performing-wifi-password-cracking-with-aircrack

Enable monitor mode with airmon-ng, run airodump-ng locked to the target BSSID and channel, then either wait for a client reconnection or send deauth frames with aireplay-ng to force a new 4-way handshake. Verify the capture with aircrack-ng before cracking.

Convert the capture with hcxpcapngtool to the hc22000 format, then run hashcat in mode 22000 with a dictionary like rockyou.txt. Add rule files, mask attacks, or combinator mode for deeper cracking beyond plain dictionary guesses.

PMKID capture with hcxdumptool needs no connected client and no deauthentication, extracting the hash from the AP's first EAPOL frame. Handshake capture requires a client reconnection, often forced via deauth, and records the full 4-way exchange.

The capture is likely incomplete or on the wrong channel or band. Confirm all four EAPOL messages are present with aircrack-ng or cowpatty, lock airodump-ng to the target channel, and ensure your adapter supports the network's frequency band.

WPA3-SAE resists offline dictionary attacks, so traditional handshake cracking does not apply. Networks with 802.11w Protected Management Frames also block deauthentication, preventing forced handshake capture.

Only with explicit written authorization for the specific in-scope networks, such as during a contracted penetration test. Capturing handshakes or deauthenticating clients on networks you do not own or have permission to test is unlawful.