Guide · Agent skill
How to use the offensive-wpa2-psk agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
offensive-wpa2-psk is an agent skill, a folder with a SKILL.md file of instructions that an AI agent loads when a task matches it. It is a methodology for testing the password of a WPA/WPA2 Personal Wi-Fi network: capturing a PMKID or four-way handshake, converting it to hashcat's hc22000 format, and testing candidate passwords offline. This guide explains what the skill does, how to install it, how to phrase requests so it triggers, and the limits you must respect. It is only for networks you own or have written permission to test.
WPA2 Wi-Fi Password AttacksSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Confirm authorization. Get written, signed permission for the exact WPA/WPA2 Personal network and BSSID you will test. Do not proceed without it.
- 2Install the tools. On a Linux machine with a monitor-mode capable adapter, install the aircrack-ng suite, hcxdumptool, hcxtools and hashcat, as described in each project's documentation.
- 3Download and unzip the skill. Download the ZIP from this item page and unzip it into ~/.claude/skills/ or a project's .claude/skills/ folder.
- 4Start an agent session and ask. Open an agent session and describe the authorized network, the goal and the PMKID-first approach in plain language.
- 5Capture and verify. Capture a PMKID or four-way handshake, convert it with hcxpcapngtool, and confirm the output shows AUTHORIZED lines before cracking.
- 6Crack and record results. Run the dictionary and rule attacks, then masks if needed, and document outcomes in your engagement report.
What does the offensive-wpa2-psk skill make the agent do?
The skill is a written attack methodology for WPA/WPA2-PSK networks, the pre-shared key mode used by most home and small-business Wi-Fi. It tells the agent the order of work: identify the target, try a PMKID capture first because it needs no connected client, fall back to a four-way handshake capture if no PMKID appears, convert the capture, then crack offline with wordlists, rules and masks.
The skill covers hcxdumptool and hcxpcapngtool for capture and conversion, hashcat mode 22000 for cracking, vendor default-password generators such as upc_keys and skylogin, and notes on 802.11r and opportunistic key caching. It does not run anything itself. The agent would need a Wi-Fi adapter and the named tools installed on a Linux machine.
- Best fit: authorized penetration testers, security students on their own lab access points, and red teams writing wireless reports on consumer or SMB networks.
- Not for: any network you do not own or have written permission to test, neighbours' networks, or public hotspots.
How do you install the skill?
Download the skill ZIP from the item page on this directory. Unzip it into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only within that project. Each skill sits in its own folder containing SKILL.md.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the ZIP there.
- Personal use: unzip into ~/.claude/skills/.
- Single project: unzip into the project's .claude/skills/ folder.
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP.
What requirements do you need before using it?
The skill assumes working knowledge of monitor mode, aircrack-ng and hashcat. It is not a one-click tool. The source lists these requirements: a Linux machine with a monitor-mode capable Wi-Fi adapter, the aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng), hcxdumptool and hcxtools (hcxpcapngtool), and hashcat, with GPU drivers recommended.
You also need a wordlist such as rockyou.txt, weakpass, or OneRuleToRuleThemAll rules. Optional vendor generators include upc_keys, skylogin, BT-Hub-PSK-Generator and ZyxelKeygen. The skill runs no scripts and makes no network calls of its own.
- Linux with a monitor-mode capable Wi-Fi adapter
- aircrack-ng suite, hcxdumptool, hcxtools, hashcat
- Wordlists and rules, plus optional vendor generators
How do you trigger the skill with a natural request?
Agents load a skill when your request matches its description. Describe the situation plainly and name the scope. The skill's description mentions WPA/WPA2 Personal networks, PMKID, four-way handshake, hashcat and vendor default passwords, so requests using those terms are most likely to load it.
State the authorization in the request. A useful pattern is: the network is WPA2 Personal, we own it or have a signed scope for it, and we want to see whether its PSK can be recovered from a PMKID or handshake. Expect the agent to work from the skill's workflow, not to attack anything it cannot reach through the tools you have installed.
- Example: "Our signed scope includes the WPA2-PSK network with BSSID AA:BB:CC:DD:EE:FF. Walk me through a PMKID-first test and conversion to hc22000."
- Example: "I own this lab access point. A PMKID capture came back empty. What is the handshake fallback path, and how do I check the capture is valid?"
- Example: "Which mask attacks in this skill fit an 8-digit default PSK, and how do I run them against my hash file?"
What does a typical workflow look like?
The skill sets out a fixed order. Confirm the target BSSID, channel and encryption first. Try PMKID capture, since many access points answer without a real client. If no PMKID appears, capture a four-way handshake, using a single targeted deauthentication rather than a broadcast one, because the skill notes broadcast deauth is louder and trips intrusion detection faster.
After capture, convert the file with hcxpcapngtool and check its output for lines reading AUTHORIZED. The skill warns that partial handshakes will not crack, so recapture if the check fails. Then run a dictionary attack with rules, and fall back to mask attacks for common default patterns such as 10-digit or 8-digit keys.
- Identify target and encryption.
- Try PMKID first.
- Fall back to a four-way handshake if no PMKID is yielded.
- Convert to hc22000 and verify the capture.
- Crack offline with dictionary, rules, then masks.
hcxpcapngtool -o hash.hc22000 handshake-01.capWhat safety limits and notes should you follow?
The skill is an offensive playbook, so the limits matter. Only test networks you own or have written, signed permission to test. Unauthorized access to Wi-Fi networks is illegal in most jurisdictions. The skill's own guidance is to restrict PMKID sweeps to an authorized BSSID list and to keep deauthentication to one client at a time.
Monitor-mode interfaces and deauthentication can be detected by wireless intrusion detection systems and can disrupt connected devices. Plan the engagement with the client's network team, record what you captured and when, and delete captures and hash files according to your engagement terms. The skill is not a substitute for knowing these tools.
- Use an authorized target list (the skill's --filterlist_ap approach).
- Prefer single-client deauth bursts over broadcast deauth.
- Expect detection by wireless intrusion systems and possible disruption.
- Keep records and handle capture files under your engagement rules.
What people use it for
- Testing whether a client's consumer-grade WPA2 Personal router uses a weak or vendor-default key during an authorized engagement.
- Teaching a security student the PMKID and handshake concepts on their own lab access point.
- Writing the wireless section of a red team report for an SMB office network under a signed scope.
- Checking whether a home network's key falls into a common default pattern such as a fixed-length digit string.
Frequently asked questions
How do I install the offensive-wpa2-psk skill?
Download the skill ZIP from this item page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings, Capabilities, Skills.
What do I need to run offensive-wpa2-psk?
You need a Linux machine with a monitor-mode capable Wi-Fi adapter, the aircrack-ng suite, hcxdumptool and hcxtools, and hashcat with GPU drivers recommended. You also need a wordlist such as rockyou.txt. The skill itself runs no scripts and makes no network calls.
Is offensive-wpa2-psk free to use?
The source lists the licence as MIT. The skill is intended for authorized testing only, and using it against networks without permission is illegal in most jurisdictions.
Why does my hash.hc22000 file come out empty?
According to the skill, an empty hash file means the access point did not yield a PMKID. Move to the four-way handshake capture instead. If a handshake is partial, the skill says to recapture because bad or partial handshakes will fail to crack.
What is the difference between a PMKID attack and a handshake capture?
A PMKID attack can work without a connected client, so it is the skill's preferred first step. A four-way handshake capture needs a client associated with the network and usually a targeted deauthentication to force a reconnect.
What should I use alongside this skill?
The skill refers to a companion skill named offensive-wifi-recon for identifying the target BSSID, channel and encryption. You also need the named tools installed locally, since the skill does not run anything itself.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a trained penetration tester or student working under written authorization, and you already understand monitor mode, aircrack-ng and hashcat. Pick something else if you want a one-click tool, or if you have no permission to test the network, since this playbook is for authorized assessments only.
Download the skill