Make your 2026 legendary, the HTB way — 25% off our HTB Academy Annual Plans for a limited time. Learn More

Wi-Fi Password Cracking Techniques

Password cracking is a cornerstone of wireless penetration testing, as many real-world assessments hinge on the strength of the Wi-Fi password and our ability to break it. Despite its importance, many testers continue to rely solely on dictionary attacks with basic tools and minimal customization. In this module, we’ll go beyond the basics and explore the full spectrum of practical techniques, targeted strategies, and performance-driven optimizations for cracking Wi-Fi passwords.

5.00

Created by Sentinal
Co-Authors: N1tr0x

Medium Offensive

Summary

This module explores a variety of Wi-Fi password cracking techniques using tools like Hashcat, Cowpatty, and John. It covers brute-force, rule-based, mask, and hybrid attacks, along with precomputed hash (rainbow table) methods, WPA2-Enterprise credential brute-forcing, and Cisco password cracking using configuration files.

In this module, we will cover:

  • Overview
    • Introduction
    • Traditional WPA Password Attack
    • Anatomy of a Password
  • Using Hashcat
    • CPU vs GPU Based Cracking
    • Hashcat Rules
    • Mask Attacks
    • Combinator Attacks
    • Hybrid Mode
  • Generating Credentials
    • Generating Default Credentials
    • Generating Wordlists
    • Generating Usernames
  • Miscellaneous Attacks
    • Precomputation (Rainbow Table) Attacks
    • Using Cloud for Cracking
    • Cisco Password Cracking
  • Skills Assessment

This module is broken down into sections with accompanying hands-on exercises to practice each of the tools, tactics, and techniques we cover. There are no specific WiFi hardware requirements for this module, as Hack The Box manages all necessary resources. You will need to RDP into the provided attacker VM to perform the exercises.

As you work through the module, you will see example commands and command outputs for the various tools and topics introduced. Reproducing as many examples as possible is recommended to reinforce the concepts presented in each section.

You can start and stop the module at any time and pick up where you left off. There is no time limit or grading, but you must complete all of the exercises and the skills assessments to receive the maximum number of cubes and have this module marked as complete in any paths you have chosen.

This module is classified as "Medium" and assumes a working knowledge of Linux systems and network fundamentals. Prior familiarity with the following topics is recommended for successful completion of this module:

Introduction

Wi-Fi is an essential part of modern life, connecting our devices to the internet at home, at work, and in public spaces. While it's designed with security in mind, weak passwords and misconfigurations often leave networks open to attack. Wi-Fi password cracking involves testing these weaknesses to recover the passphrase or encryption key protecting the network.

When assessing the security of a wireless network, one of the first things we look at is the strength of the password or pre-shared key (PSK). The reason for this straightforward: strong passwords can dramatically increase the time and effort required for an attacker to break in. Whether we're working with a captured handshake or a hashed key, the success of our cracking attempts largely depends on the quality of our wordlist and the techniques we apply.

There are countless ways to build wordlists and approach password cracking, each with its own strengths depending on the context. Since most passwords are chosen by people, they often follow familiar patterns, reflect personal habits, or stick to factory defaults. Being able to stop these tendencies and shape a strategy around them can make all the difference for us as pentesters.

Wi-Fi Encryption Standards

Wireless networks typically use one of these security protocols:

Protocol Status Security Level
802.11 (Legacy) Deprecated Very Weak
802.11b (WEP) Deprecated Very Weak
802.11g/n (WPA) Deprecated Weak
802.11n/ac (WPA2) Widely used Strong (if passphrase is strong)
802.11ac/ax (WPA3) Current Strongest (so far)
Open Networks Active No Security
OWE (Opportunistic Wireless Encryption) Emerging Better than open, but lacks authentication
WPA2-Enterprise Active High (with certificate validation)
WPA3-Enterprise Active Very High

In this module, we'll dive into both traditional and advanced techniques for cracking WPA2 networks, many of which also apply to other wireless security protocols covered in separate Wi-Fi modules. We'll explore methods like generating wordlists from default credentials or user-specific patterns, using mask-based and rule-based cracking, as well as combination and hybrid attacks. We'll also break down the differences between CPU and GPU-based cracking, highlighting the strengths and trade-offs of each.

The Traditional WPA Password Attack

A traditional WPA password attack involves four key steps: Reconnaissance, Handshake Capture, Password Cracking, and Access Verification.

  1. Reconnaissance: Identify nearby Wi-Fi networks (airodump-ng).
  2. Handshake Capture: Listen for or trigger a handshake by disconnecting a connected client (aireplay-ng).
  3. Password Cracking: Use a wordlist or brute-force to attempt to crack the handshake (aircrack-ng, hashcat, cowpatty, john).
  4. Access Verification: If cracked successfully, test the key by connecting to the network.

In the next section, we'll take a hands-on approach and explore a variety of tools commonly used to crack WPA/WPA2 passwords.

Sign Up / Log In to Unlock the Module

Please Sign Up or Log In to unlock the module and access the rest of the sections.

Sections

Relevant Paths

This module progresses you towards the following Paths

Wi-Fi Penetration Tester

Wi-Fi Penetration Tester

The Wi-Fi Penetration Tester Job Role Path is designed for professionals and aspiring security practitioners who want to build expertise in assessing and securing corporate wireless networks. The course provides hands-on training in evaluating the security of Wi-Fi environments, from attacking modern authentication and encryption protocols to simulating real-world attack scenarios such as rogue access points, man-in-the-middle attacks, and credential harvesting. Students will gain practical experience with industry-standard tools and methodologies, learning how to identify vulnerabilities, exploit misconfigurations, and recommend effective countermeasures. By the end of this Path the participants will be equipped with the knowledge and skills required to perform authorized Wi-Fi penetration tests and strengthen the wireless security posture of enterprise corporate environments.

Hard Path Sections 170 Sections
Required: 3400
Reward: +680
Path Modules
Wi-Fi Penetration Testing Basics
Medium
Path Sections 16 Sections
Reward: +20
In today's digital age, wireless networks are ubiquitous, connecting countless devices in homes, businesses, and public spaces. With this widespread connectivity comes an increased risk of security vulnerabilities that can be exploited by malicious actors. As such, understanding and securing Wi-Fi networks has become a crucial aspect of cybersecurity. Whether you are an aspiring ethical hacker, a network administrator, or simply a tech enthusiast, gaining a solid foundation in Wi-Fi penetration testing is essential for safeguarding your digital environment.
Attacking Wi-Fi Protected Setup (WPS)
Medium
Path Sections 13 Sections
Reward: +20
In this module, we delve into the intricacies of WPS, uncovering the common vulnerabilities that plague this technology. From brute-force attacks to more sophisticated exploitation techniques, we will explore how attackers compromise WPS-enabled networks. By understanding these vulnerabilities and their related attacks, you will gain the knowledge necessary to protect your networks and mitigate the risks associated with WPS.
Wired Equivalent Privacy (WEP) Attacks
Medium
Path Sections 13 Sections
Reward: +20
In this module, we delve into Wired Equivalent Privacy (WEP) and the various attacks that can compromise it. We'll explore how to identify access points configured with WEP and demonstrate different methods to exploit its vulnerabilities. As WEP is an outdated and insecure protocol, understanding its weaknesses is crucial for recognizing the need to upgrade to more secure protocols. This module aims to provide insights into WEP’s vulnerabilities and practical techniques for testing its security.
Attacking WPA/WPA2 Wi-Fi Networks
Medium
Path Sections 15 Sections
Reward: +100
This module explores the security challenges of WPA and WPA2 Wi-Fi networks, focusing on WPA/WPA2-Personal and WPA/WPA2-Enterprise. Although these protocols aim to secure wireless communication, attackers can exploit various weaknesses in home and enterprise environments. This module will delve deeper into WPA-Personal and WPA-Enterprise, demonstrating multiple attack vectors to compromise each. Understanding these attack vectors will give you insight into the vulnerabilities that could compromise WPA/WPA2 networks and how to secure them.
Wi-Fi Evil Twin Attacks
Medium
Path Sections 16 Sections
Reward: +100
This module explores the concept of evil twin attacks on Wi-Fi networks, focusing on WPA2, WPA3, and WPA-Enterprise. Despite these protocols being designed with strong security measures, they remain vulnerable to social engineering and rogue access point attacks. We will delve into both manual and automated methods for executing evil twin attacks, demonstrating practical approaches for each network type. Additionally, we will cover advanced MiTM techniques, including DNS spoofing and SSL interception, to highlight how attackers can exploit compromised connections for data interception.
Attacking WPA3 Wi-Fi Networks
Medium
Path Sections 16 Sections
Reward: +100
Wi-Fi Protected Access 3 improves upon WPA2 by offering stronger encryption, SAE for personal networks, OWE for open networks, and mandatory Protected Management Frames. However, it is not immune to compromise. In this module, we’ll explore practical attack techniques against WPA3 implementations, including OWE, SAE, and Enterprise networks (EAP-PWD), highlighting how vulnerabilities and misconfigurations can be exploited in real-world scenarios.
Bypassing Wi-Fi Captive Portals
Medium
Path Sections 17 Sections
Reward: +100
In this module, we delve into a range of methods for identifying and bypassing captive portals, employing both indirect and direct exploitation techniques. We cover tactics such as MAC spoofing, ARP poisoning, DNS tunneling, and credential interception, alongside direct attack vectors like Cross-Site Scripting (XSS), file upload vulnerabilities, file inclusion, and brute force attacks. Additionally, we will examine client hijacking strategies to extract credentials and circumvent portal restrictions. By understanding these attack methods, we can evaluate and enhance the security of captive portal implementations.
Wi-Fi Password Cracking Techniques
Medium
Path Sections 16 Sections
Reward: +20
Password cracking is a cornerstone of wireless penetration testing, as many real-world assessments hinge on the strength of the Wi-Fi password and our ability to break it. Despite its importance, many testers continue to rely solely on dictionary attacks with basic tools and minimal customization. In this module, we’ll go beyond the basics and explore the full spectrum of practical techniques, targeted strategies, and performance-driven optimizations for cracking Wi-Fi passwords.
Wi-Fi Penetration Testing Tools and Techniques
Medium
Path Sections 30 Sections
Reward: +100 NEW
Wireless network penetration testing presents a unique challenge due to the wide variety of technologies, protocols, and security configurations encountered in the field. This module introduces learners to a range of Wi-Fi pentesting tools, each selected to demonstrate techniques suited for different environments and stages of an engagement. By working through practical examples, learners will gain hands-on experience in choosing and applying the right tool for the task.
Attacking Corporate Wi-Fi Networks
Medium
Path Sections 18 Sections
Reward: +100 NEW
This module incorporates a simulated Wi-Fi penetration test from start to finish, emphasizing hands-on techniques that reflect real-world engagements. It involves conducting scoped reconnaissance, assessing wireless configurations, and evaluating common attack surfaces across WPA2, WPA3, and Enterprise deployments. The environment culminates in a demonstration of internal network pivoting, including Active Directory access, all performed within a controlled, simulated environment and in adherence to strict legal and ethical boundaries.