Let's suppose I was able to get a handshake from my target's network and I got the .CAP file (containing the handshake), but I would like to crack the password from another location (away from the target network location). Would it be possible, or do I have to be nearby the target network to do that?

  • there's quite a lot on this topic online. Have you tried "crack wifi password offline"?
    – schroeder
    Commented Jul 4, 2016 at 20:47
  • 1
    btw - distance doesn't matter - you are asking about cracking a static key, which doesn't require a connection to the AP
    – schroeder
    Commented Jul 4, 2016 at 20:49
  • @schroeder I just found a website with a lot of information about it, thanks. I guess I searched the wrong terms.
    – CrypticX
    Commented Jul 4, 2016 at 20:54
  • @BinaryMatrix please share your sources in comments to help others with the same question.
    – amrx
    Commented Jul 4, 2016 at 22:26
  • @Baron this helped with my question howtogeek.com/202441/…
    – CrypticX
    Commented Jul 5, 2016 at 20:26

2 Answers 2


You can be anywhere you like.
Once you have the handshake you can crack the password anywhere you like.
The handshake is as if you have a "hashed" password and you want to crack it.

One method of doing this is using aircrack-ng which tries to crack the handshake using a dictionary attack (This is a passive attack on your captured packets). You can view the full tutorial here.

  • @BinaryMatrix No problem =] Commented Jul 4, 2016 at 22:36

Deauthenticate the wifi clients with aireplay-ng (from aircrack-ng suite) or wifite. Make sure your rx quality is as good as possible. Use two adapters, and sniff with one using airodump-ng (fix the ivs_only var in airodump-ng.c and recompile) --output-format=csv,pcap or kismet. Inject with the other one. Depending on the type, you may need airmon-ng to set rfmon. Once you have a bunch of handshakes, use pyrit to crack them. You need a GPU or several for this (you can use client mode, and connect it to other machines in server mode over IP). CPU cracking is dead, forget about it. I have some old scripts which use aireplay-ng to deauth widely (every wlan, a few different modes of deauthentication), but I suppose wifite is more userfriendly.

  • I have to assert that CPU cracking is well and truly dead. Still works somewhat for password hashes, but IIRC the wpa psks are rolled 16k times, and you will never get as efficient cracking with cpu as with gpu. E.g.: my core i5 can do ~1700 c/s, but my gpu can do ~70000 c/s. And it is a cheap, old gpu. google hashcat-ocl, hashcat-cuda.
    – user400344
    Commented Jul 5, 2016 at 8:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .