WPA Decryption Using Wireshark

This method enables you to see the actual IP traffic of a Wi-Fi client that uses WPA encryption.
You must know the WPA passphrase, and capture a 4-way handshake for that client.

[joegodby]

I don't comment much on videos, but yours was extraordinarily well done. Why?...Simple, to the point, clear, no loud music, no immature 'hacking themes' and high quality video. Oh yes, and it help clearly explain something I was trying to understand. Thanks!

[simonlim]

Thanks for the video. I want to confirm the passphrase and SSID format is passphrase:SSID? The ':' separates the passphrase and SSID?
Another question: if we are using WPA2-AES, what format would you use? Thanks.

[infectedplus]

Hello. I have a couple questions since I am not able to de-crypt a WPA2 packet.

1. In order to capture the 4 way handshake should be enough to wait until the target device is reconnected to the wifi network which I am sniffing?
2. Can I make the 4 way handshake to be captured using aireplay-ng on my terminal? If so should I have wireshark running at the same time?
3. Last not least, does Wireshark needs to be in monitor mode? If so should I do this using airmon-ng and then select then monitor mode interface or selecting the monitor mode through wlan interface at Wireshark would be enough?

[MrBernhard]

Great video mate, really enjoy them, would like to know your reasons for going with Apple Mac and your specs?

[CarlosRodriguez-vgob]

I understand everything you are saying however when i try to use the eapol protocol to decrypt, i keep getting a message stating that in the 4 way handshare i "malformed packets"

[thunkuniversity]

Thanks. One question though. I know this is a few years old, but I only have two 802.11 Radio options. No 802.11x option or place to enter the passphrase. Did wireshark take this away? I'm on a Mac as well. Tried it on windows, but not luck either.

[AUBCodeII]

Ok so let's assume I've started capturing encrypted traffic to and from an AP at 8:00 AM, using airodump-ng. At 8:00 AM three clients are connected to that AP, let's call them c1, c2 and c3. At 8:05 AM, client c4 joins in and therefore I'm able to get their 4-way handshake with the AP. At 8:10 AM I perform a deauthentication attack on c3 and get their handshake when they reconnect to the AP. I stop the capture at 8:15 AM. Based on what you told on the video, given that I have the passphrase to access that network, I'm only able to decrypt the traffic of c4 and c3 (from 8:10 AM to 8:15 AM, and not from 8:00 AM to 8:15 AM)?

[dilshoddavlatov]

what is this filter applied immediately after launching interface in wireshark?

[pastudan]

Super helpful! Only thing is that it took me a second to realize that I need to enable Monitor mode to see other device traffic on my LAN

[raomohsin]

Hi Tall,
This is not working on my PC. How to I know 4 way hand shake capture???? I want to share my pcap file how do I send you pcap file???

[hangeroo]

Okay, I love how straight to the point this was. So is this something you have to do for all wifi traffic that is captured? How would I know if it's using WPA encryption...or do I assume all are anymore? Will this reveal HTTPS encrypted traffic or not? If not, how would i go about decrypting that type of traffic? Thanks in advance for your time!

[ensontaylor]

So cwne88 is the ssid?
Where do I apply the 4way handshake capture?
Do i need to join the network?
I cannot get this to work. Need more information

[plexvid]

So when you capture the handshake will it only decrypt from that one device or will it decrypt all the wi-fi device connected, and can i just pull the plug on the router so everyone has to reconnect and capture the handshake ??? Thanks for sharing.

[BharatNTIE]

Sir !!!!Super like very simple!!! however a question on capture 4 Way Handshake. Does the wireshark capture the association between the Smartphone you have and the AP. Here is where i lost it, unless the capture represents L2 Assoc between your smart phone and AP:-

a) Configure your MAC in Monitor Mode. Obviously you associate the MAC Book to the AP before you can start wireshark.
b) But i thought the 4 WAY handshake is already done (on MAC book Pro) before you initiate Wireshark on MAC book.
c) I did not see you associating the Smart Phone, where did you obtain the 4way handshake from, is the wlan.addr the mac of the smart phone radio. Only then does it make sense.

Thanks
Bharat

P.S. Just for fun how can i obtain the Passphrase if i wanted

[richardwalters]

So ... right now, my Mac's Wireshark seems to ONLY accumulate 802.11 Protocol type information ... Is this something I need to do to see TCP Protocol information ?

[gamuchiraindawana]

Wait so is the wifi password what I enter as the WEP AND WPA Decryption Key?

[michaploc]

Something similar possible in 802.1x Networks? How top debug them?

[ayoub]

Hi when I open wireshark I don't find any network interface to select and also I have installed Wincap and Ncap. I can't find any solution on the internet, can you help me? THANKS

[MrRafabro]

Hey man, i've tried it and it's not working for some reason. I'm on windows, so I'm now thinking it's because of that since I can't activate monitor mode. I'm trying to sniff my friends computer packets just to learn a bit how to do it. I'm filtering for his ip, did all like you did in the 802.11 preferences and enable decryption and when he connects to the wi-fi I still don't get the 4 way handshake for some reason. Someone have any suggestions?

[CarlGmm]

I tried the steps that you used in this video, but even after entering the correct SSID and password the packets remain the same and I am still unable to read them. Any help would be appreciated