Skip to main content
2 of 2
replaced http://security.stackexchange.com/ with https://security.stackexchange.com/

There is no need to act as a proxy to capture the four way handshake.

No you are wrong, the PMK is not sent, never.

The only way to decipher the PTK is almost like defalt said.

You need to be sniffing at the time the connection between the AP and the STA is being established, capturing the four way handshake. This can also be done by sending a death packet to the AP spoofing the client, so it disconnects and reconnects, hence, sending the four way handshake.

It is only the first two packets that you need of the four way handshake. The first one contain the AP MAC and the ANounce, and the second contains the Client MAC, the SNounce and the MIC to verify that the PTK match.

In order to decrypt the traffic you need to generate your own PMK also called Pre-shaked Key (PSK) then create a PTK out of it and test it to match the MIC.

Azteca
  • 1.1k
  • 6
  • 17