How Weak WiFi Passwords Get Cracked (WPA2 Lab Demo)
Introduction
Many home and small-office networks still use WPA2-PSK (Pre-Shared Key). The protocol is sound when the passphrase is long and random, but a weak or dictionary PSK lets an attacker finish the hard work offline after one captured 4-way handshake.
In WPA2 personal mode, every station that knows the same passphrase can derive the same PMK for that SSID. The 4-way handshake then proves both sides share that material and installs fresh session keys (PTK/GTK) without sending the passphrase itself. That design is why a strong PSK stays hard to recover from a capture, and why a weak PSK fails once the handshake is on disk.
This guide walks through that attack path in a controlled lab: monitor mode, channel-locked capture, deauth to force a handshake, then offline dictionary testing with Aircrack-ng. Run it only on networks you own or have written authorization to test. Unauthorized Wi-Fi cracking is illegal.
Walkthrough: Cracking WPA2-PSK
The usual path against WPA2-PSK is to intercept the cryptographic exchange (the 4-way handshake) between a client and the access point. After you have a complete handshake, you can leave the air and test candidate passphrases on your own hardware. The AP never see those guesses.
Step 1: Enabling Monitor Mode
Put the wireless adapter into monitor mode. Managed mode only delivers frames for your station MAC; monitor mode records raw 802.11 frames in range.
airmon-ng start wlan0
Note: This usually creates a new interface named wlan0mon.
Step 2: Reconnaissance and Target Selection
Scan for access points and stations, then note the target BSSID, channel, and at least one associated client:
airodump-ng wlan0mon
Pick the lab SSID, write down its BSSID and channel, and identify a station you are authorized to deauthenticate.
Step 3: Channel-locked capture, then force the handshake
Before you send deauth frames, lock airodump-ng to the target channel and BSSID and write packets to disk. If you stay on a full-band hop, you will miss the handshake while the card is on another channel.
airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon
Leave that capture running so you do not lose frames while you work. In a second terminal, inject a short deauth burst so the client reconnects and performs a fresh 4-way handshake:
aireplay-ng --deauth 10 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
-a: AP BSSID
-c: client (station) MAC
--deauth 10: send 10 deauth frames
When the station reconnects, airodump-ng should mark the handshake and keep writing to capture-01.cap (or the next index under -w capture). Confirm the capture file grew and that the tool reported a WPA handshake for the target BSSID before you stop monitor mode.
Step 4: Offline dictionary attack
With a complete handshake on disk, the air portion is done. aircrack-ng does not "hash the password once and match a simple digest." For each candidate passphrase it:
Derives the PMK from the passphrase and SSID (PBKDF2-HMAC-SHA1).
Builds a candidate PTK from the PMK plus the ANonce, SNonce, and MACs in the captured handshake.
Checks whether that PTK produces a valid MIC for the EAPOL frames you captured.
If the MIC verifies, that candidate is the PSK. Wrong guesses fail the MIC check and the tool moves on. That is why GPU cracking helps against weak wordlists and why a long random passphrase still resists this workflow even after a perfect capture.
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 00:11:22:33:44:55 capture-01.cap
Because guessing runs offline on your CPU or GPU, AP rate limits and lockouts do not apply. In this lab the weak passphrase cracked quickly; a long random PSK makes the same workflow impractical.
Defense and Mitigation
WPA2-PSK security is mostly passphrase strength plus radio reach. A long random passphrase raises the cost of offline guessing; a short dictionary word does not. The 4-way handshake is not "broken" when the PSK is strong. What fails is a guessable shared secret that an attacker can capture from outside the building if the signal reaches them.
Enterprise deployments should treat a shared PSK as a last resort for guest or lab SSIDs. Staff networks belong on 802.1X so each identity has its own credential and a revocation path when someone leaves.
To reduce exposure:
Use strong passphrases: at least 16 characters, random or a long passphrase that will not appear in common wordlists.
Prefer WPA3 where clients allow it: WPA3 SAE (Simultaneous Authentication of Equals) is designed so a captured exchange does not enable the classic offline dictionary attack used against WPA2-PSK. A weak SAE password can still be risky under online guessing or other misuse, so do not treat WPA3 as permission to keep a short shared secret.
Use WPA2/WPA3-Enterprise (802.1X) for staff: individual credentials or certificates remove the single shared PSK for the corporate SSID; keep PSK for guest or lab SSIDs only when you must.
Also reduce unnecessary RF exposure: place APs carefully, avoid broadcasting sensitive SSIDs farther than needed, and rotate guest PSKs on a schedule so a leaked passphrase has a short lifetime.
Conclusion
Capture a handshake only under authorization, lock the channel before deauth, and remember that offline cracking verifies MIC against a derived PTK, not a single static hash. Use the companion video for the live demo and this post for the command sequence and defensive notes.
References
Register for instructor-led online courses today! https://www.darkrelay.com/courses
Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths
Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing
Contact us for custom pentesting needs at: info@darkrelay.com or WhatsApp.
Comments