In the world of network security, the concept handshake The handshake is a fundamental element of the process of connecting any device to a wireless network. When you enter a password on a Windows laptop or smartphone, a complex authentication process occurs, during which the client device and the access point exchange encrypted data packets. This exchange, known as the four-way handshake, contains a hashed version of the password, making it critical for network security analysis.
Many administrators and information security specialists wonder how to obtain a Wi-Fi handshake on Windows to audit their infrastructure or test password strength. Understanding this process not only helps identify weaknesses in the router configuration but also recognizes the importance of using complex encryption keys that cannot be brute-forced in a reasonable amount of time.
It's worth noting that packet capture itself is a passive process that doesn't disrupt network operation. However, using the captured data for unauthorized access is illegal. In this article, we'll examine the technical aspects of handshake formation, tools for analyzing it in Windows, and, most importantly, methods for protecting against such attacks to ensure your home or corporate Wi-Fi remains impenetrable.
How WPA2 Works and the Four-Way Handshake
Protocol WPA2-PSK, which is used in the vast majority of home and office networks, is based on the encryption standard AESHowever, the password verification procedure itself occurs before traffic encryption begins and is called a four-way handshake. At this point, the access point (Authenticator) and the client device (Supplicant) confirm knowledge of the shared secret key (PSK) without transmitting it over the network in clear text.
The exchange process consists of four messages, each of which plays a role in generating temporary encryption keys. The access point sends a random number (ANonce), the client generates its own (SNonce), and uses these to calculate PTK (Pairwise Transient Key). Then, the key installation is confirmed, and only after all four steps are successfully completed does the transfer of user data begin.
Why is PTK not transmitted directly?
The PTK (Pairwise Transient Key) is never transmitted over the air. It is calculated independently on both devices based on a shared password, MAC addresses, and random numbers. If the calculated keys match, the devices know the password is correct without even exchanging the password itself.
For a security analyst, the second and third messages are critically important, as they contain MIC (Message Integrity Code). MIC allows you to verify the correctness of a password offline by running a brute-force attack. If the hashes match, the password has been guessed correctly. Understanding this math is essential to understanding why simple passwords like "12345678" are vulnerable.
Necessary equipment and software
To conduct a legal Wi-Fi network security audit in a Windows environment, you'll need specialized tools. Standard network adapters built into laptops often don't support monitoring mode, which is necessary to capture all packets in the air, not just those addressed to your device. Therefore, the first step is choosing compatible equipment.
The most popular solutions are considered to be adapters on chipsets Atheros, Ralink or Realtek, which have open-source drivers. Working with them in a Windows environment can be complicated by the need to install special drivers, such as Npcap or specialized utilities from the manufacturer. Without monitoring mode support, capturing the handshake of a specific target network will be impossible.
- 📡 Wi-Fi adapter with Monitor Mode and packet injection support.
- 💻 Windows 10/11 operating system with administrator rights to install drivers.
- 🛠️ A software traffic sniffer, such as Wireshark or Aircrack-ng for Windows.
- 📶 The distance from the target network must be within the range of reliable signal reception.
It is important to understand that software plays no less a role than hardware. Wireshark is a powerful protocol analyzer that allows you to examine every byte of a captured packet in detail. However, for direct capture and password recovery, a set of utilities is often used. Aircrack-ng, ported to Windows, or specialized Linux distributions running in a virtual machine.
⚠️ Warning: Using monitoring and packet injection modes may be flagged by antivirus software as suspicious activity. Before beginning testing, ensure you are only testing on your own networks or have written permission from the infrastructure owner.
Setting the network adapter to monitor mode
Putting a network card into monitor mode is the most technically challenging step for Windows users. Unlike Linux, where this is accomplished with a single command in the terminal, in Windows the driver interface is often hidden. You need to ensure that your adapter supports this feature and that the correct driver is installed to enable this mode.
Often, activating monitoring mode requires using the command line or PowerShell with elevated privileges. After installing drivers that support Monitor ModeYou can check the adapter's status through Device Manager or specialized utilities. If the adapter doesn't switch, you may need to disable the WLAN AutoConfig service to free the device from the operating system's control.
After successfully switching, the adapter will no longer connect to regular Wi-Fi networks as a client, as its task will change to listening to the entire airwaves. In this state, it will be able to see the SSIDs of hidden networks and the MAC addresses of all devices within range. This state must be recorded before launching the traffic sniffer.
Handshake Capture Process
The handshake acquisition process itself consists of waiting for a legitimate client to connect to the target network. A traffic sniffer, running in monitor mode, filters the data flow and stores only packets containing EAPOL (Extensible Authentication Protocol over LAN), which are the handshake markers.
If no one is connecting to the network right now, security administrators can use the method deauthenticationThis sends a special control frame to the client, forcibly breaking its connection to the router. The device, attempting to re-establish the connection, automatically initiates a re-handshake, which allows the necessary packets to be captured.
aireplay-ng --deauth 10 -a ROUTER_MAC -c CLIENT_MAC wlan0monIn Windows, the equivalent utility can be mdk4 or deauthentication functionality in graphical interfaces like Kismet (when running in Docker or WSL). After sending the deauthentication packet, the sniffer should record a burst of traffic and save a file with the extension .cap or .pcapng, which will contain the desired handshake.
Analysis of captured data and password verification
Once the file with the captured traffic is received, the analysis stage begins. The main tool here is Aircrack-ngThis utility allows you to run a brute-force attack or dictionary attack against a captured hash. The speed of the attack depends directly on your GPU and the password's complexity.
For verification, a file with a dictionary of common passwords is used, for example, rockyou.txtThe program takes each password from the list, generates a hash from it, and compares it with the captured MIC. If there are no matches, the process continues until the dictionary is exhausted.
| Parameter | Description | Impact on safety |
|---|---|---|
| Password length | Number of characters in the key | Each additional character exponentially increases the guessing time. |
| Complexity | Use of special characters, numbers, case | Protects against dictionary attacks by requiring a brute force attack |
| WPS | Quick Setup Protocol | The presence of WPS often allows you to bypass password protection completely |