":"https://github.com/ZeroDayArcade.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Cracking WPA/WPA2 WiFi Passwords from a Captured Handshake\nA python script for cracking WPA/WPA2 PSK passwords with a captured handshake.  \n\nFor capturing a handshake, see the other repo: \u003ca href=\"https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking\"\u003eCapturing a 4-Way Handshake from WPA/WPA2 WiFi Networks with a Python Script\u003c/a\u003e.\n\nThis script can crack WiFi passwords for WPA and WPA2 networks when supplied with information contained within captured packets from a 4-way handshake. In other words when supplied with: \n1. MIC\n2. SSID\n3. MAC address of the Access Point (AP)\n4. MAC address of the Client\n5. Nonce for the AP\n6. EAPoL of Client (which includes Nonce for Client)\n\nalong with a passwords list.\n\nA sample list of the top 100 passwords is included for testing. In a real world scenario, you'd typically use a much larger list. This script is for demonstration purposes and built for comprehension over speed. It is meant to help those looking to build their own cracking tools get started with a bare-bones example.\n\n***Reminder:** Only ever hack a network that you own and have legal permission to hack. Any hacking skills/knowledge gained from this repository should only be used within the context of security research, penetration testing, password recovery, and education.* \n\n## Background Information\n\nWhen a client machine connects to an access point (AP) such as a wireless router, a 4-way handshake takes place. Packets from this exchange can be captured by a third party listening for packets with a wireless adapter set to monitor or promiscuous mode. Contained within these packets is the information above, which ultimately contains the password to the WiFi network if the network is secured with a PSK. The reason this is not normally an issue is because the password is scrambled through several layers of encryption making the information seemingly useless.\n\nHowever, the hashing functions that mask the true password can be used in conjunction with a list of common passwords in order to potentially crack the password and gain unauthorized access to the network. A hacker can take a list of potential passwords and run each one through the same hashing functions the access point uses to see if any produce the same MIC value that was captured in the 4-way handshake. If any of them do, then the hacker knows that they have the correct password. \n\nNote that this is much different than attempting to login to the network by typing in different passwords and seeing if any of them work. This process happens offline. Once the MIC and other information is obtained from the handshake, the hacker can make as many attempts as they want to find the password without having to interact with the Access Point again until they're ready to connect with the cracked password.\n\n\n## How the script works\n\nYou can use our \u003ca href=\"https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking\"\u003eWPA/WPA2 Handshake Capture script\u003c/a\u003e to obtain a MIC (+Nonces and EAPoL frames) from an AP with a ~$10 WiFi adapter. This will also produce a `WPA*02` hashcat hc22000 format hash line that you can run directly with this script (see below). Alternatively you can obtain this information with \u003ca href=\"https://github.com/ZerBea/hcxdumptool\"\u003ehcxdumptool\u003c/a\u003e or the \u003ca href=\"https://github.com/risinek/esp32-wifi-penetration-tool\"\u003eESP32 Wi-Fi Penetration Tool\u003c/a\u003e.\n\nThis script (`crack_handshake.py`) does the password cracking that comes after the MIC / Nonces/ EAPoL frames have been obtained from the Access Point.\n\nTo generate a potential matching MIC with a test password from the passwords list, the following steps are taken:\n1. A PMK (Pairwise Master Key) is computed using a cryptographic function called PBKDF2 with the test password and SSID as inputs\n2. A PTK is then calculated from the PMK, the MAC addresses from the AP and Client, and Nonces from the AP and Client as inputs.\n3. A MIC is then computed from the first 16 bytes of the PTK (the KCK), and data from an EAPoL frame.\n\nIn order to crack a password, `crack_handshake.py` simply loops through a list of likely passwords and does the above 3 steps with each test password until a matching MIC is found. It is essentially a less sophisticated, CPU-based way of doing something similar to what hashcat does with a dictionary attack in hash mode 22000 with known MIC + Nonces + EAPoL frames.\n\nPersonally, I like to have short and simple code examples to build off of, or to port to other languages. All of the code uses only standard python libraries. There's only about ~70 total lines of python, and without print statements and spaces it's closer to ~40 lines total.\n\n## Running the script\n\nThis script is built to work with hashcat hash lines (hc22000 format) out of the box. For those unfamiliar, these hash lines contain all of the information described above when they start with `WPA*02`. To attempt a crack with one of these hash lines simply run:\n```\npython3 crack_handshake.py \"\"\"\u003cWPA02_HASHCAT_HC22000_FORMAT_HASHLINE\u003e\"\"\" \u003cPASSWORD_LIST_SRC\u003e\n```\n**IMPORTANT:** When running the script in this manor make sure to use triple quotes around the hash line. Otherwise characters like `*` in the hash line can cause the script to run incorrectly and can cause weird problems in your Terminal. \n\nNote that `\u003cPASSWORD_LIST_SRC\u003e` can be ommited to simply use the sample `passlist.txt` file that comes with this repo.\n\nThe script can also be imported by other python scripts and the `crack_handshake()` function can be supplied with parameters like so: \n```\ncrack_handshake(mic, mac_ap, mac_cl, essid, nonce_ap, nonce_cl, eapol_client)\n```\nThe function expects each parameter to be a valid byte string.\n\n## Getting and Testing the Script:\nClone the project:\n```\ngit clone https://github.com/ZeroDayArcade/cracking-wpa-with-handshake.git\n```\ncd into project directory:\n```\ncd cracking-wpa-with-handshake\n```\nTest the script with a hashcat example:\n```\npython3 crack_handshake.py \"\"\"WPA*02*024022795224bffca545276c3762686f*6466b38ec3fc*225edc49b7aa*54502d4c494e4b5f484153484341545f54455354*10e3be3b005a629e89de088d6a2fdc489db83ad4764f2d186b9cde15446e972e*0103007502010a0000000000000000000148ce2ccba9c1fda130ff2fbbfb4fd3b063d1a93920b0f7df54a5cbf787b16171000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac028000*a2\"\"\" passlist.txt\n```\n\nAnother hashcat example from the hashcat forums (\u003ca href=\"https://hashcat.net/forum/thread-10253-page-2.html\"\u003eSource\u003c/a\u003e):\n\n```\npython3 crack_handshake.py \"\"\"WPA*02*1709ba709b92c3eb7b662036b02e843c*6c5940096fb6*64cc2edaeb52*6c686c64*ca37bb6be93179b0ce86e0f4e393d742fca6854ace6791f29a7d0c0ec1534086*0103007502010a00000000000000000001f09960e32863aa57ba250769b6e12d959a5a1f1cc8939d6bed4401a16092fa72000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001630140100000fac040100000fac040100000fac020000*00\"\"\"\n```\n\nOur sample password list is enough to successfully crack both of these examples. And of course you can always supply your own passwords list, or add your own passwords to passlist.txt. \n\nThis script was tested on several versions of Linux including Kali Linux running on a x86-64 Intel machine and Raspian (on a Raspberry Pi 4/ARM processor) as well as on macOS and Windows. It was tested with hashcat examples from the hashcat forums and with real captured frames from a simple penetration test with a weak password. It should work on pretty much everything running Python 3, and was tested with Python 3.7 through 3.11.\n\n\n## Acknowledgements\n`passlist.txt` is a sample list taken from the top 100 most common passwords put together by Daniel Miessler. I've added \"hashcat!\" to the list for the example hash. See the original list here:\nhttps://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10-million-password-list-top-100.txt\n\n\u003cbr/\u003e  \n\n# More Zero Day Arcade Resources:\n**Learn Reverse Engineering, Assembly, Code Injection and More:**  \n🎓  \u003ca href=\"https://zerodayarcade.com/tutorials\"\u003ezerodayarcade.com/tutorials\u003c/a\u003e \n\n**More WiFi Hacking with Simple Python Scripts:**  \n\u003ca href=\"https://github.com/ZeroDayArcade/capture-pmkid-wpa-wifi-hacking\"\u003eCapturing PMKID from WiFi Networks\u003c/a\u003e  \n\u003ca href=\"https://github.com/ZeroDayArcade/wpa-password-cracking-with-pmkid/\"\u003eCracking WiFi Passwords with PMKID\u003c/a\u003e  \n\u003ca href=\"https://github.com/ZeroDayArcade/capture-handshake-wpa-wifi-hacking\"\u003eCapturing 4-Way Handshake from WPA/WPA2 Networks\u003c/a\u003e  \n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FZeroDayArcade%2Fcracking-wpa-with-handshake","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FZeroDayArcade%2Fcracking-wpa-with-handshake","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FZeroDayArcade%2Fcracking-wpa-with-handshake/lists"}