CompTIA PenTest+ (PT0-003)Attacks and ExploitsMedium
A penetration tester is evaluating an organization's wireless network. They observe that the network uses WPA2-PSK and has a weak pre-shared key. The tester wants to perform an offline brute-force attack against the captured WPA2 handshake. Which of the following commands, using `hashcat`, would be most suitable for this task if the handshake was captured in a .cap file?
- Ahashcat -m 2500 handshake.cap -a 3 ?a?a?a?a?a?a?a?a
- Bhashcat -m 5500 handshake.cap -a 0 wordlist.txt
- Chashcat -m 11000 handshake.cap -a 0 wordlist.txt
- Dhashcat -m 22000 handshake.cap -a 6 wordlist.txt
Show answer & explanationAnswer & explanation
Correct answer: C. hashcat -m 11000 handshake.cap -a 0 wordlist.txt
WPA/WPA2 PSK (PMKID) is mode 22000, and WPA/WPA2 PSK (handshake) is mode 2500. The question states 'WPA2-PSK' and 'captured WPA2 handshake'. Mode 2500 is used for WPA/WPA2 PSK handshakes. An `-a 0` attack mode specifies a dictionary attack, which is common for cracking pre-shared keys against a wordlist.
Why the other options are wrong
- A. Mode `2500` is correct for WPA/WPA2 PSK handshakes, but `-a 3` is for brute-force/mask attacks, while the question implies a dictionary attack with a wordlist for a 'weak pre-shared key'.
- B. Mode `5500` is for NetNTLMv2, not WPA2 PSK.
- D. Mode `22000` is for WPA/WPA2 PSK (PMKID), not the full handshake, and `-a 6` is for hybrid wordlist + mask attack, which is not the primary method for a simple dictionary attack.
WPA2-PSK Hashcat Cracking
Using Hashcat to perform an offline brute-force or dictionary attack against a captured WPA2-PSK 4-way handshake to recover the pre-shared key.
- Requires a captured 4-way handshake (e.g., in a .cap or .hccapx file).
- Hashcat mode `2500` is used for WPA/WPA2 PSK handshakes.
- Commonly performed with dictionary attacks (`-a 0`) or mask attacks (`-a 3`).
- The effectiveness depends on the strength of the pre-shared key and the quality of the wordlist.
Memory trick: Mode 2500 for the handshake, 22000 for PMKID, attack type for the strategy.