Handshake Lab
Capture one handshake on $LAB_SSID — airodump literacy; optional crack on YOUR lab PSK only.
Visual · t15_handshake_lab
Lab: handshake capture on $LAB_SSID. Original Cyberlium.
Evidence is a redacted pcap header — not a cracked neighbor network.
On YOUR lab AP: confirm $LAB_SSID/BSSID in RoE, start monitor on $LAB_IFACE, airodump-ng filtered to your BSSID, associate a lab client to generate handshake, verify.cap shows WPA handshake in output. If brief allows, run offline test against YOUR known-weak lab passphrase you rotate after — not production home Wi-Fi. Save redacted notes; chmod 600; delete captures after lab.
1. Filtered capture
airodump-ng --bssid $BSSID -c channel -w lab-handshake $LAB_IFACE.
Confirm ESSID matches $LAB_SSID before saving file.
Command guide
Try these commands — Filtered capture
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Handshake lab — https://www.aircrack-ng.org/doku.php?id=simple_wpa_crack Wireshark EAPOL — https://www.wireshark.org/docs/wsug_html_chunked/ChWirelessWLANTraffic.html
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install aircrack-ng sudo apt install tcpdump
macOS: Prefer Kali VM
Windows: Use Kali VM Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
grep LAB_SSID "$HOME/cyberlium-lab/t15-wifi/roe.txt" 2>/dev/null || true sudo timeout 10 airodump-ng --bssid ff:ff:ff:ff:ff:ff --channel 6 wlan0 2>/dev/null || sudo tcpdump -i any -c 8 -n 2>/dev/null || echo 'Capture on YOUR lab AP channel only'
Primary tools to practice this lesson: airodump-ng, tcpdump. Reference sites: Handshake lab (https://www.aircrack-ng.org/doku.php?id=simple_wpa_crack); Wireshark EAPOL (https://www.wireshark.org/docs/wsug_html_chunked/ChWirelessWLANTraffic.html). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Handshake verify
Look for 'WPA handshake: AA:BB:' line in airodump top table.
No handshake → fix client association on lab AP; no deauth on foreign BSSIDs.
3. Teardown
Stop monitor mode. Power down lab AP if portable.
Secure or delete.cap; rotate lab PSK if weak passphrase was used.
4. What you ship: handshake lab pack
Filtered airodump command + handshake verify line + teardown.
5. What you record before the next lesson
Redacted lab notes path.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Deauth flood on café SSID to 'get handshake faster.'
- Right: Lab capture on $LAB_SSID only. Next: quiz.
Mission: handshake lab
1) RoE check $LAB_SSID/BSSID. 2) Capture handshake with filtered airodump. 3) Verify handshake line; teardown and secure files.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Handshake incomplete — which message missing?”
APPLY: Lab proves:
APPLY: True or False: Deauth strangers to capture is OK.
APPLY: After lab: