how to use wireshark to get wifi passwords

To calculate PTK, you need data from a four-way handshake, as well as a password of a Wi-Fi network (in fact, you also need other information, such as the network name (SSID), but obtaining this data is not a problem).

Thus, it turns out that Wi-Fi traffic for each connection in the same Access Point is encrypted with different PTKs, and even for the same Client after reconnecting PTK changes.

At the same time, PTK is dynamic, that is, it is created anew for each new connection. When transmitting via Wi-Fi, the traffic is encrypted using PTK (the Pairwise transient key). I saved it all to the test.cap so that I can later on go through each and every packet on my device using Wireshark for detailed inspection.Let's start with the theory in order to understand why the process of decrypting Wi-Fi traffic in Wireshark requires some effort and why one cannot just decrypt any captured Wi-Fi traffic even if one has a password from the Access Point. ( To refer the ettercap tutorial visit here : Ettercap Packet Sniffing )Īs soon as I initiated the ettercap, tons and tons of traffic was passing through on my terminal screen. I wanted to capture each and every packet on their network, so I opened up terminal and typed in the following command.Įttercap -T -M arp -i eth0 /// -w test.cap Once I got into the network then I started ettercap, ( one of the best tool out there to sniff packets ). The reason was, if they had not used such a simple password which was present in the rockyou.txt file, then the whole process would have been bogged down, I guess it was my lucky day.

I was feeling ecstatic as soon as I figured out the password of IP on Firewall. Once, I obtained the password, the next thing was to go ahead and sniff-out their traffic and look for interesting things.

How to use wireshark to get wifi passwords