Kali Linux WiFi Password Recovery — Complete Tutorial

Step 1 — Install and verify Kali Linux

Kali Linux can run as a primary OS, a virtual machine (VMware, VirtualBox), or a Live USB with persistence. For WiFi packet injection, a bare-metal install or Live USB is recommended — virtual machines may not pass through USB WiFi adapters with full monitor mode support.

For VM users: enable USB 3.0 passthrough in VM settings and attach the WiFi adapter to the VM (not the host). VMware Workstation and VirtualBox with Extension Pack support this. Some USB adapters have more reliable passthrough than others — Alfa AWUS036ACHM works well with VMware.

Post-install: update the system with sudo apt update && sudo apt full-upgrade -y. Verify kernel version with uname -r. Kernel 6.5+ is recommended for the best WiFi adapter driver support.

Step 2 — Set up monitor mode

Insert the WiFi adapter. Check it's recognised: iwconfig should show a new interface (typically wlan0). Put it into monitor mode: sudo airmon-ng start wlan0. This creates a monitor interface (wlan0mon) that can capture all WiFi frames in range.

If airmon-ng returns 'monitor mode already enabled' or fails: manually kill interfering processes. Check with sudo airmon-ng check kill — this stops NetworkManager and wpa_supplicant, which can interfere with monitor mode. Run the check-kill command, then try airmon-ng start again.

Verify monitor mode is active: iwconfig should show 'Mode:Monitor' on the monitor interface. Alternatively, without airmon-ng, use the documented sequence: ip link set wlan0 down; iw dev wlan0 set type monitor; ip link set wlan0 up. (set monitor <flag> configures monitor flags rather than the interface type, and the interface must be down first or the change fails with 'Device or resource busy'.) Recent airmon-ng builds often enable monitor mode on wlan0 without renaming it, so always check iwconfig to see which interface name to use in the commands that follow.

Injection test: sudo aireplay-ng --test wlan0mon. The output should report 'Injection is working!'. If it reports 'No answer...' or 'No injection' the adapter does not support packet injection — check the chipset compatibility.

Step 3 — Capture a WPA handshake with airodump-ng

Start airodump-ng to scan all channels: sudo airodump-ng wlan0mon. This displays all visible access points (BSSID, channel, encryption, signal strength) and connected clients. Identify the target network from the list.

Focus on the target: sudo airodump-ng -c <channel> --bssid <target_BSSID> -w capture wlan0mon. This writes captured frames to 'capture-01.cap' (pcap format). The -c flag limits capture to the target's channel — essential for capturing the full 4-way handshake.

Initiate a deauth attack to force a client to re-associate — only on a network you own or have written permission to test: sudo aireplay-ng -0 2 -a <target_BSSID> -c <client_MAC> wlan0mon. This sends 2 deauthentication packets to the client, causing it to disconnect and reconnect. The reconnection triggers the 4-way EAPOL handshake. This is an active interference attack against devices that may not be yours, not a passive observation.

Monitor airodump-ng output for 'WPA handshake: XX:XX:XX:XX:XX:XX' at the top-right corner. This confirms a complete 4-way handshake was captured. If no clients are connected, you cannot capture a handshake via deauth — consider PMKID capture instead.

Step 4 — PMKID capture (no client needed)

If the target has no connected clients: capture the PMKID instead. The PMKID is not carried in beacons — an AP that supports PMKID caching returns it in the RSN IE of the (Re)Association Response, or in the RSN PMKID KDE of EAPOL-Key message 1. hcxdumptool associates with the AP to trigger that message, so the method needs no other client but does need your adapter to transmit an association request.

Use hcxdumptool for PMKID capture. The syntax changed in 6.3.0: on 6.2.x and earlier the capture command is sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1, while on 6.3.0 and later those options were replaced (-w <file> writes the pcapng, and a real-time status display replaces --enable_status), so the old flags fail with an unrecognized-option error. Check hcxdumptool --help on your installed version. Leave it running for 30-60 seconds per target — longer if the signal is weak.

PMKID capture works on APs that implement PMKID caching / fast roaming. PMF (802.11w) is unrelated — PMF blocks the forged deauth path, it does not create a PMKID — and whether an AP sends a PMKID at all is vendor- and firmware-dependent, with many newer APs declining to. The method does not work on WPA3-SAE networks, not because anything is encrypted, but because an SAE-derived PMK is not an offline password oracle.

Convert the hcxdumptool output to hashcat format: hcxpcapngtool -o hash.hc22000 -E wordlist.txt capture.pcapng. The -E flag extracts any readable ESSIDs encountered during capture.

Step 5 — Convert capture to hashcat format

For airodump-ng captures (.cap): use hcxpcapngtool from the hcxtools package: hcxpcapngtool -o hash.hc22000 -E essidlist.txt capture-01.cap. This extracts the 4-way handshake hash in hashcat mode 22000 format.

For hcxdumptool captures (.pcapng): the same command works: hcxpcapngtool -o hash.hc22000 -E essidlist.txt capture.pcapng.

Inspect the output hash file: cat hash.hc22000. Each line should start with 'WPA*01*' for PMKID or 'WPA*02*' for EAPOL, followed by the encoded network and handshake fields. If the file is empty, the capture did not contain a complete handshake or usable PMKID.

Step 6 — Crack with hashcat (mode 22000)

Basic dictionary attack: hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt. On Kali the list ships compressed, so unpack it first: sudo gunzip /usr/share/wordlists/rockyou.txt.gz. On an RTX 5090, published mode-22000 measurements put throughput around 3.3 MH/s, so the ~14.3M-entry rockyou list is a matter of seconds.

Dictionary + rules attack: hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule. Current hashcat ships best66.rule, not the older best64.rule — a copied best64 command fails with a missing-rule error, so verify with ls /usr/share/hashcat/rules/. The rule file applies 66 mutations to each dictionary word, producing roughly 944 million candidates (14.3M x 66). At around 3.3 MH/s that is roughly 5 minutes.

Mask attack (character-set constrained): hashcat -m 22000 hash.hc22000 -a 3 ?l?l?l?l?l?l?l?l. This tries all 8-character lowercase passwords (208 billion). At around 3.3 MH/s that is roughly 17.5 hours.

Hybrid attack (dictionary + mask suffix): hashcat -m 22000 hash.hc22000 rockyou.txt -a 6 ?d?d?d. This appends 3 digits to each dictionary word, covering patterns like 'password123'.

When the password is found: hashcat displays it in the output. Check the potfile: hashcat --show -m 22000 hash.hc22000. The cracked password appears as the stored WPA*01*/WPA*02* hash line, then a colon, then the recovered password — the ESSID appears only as the hex field inside that line.

Step 7 — Advanced techniques

Rules customization: create a custom rule file targeting the specific password patterns common in your region. For example: append year suffixes (2024, 2025, 2026), common number patterns (123, 000, 111), local area codes, or street-abbreviation variants.

Princess/Prince attack: use hashcat --stdout with princeprocessor (PP64) to generate combinatorial passwords from a base wordlist. Effective against compound passwords (e.g., 'John1982Sarah2020' — two dictionary elements combined).

Markov chain mask attack: hashcat's markov-chains are enabled by default for mask attacks and already order candidates by probability, testing the most likely character sequences first. Tune them with -t/--markov-threshold (or --markov-classic); use --markov-disable only when you deliberately want plain sequential brute force.

If GPU memory is insufficient for large wordlists: tune -n/--kernel-accel and -u/--kernel-loops, or split the wordlist into chunks. --workload-profile does not affect memory use — it selects a performance/power profile (1 Low / 2 Default / 3 High / 4 Nightmare), and profile 2 is already the default, so passing it changes nothing. Use -w 1 only to trade speed for desktop responsiveness on a workstation you are also using.

Troubleshooting common issues

Adapter not recognised: run lsusb to confirm the adapter is detected. Check dmesg | tail -20 for driver errors. The Alfa AWUS036ACHM should appear as USB ID 0e8d:7610 — lsusb prints vendor and product IDs, not a chipset name, so check the ID rather than looking for text. 0e8d:7612 is the different model AWUS036ACM (MT7612U).

No handshake captured after deauth: the client might be using PMF (802.11w) which ignores deauth frames from non-AP sources. Try on a different network or use PMKID capture instead.

Hashcat shows 'Hashfile ... line reject' or 'Skipping' for your hash: the hash format is incorrect. Mode-22000 lines start with WPA*01* (PMKID) or WPA*02* (EAPOL) followed by the *-separated fields — there is no 22000$ prefix. Confirm the file with hashcat --identify hash.hc22000. To re-extract, note there is no --hc22000 option: mode-22000 output is what hcxpcapngtool writes with -o, i.e. hcxpcapngtool -o hash.hc22000 capture.pcapng (see hcxpcapngtool --help).

Injection test fails: the adapter or driver does not support injection. Check the chipset against the supported list. Some adapters need a driver update or kernel downgrade.

Kali Linux WPA recovery pipeline

1. 1

   Boot Kali, insert adapter, set monitor mode

   sudo airmon-ng start wlan0, verify with iwconfig.

2. 2

   Scan for networks

   sudo airodump-ng wlan0mon. Note target BSSID, channel, encryption type.

3. 3

   Capture handshake or PMKID

   On a network you own or are authorized to test: airodump-ng focused capture + aireplay-ng deauth, OR hcxdumptool PMKID capture.

4. 4

   Convert to hashcat format

   hcxpcapngtool -o hash.hc22000 -E ssids.txt capture.pcapng.

5. 5

   Crack with hashcat

   gunzip /usr/share/wordlists/rockyou.txt.gz first, then hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best66.rule. Use a mask attack if the dictionary fails.

Frequently Asked Questions

Related Reading