Four-Way Handshake
Name the WPA/WPA2-PSK four-way exchange — literacy on YOUR lab AP only.
Visual · t15_four_way_handshake
Four-way proves PSK without sending the key. Original Cyberlium.
The handshake is how Wi-Fi proves you know the password — not permission to grab one from a café.
WPA/WPA2-PSK uses a four-way handshake between client and AP after association. Messages exchange nonces and MICs derived from the PSK — the passphrase never crosses the air in clear text. Attackers who capture a complete handshake offline can attempt PSK guessing against that capture on their own hardware — which is why weak passphrases fail and why scope matters. Learn the message flow on $LAB_SSID documentation and diagrams; do not capture handshakes from neighbor SSIDs.
1. Four messages, one proof
Message 1: AP sends ANonce. Message 2: client sends SNonce + MIC. Messages 3–4 confirm keys and GTK delivery.
Each side proves knowledge of the PSK through key derivation (PMK → PTK) without transmitting the passphrase.
Command guide
Try these commands — Four messages, one proof
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
4-way handshake — https://www.wi-fi.org/knowledge-center/glossary Wireshark EAPOL — https://www.wireshark.org/docs/wsug_html_chunked/ChWirelessWLANTraffic.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install tcpdump
macOS: Built-in
Windows: Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
sudo tcpdump -i any -c 10 -n 'ether proto 0x888e' 2>/dev/null || echo 'Filter EAPOL on YOUR lab SSID capture only' tshark -i any -c 5 -Y 'eapol' 2>/dev/null || tcpdump -i any -c 5 -n 2>/dev/null | head -5
Primary tools to practice this lesson: tcpdump, tshark. Reference sites: 4-way handshake (https://www.wi-fi.org/knowledge-center/glossary); Wireshark EAPOL (https://www.wireshark.org/docs/wsug_html_chunked/ChWirelessWLANTraffic.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What capture means (concept)
A complete handshake in a pcap proves a client authenticated — useful for offline PSK testing on YOUR lab capture only.
Incomplete captures (missing message 1 or 4) may not crack — literacy includes knowing when a capture is usable.
3. Defender view
Strong passphrases and WPA3-SAE reduce offline guessing value.
Monitor for deauth floods aimed at forcing re-handshakes — a signal on enterprise and home SOC dashboards.
4. What you ship: four-way handshake vocabulary
Four messages named. PSK not sent in clear. $LAB_SSID-only capture rule.
5. What you record before the next lesson
Four-way flow paragraph + defender deauth note.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Capture a handshake from a neighbor SSID 'to study.'
- Right: Name four-way flow. Next: PSK offline risk.
Mission: four-way literacy sheet
1) Sketch messages 1–4 with ANonce/SNonce labels. 2) Write why PSK is not sent over the air. 3) Write $LAB_SSID-only capture rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Which message carries the MIC?”
APPLY: Four-way handshake proves:
APPLY: True or False: Capturing handshakes from stranger SSIDs is in scope.
APPLY: Deauth floods may aim to:
PSK Offline Risk
Part of Wireless Hacking — Handshake and PSK Literacy.
Lab SSID Only
Part of Wireless Hacking — Handshake and PSK Literacy.
Handshake Lab
Part of Wireless Hacking — Handshake and PSK Literacy.