Lion Cipher Lab

Capture and crack a WPA2 handshake on YOUR OWN Wi-Fi

• Penetration Testing / Red Team
• Advanced
• ~75 min
• Free · no account required

Why it matters

Your home Wi-Fi password is the one secret standing between the entire internet and every device in your house — laptops, phones, cameras, the front-door lock. Almost every home network is protected by WPA2 (Wi-Fi Protected Access 2) or the newer WPA3, and with WPA2 there is a quiet, well-known weakness: when a device joins the network, it and the router perform a brief exchange called the four-way handshake, and anyone nearby with the right adapter can record that handshake out of the air without ever connecting to anything. They cannot read your password from it directly — but they can take…

What you'll learn

• understanding what Wi-Fi security really is: WPA2, WPA3, a pre-shared key (the password), and how a router proves you know it
• learning the vocabulary from zero: access point, SSID, BSSID, channel, client/station, monitor mode, handshake, deauth, PMKID, wordlist
• recognizing which Wi-Fi adapters support monitor mode and packet injection, where to buy one, and roughly what it costs
• installing the aircrack-ng suite on Kali or another Linux system
• putting a wireless adapter into monitor mode with airmon-ng and understanding why that is necessary
• using airodump-ng to survey the air and read off your OWN network's BSSID and channel
• capturing the WPA2 four-way handshake from your OWN access point, either by waiting for a reconnect or by deauthenticating your OWN device
• cracking the captured handshake offline against a wordlist with aircrack-ng, and watching a weak password fall
• proving in your bones why a short or common Wi-Fi password is unsafe, and fixing it with a long passphrase and WPA3
• holding the one rule absolutely: this is only ever done to a network and devices you personally own, never anyone else's

Steps in this lab

1. First, the one rule that makes this legal: your access point, your devices, nobody else's
2. The words you need first, from zero: WPA2, handshake, BSSID, channel, monitor mode
3. Get the right hardware: a Wi-Fi adapter that supports monitor mode
4. Install the aircrack-ng suite on Kali or Linux
5. Put your adapter into monitor mode with airmon-ng
6. Survey the air and find YOUR network's BSSID and channel
7. Capture the four-way handshake from your own access point
8. Force a fresh handshake by deauthenticating YOUR OWN device (and the rule, again)
9. Crack the handshake offline against a wordlist
10. Fix the real weakness: set a strong passphrase and turn on WPA3
11. A note on PMKID: the same lesson, sometimes without a deauth
12. What you proved, and where it takes you

Open the full interactive lab →