> For the complete documentation index, see [llms.txt](https://repo.4pfsec.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://repo.4pfsec.com/wireless-penetration-testing/wifi-pineapple-tetra/cracking-wpa2-handshake.md).

# Cracking WPA2 Handshake

This section will cover how to crack a WPA2 handshakes captured with the previously showcased attack vector

## Cracking

We need to convert the captured `.pcap` file into `.hccapx` format in order to start cracking with it. There's a tool named `cap2hccapx` which can help us do this. However, we first need to download and compile it on our unix system.

### **Compiling cap2hccapx**

* Downloading Source

```
wget https://raw.githubusercontent.com/hashcat/hashcat-utils/master/src/cap2hccapx.c
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_ri2Imxu7XR8RIqzL%2Fimage.png?alt=media\&token=cd834a3a-ef78-4555-a7f0-f0ba43dcc585)

* Compiling Tool

```
gcc -o cap2hccapx cap2hccapx.c
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_rp0ubtLrZTalSH_2%2Fimage.png?alt=media\&token=1b82f575-bcce-49dd-b1bd-37e1abf2c6bf)

* Testing Tool

```
./cap2hccapx
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_ru-YjmYXEsMWri2W%2Fimage.png?alt=media\&token=acc9ec4b-2f45-4ebb-a4bb-bb253beda522)

### Converting

Now that we have the tool compiled and ready to go, we can convert the file and prep it for cracking!

```
cap2hccapx E4-6F-13-FA-AD-E0_partial.pcap  capture.hccapx
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_rxUpxXeVWNQYZA5l%2Fimage.png?alt=media\&token=71dfc464-9fdb-4e2c-91ab-5bf84c6ee9d0)

### Cracking with .hccapx

I'll be using Hashcat for the cracking on my host machine. [Here's](https://4pfsec.com/hashcat-password-cracking/) a post where I explain why cracking on the host machine is better 😊!

```
.\hashcat.exe -m 2500 .\hashes\capture.hccapx .\wordlists\rockyou.txt --force
```

![](https://561482365-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MdOcy1ba9EGn2GQ7ELK%2F-Mg_oAFaIX1Zp0K4gkKm%2F-Mg_s-4sWEc87K4G-6Au%2Fimage.png?alt=media\&token=15e76479-03e6-4910-a00c-fdcfdb28df77)

{% hint style="success" %}
e46f13faade0:c6adf262679d:Nee2.4:**tinkerbell**

**tinkerbell** is the PSK of the network in question
{% endhint %}

We were successfully able to crack the handshake and retrieve the password to the lab network!