In today's world, wireless networks have become an integral part of infrastructure, but their vulnerability requires constant attention from security administrators. The process getting a handshake (handshake) is a fundamental step in the security audit of WPA2 and WPA3 protocols. This encrypted data packet allows us to verify the strength of a network password without actively intruding into user traffic.
Many Windows operating system users wonder about the possibility of conducting such tests without installing complex Linux distributions. Although Kali Linux is considered an industry standard, and modern tools allow you to work with wireless interfaces even in Microsoft environments. You'll need an understanding of how packets work and specialized software.
It's important to clarify that any data interception activities must be conducted exclusively as part of a legal audit of your own networks or under a contract with the infrastructure owner. Unauthorized access to third-party resources is punishable by law. We'll cover the technical aspects of the process so you can assess the security of your perimeter.
What is a handshake and why should you get one?
A handshake, or four-way handshake, is an authentication process that occurs each time a client device connects to an access point. At this point, keys are exchanged between the router and the device, which are used to generate a password. PMK (Pairwise Master Key) and PTK (Pairwise Transient Key). By intercepting this moment, the researcher obtains an encrypted hash that can be attempted to decrypt offline.
The main purpose of receiving this packet is to check the password strength. If the network uses a weak key, an attacker with a handshake can launch a brute-force attack and gain access. For the network owner, this is a signal to strengthen credentials or upgrade to more modern encryption standards.
There's a common misconception that by intercepting a handshake, you can immediately read the traffic. This isn't true. Without a password or a successful hash, the data inside the packets remains unreadable. However, the very existence of the handshake file gives a potential attacker unlimited time to crack it silently.
- 🔐 Authentication: confirmation of the client's identity by the network.
- 🔑 Key generation: creation of temporary session encryption keys.
- 📡 Data protection: preventing connection of unauthorized devices.
- ⚡ Speed: The process takes a fraction of a second with a normal connection.
⚠️ Warning: Using tools to intercept traffic on other people's networks without the owner's written permission is a violation of computer security laws.
What is the difference between WPA2 and WPA3 in terms of handshake?
The WPA3 protocol uses the SAE (Simultaneous Authentication of Equals) method, which makes classic four-way handshake interception impossible for subsequent offline brute-force attacks. In WPA2, the hash is transmitted openly (albeit encrypted with a key), allowing it to be stored and used for brute-force password attempts. In WPA3, key exchange is performed in such a way that even with packet interception, remote password brute-force attacks are virtually impossible without active participation in a real-time conversation.
Necessary equipment for working with WiFi on Windows
Standard built-in WiFi modules in laptops rarely support the mode Monitor Mode (monitoring mode), which is critical for listening to the air and capturing service packets. Standard Windows drivers are designed for maximum performance and power savings, ignoring the low-level functions necessary for auditing.
For successful operation you will need an external USB adapter based on chipsets from Atheros, Ralink or Realtek (specific models like AR9271 or RTL8812AU). These devices are capable of switching to monitoring mode and performing packet injection, which allows them to artificially disconnect clients and force them to reconnect.
Additionally, it's important to consider channel width and standard support. For auditing modern networks, an adapter supporting the 802.11ac standard and operating in the 5 GHz band is desirable, although most attacks are still carried out in the 2.4 GHz frequency due to its longer range and the prevalence of legacy devices.
| Adapter model | Chipset | Monitor Mode support | Range |
|---|---|---|---|
| TP-Link TL-WN722N (v1) | Atheros AR9271 | Yes (native) | 2.4 GHz |
| Alfa AWUS036NHA | Atheros AR9271 | Yes | 2.4 GHz |
| Alfa AWUS036ACH | Realtek RTL8812AU | Yes (drivers needed) | 2.4 / 5 GHz |
| Panda PAU09 | Ralink RT5572 | Yes | 2.4 / 5 GHz |
Setting up monitoring mode in Windows
After connecting a compatible adapter and installing specialized drivers (often these are modified versions from aircrack-ng or commview), you need to activate monitoring mode. In Windows, this is done not through the standard network settings menu, but through console utilities or the interface of specialized software.
One of the popular utilities is Acrylic WiFi Professional or console version Aircrack-ng For Windows, you need to identify the interface name in the system. This usually looks like "Wireless Network" or a specific model name. The command to put the card into monitor mode may involve running a script that changes the driver's state.
If you are using a package Aircrack-ng In Windows, make sure you run the command prompt as an administrator. Without elevated privileges, access to the .raw network interface will be blocked by the OS security system. This process may require restarting the network service or the adapter itself.
airmon-ng start wlan0As a result of executing the command, the interface may be renamed, for example, to wlan0monThis indicates that the card is now listening to the entire airwaves, not just packets addressed to it. However, in Windows, stability in this mode is often lower than in Linux, and occasional connection interruptions are possible.
- 💻 Admin rights: mandatory requirement for access to the driver.
- 📡 Renaming: the appearance of the "mon" suffix on the interface.
- 🛑 Connection break: In monitoring mode, you disconnect from the current WiFi network.
⚠️ Warning: Enabling monitoring mode will interrupt your current WiFi internet connection. Please ensure you have an alternative connection (Ethernet cable or mobile data) to retrieve information.
Using Aircrack-ng to Capture Packets
Set of utilities Aircrack-ng is the gold standard for WiFi auditing, and its Windows version allows for basic functionality. The key tool here is airodump-ng, which scans the airwaves and saves passing packets to a file. This file will later contain the desired handshake.
To get started, you need to launch a scan on the specific channel where the target network is located. This will reduce noise and allow you to spot targeted packets faster. The command may seem complicated for a beginner, but it's standard for all security professionals.
airodump-ng --channel 6 --bssid 00:11:22:33:44:55 -w capture wlan0monParameter --bssid indicates the MAC address of the router, and -w Specifies the filename prefix where the data will be saved. After launching the utility, a list of packets will start scrolling on the screen. Your task is to wait until "WPA Handshake: [MAC address]" appears in the upper right corner, confirming a successful capture.
If clients don't connect on their own, you have to use the deauthentication method. Utility aireplay-ng Allows you to send a special control frame that forcibly terminates the client's connection to the router. The client will automatically attempt to reconnect, at which point you'll intercept the handshake.
☑️ Handshake capture algorithm
It's worth noting that modern routers can protect against flood attacks by deauthenticating, ignoring excessively frequent disconnect requests. In this case, the process may take longer, requiring patience from the operator.
Analyzing traffic using Wireshark and tshark
An alternative to specialized hacking tools can be the use of a powerful traffic analyzer. Wireshark. Although it cannot independently carry out deauthentication attacks (this would still require aireplay or similar), its capabilities for filtering and storing packets are unrivaled.
Wireshark allows you to visually see the handshake. In the packet list, look for the protocol. EAPOL (Extensible Authentication Protocol over LAN). The presence of four consecutive EAPOL packets usually indicates the completion of the four-way handshake. This is a convenient way to verify that the captured data is correct.
After capturing a file in format .cap or .pcap, you can open it in Wireshark and export only the necessary packets. This is useful if the file is huge and you want to clean it up before sending it to a password cracker. Filter eapol in the Display Filter line will instantly cut off excess traffic.
- 🔍 Visualization: color illumination of different types of packages.
- 📂 Export: ability to save only EAPOL packets.
- 📊 Statistics: detailed graphs and charts of network activity.
Processing the received file and checking the password
Once the handshake file is received, the offline analysis stage begins. The file usually has the extension .capBefore running a brute-force attack, it's a good idea to validate the file to ensure the handshake is indeed complete and uncorrupted.
You can use the built-in typing utility to check Aircrack-ngIt will attempt to find valid keys in the file. If a handshake is found, the program will report it. If the file is empty or corrupted, brute-forcing the passwords will be a waste of CPU time.
aircrack-ng -w wordlist.txt capture-01.capIn this team -w Specifies the path to a password dictionary (wordlist). Dictionaries can be huge, containing millions of combinations. The speed of the search depends on the power of your CPU or GPU. GPUs perform this task hundreds of times faster than CPUs.
If the password is cracked, you'll receive it in cleartext. If the dictionary is exhausted and access is denied, the password is more complex than those in the database, or the salt is used (although in WPA2 Personal, the salt is known—it's the network's SSID). In this case, only dictionary expansion or mutation rules (mask attacks) can help.
⚠️ Warning: The password cracking process may load your hardware at 100% for an extended period of time. Monitor your processor and graphics card temperatures to avoid overheating and throttling.
Frequently Asked Questions (FAQ)
Is it possible to get a handshake without monitoring mode?
No, this is technically impossible. Monitor mode allows the network card to read all packets in the air, regardless of the destination. In normal mode, the card ignores packets not intended for it and does not see control frames from other networks.
What is the best password dictionary to use for Windows?
The most popular dictionaries rockyou.txt (basic set), as well as specialized databases generated for specific regions or services. Effectiveness depends on the complexity of the target network's password.
Why can't airodump-ng see my networks?
Most likely, your adapter isn't in monitor mode, or you're too far from the access point. Also, make sure you're scanning the correct frequency band (2.4 or 5 GHz).
Will it take a long time to get a handshake?
The actual capture process takes seconds if there are active clients. Most of the time is spent waiting for the client to connect or the subsequent password bruteforce, which can take anywhere from minutes to infinity.