I85PREP
⌘ K
PJPT study materials
PJPT study resources

PJPT: Wireless Attacks

PJPT · Work through your exam, one topic at a time.

All guide sections

Wireless Attacks

What the exam tests

Wireless attacks test whether you can capture and crack WPA/WPA2 material and explain the conditions that make an attack possible. The exam expects legal scope awareness because wireless testing can easily affect third-party networks.

Core rules and concepts

  • Put the adapter into monitor mode with airmon-ng start wlan0; confirm with iwconfig.
  • Discover networks with airodump-ng wlan0mon, note BSSID, channel, encryption, and clients.
  • Capture a WPA2 4-way handshake with airodump-ng -c <channel> --bssid <BSSID> -w capture wlan0mon; trigger a reconnect with a targeted deauth only if authorized.
  • PMKID capture with hcxdumptool can avoid deauth but depends on AP support.
  • Crack with aircrack-ng capture-01.cap -w wordlist.txt or hashcat -m 22000 after converting with hcxpcapngtool.

Worked example

A lab AP on channel 6 uses WPA2-PSK. You capture a handshake, convert it to hashcat format, and run hashcat -m 22000 hash.hc22000 rockyou.txt. The PSK is recovered. Reasoning: the handshake contains the material needed to test candidate passwords offline; no further interaction with the AP is required. If no handshake is captured, a PMKID attempt is the next least invasive step.

Traps

Forgetting monitor mode, capturing on the wrong channel, using deauth outside the authorized BSSID, confusing a PMKID with a full handshake, and claiming a WPA3 attack without confirming the transition mode. Always record the adapter, channel, and capture time.