How to Capture a WPA2 Handshake with Aircrack-ng

Capturing a WPA2 handshake is the first step in auditing a wireless network's password — you need it in hand before you can test any guesses against it offline. So let me show you how to grab one; in a follow-up we'll put it to work brute-forcing the password.

When a device joins a WPA2 network it performs a 4-way handshake with the access point — a short exchange that proves both sides know the password without sending it in the clear. We can't reverse the handshake to reveal the password, but if we capture it we can test password guesses against it offline, as fast as our hardware allows. So the handshake is the prize. Let me show you how to grab one.

Remember: The hacking tools and knowledge that we share here should not be used on a target without prior mutual consent. Test only networks you own or have explicit written permission to test. It is the end user's responsibility to obey all applicable local, state, and federal laws. We assume no liability for misuse.

What you'll need

• A Linux box — I'm using Kali Linux, which ships with the aircrack-ng suite.
• A wireless adapter that supports monitor mode and packet injection. Not every built-in card does; adapters with Atheros or Ralink chipsets are popular for this.
• A network you are authorized to test, with at least one client (a phone, laptop) connected to it — we need a client to capture a handshake from.

Step 1: Put your card into monitor mode

Normal ("managed") mode only sees traffic addressed to you. Monitor mode lets the card listen to all the WiFi traffic around it. First, stop processes that can interfere:

sudo airmon-ng check kill

Then start monitor mode on your interface (mine is wlan0):

sudo airmon-ng start wlan0

This usually creates a new monitor interface — often wlan0mon. Confirm its name with iwconfig; I'll use wlan0mon from here on.

Step 2: Find your target network

List the networks around you:

sudo airodump-ng wlan0mon

You'll see a live table of access points. Note three things about your target:

• BSSID — the AP's MAC address (e.g. AA:BB:CC:DD:00:11)
• CH — the channel it's on (e.g. 6)
• ESSID — the network name

Press Ctrl-C to stop once you have them.

Step 3: Lock onto the target and start capturing

Now tell airodump-ng to watch only that AP on only its channel, and write everything to a file:

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:00:11 -w capture wlan0mon

• -c 6 — the channel from Step 2
• --bssid — your target's BSSID
• -w capture — write to files named capture-01.cap, etc.

Leave this running. In the top-right you're waiting for the magic words: WPA handshake: AA:BB:CC:DD:00:11. That appears the moment a client completes the 4-way handshake. You could just wait for someone to connect — or we can speed things up.

Step 4: Force a handshake with a deauth

If a client is already connected, we can briefly kick it off the network. When it automatically reconnects, it performs the handshake — and airodump-ng (still running in the other terminal) captures it. Open a second terminal and run:

sudo aireplay-ng -0 1 -a AA:BB:CC:DD:00:11 -c 11:22:33:44:55:66 wlan0mon

• -0 1 — a deauthentication attack; 1 sends one burst (use a slightly higher number if the first doesn't take)
• -a — the AP's BSSID
• -c — the client's MAC (you can see connected clients listed under "STATION" in airodump-ng)

Leave off -c to broadcast the deauth to every client, but targeting one specific client is cleaner and more reliable.

Step 5: Confirm you got it

Flip back to the airodump-ng terminal. If you see WPA handshake at the top, you're done — press Ctrl-C to stop. You now have a capture-01.cap file containing the handshake.

You can verify the capture actually contains a usable handshake:

aircrack-ng capture-01.cap

If it lists your network with "(1 handshake)", you're good.

Step 6: Clean up

When you're finished, take the card out of monitor mode and restart networking:

sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager

Next up

Right now that handshake is just an inert .cap file — it doesn't hand you the password, not yet. Cracking it is the fun part, and it's exactly where we're headed next: in the follow-up I'll show you how to run a wordlist against this capture with aircrack-ng, and then how to generate far smarter guesses with crunch instead of blindly trying everything. That's when the handshake you just grabbed finally gives up its secret.

One thing to keep in mind: this whole technique targets WPA2. WPA3 uses a different handshake (SAE) built to resist exactly this kind of offline attack — a good reason to enable it on your own networks.

To be continued…

If you found this useful, subscribe to our RSS Feed and YouTube Channel. More wireless-security writeups are coming.

References

• Aircrack-ng — Cracking WPA/WPA2