But, in theory, this should not be a serious problem, because PMKID is contained in the Message 1 of handshakes, so I hope we can capture PMKID in Airodump-ng. Although Airodump-ng does not have any special features to capture PMKID. In the new Aircrack-ng 1.4 release (from September 29, 2018) PMKID cracking was added. The first two ( hcxdumptool and hcxtools) are installed without problems in Linux, but with hashcat there may be difficulties because it requires proprietary drivers, which is a problem for some Linux distributions (as well as for all virtual computers).Īttack on WPA/WPA2 using PMKID in Aircrack-ng hashcat v4.2.0 or newer – for brute-force password.hcxtools v4.2.0 or later – to extract the data required for brute-force.hcxdumptool v4.2.0 or later – for capturing wireless frames.

In the article referred to, we used the following programs: That is, we get the necessary data for hacking the password without capturing the usual four-ways handshake, therefore, this attack is possible against Access Points even without the connected Clients. If say very briefly, some Access Points, when associated with them, send a PMKID, which, instead of a full handshake, can be used to crack the password. There you will find technical details about why this attack is possible. About hacking Wi-Fi, which has no connected Stations, is told in the previous article ‘ Hacking Wi-Fi without users’.

How to use aircrack ng