Free lesson 1 of 7 from WiFi & Wireless Hacking — How WPA2 falls: capture, the clientless PMKID attack, and offline cracking — hands-on.. No account, no card.
WPA2-PSK never sends your WiFi password over the air. Instead the AP and client prove they both know it via a math handshake. An attacker captures that proof and then guesses passwords offline against it — no interaction with the network, unlimited attempts. Weak passphrase = cracked.
The modern twist: the PMKID attack needs no client at all — a single frame from the AP is enough. That's what you'll crack in the lab (no radio required — we captured one for you).
cat ~/wifi/README.txt ls -la ~/wifi/ # handshake.22000 · wordlist.txt · flag.enc
PMKID attack let you skip that the classic 4-way-handshake capture requires?Classic capture needs a client connecting (to grab the 4-way handshake, sometimes forced with a deauth). PMKID is clientless — you get it straight from the AP's first response, so you don't need to wait for or kick any user.
⚖️ Only attack networks you own or are authorized to test. Cracking others' WiFi is illegal.
7 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab
Unlock all courses · CHF 9/month Buy only this course · CHF 19