PSK Offline Risk
Offline guessing against captured handshakes — understand risk; test only YOUR lab PSK.
Visual · t15_psk_offline_risk
Offline = attacker works without live AP contact. Original Cyberlium.
A captured handshake plus a weak password beats WPA2 marketing every time.
Once an attacker has a valid four-way capture and the SSID, they can run offline dictionary or brute-force attacks against the PSK at GPU speed — the AP is not involved. That is why 'Summer2020!' fails and why passphrase length and randomness matter. Cyberlium teaches the risk model on captures from $LAB_SSID with passphrases YOU chose for the lab — never run wordlists against café or dorm captures.
1. Offline vs online
Offline attacks use pcap + wordlist/hashcat-style workflows on attacker hardware.
Online attacks hammer the AP directly — lockouts and logs apply; different defender story.
Command guide
Try these commands — Offline vs online
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PSK selection — https://www.wi-fi.org/discover-wi-fi/security aircrack-ng — https://www.aircrack-ng.org/ (offline crack — YOUR captures only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in)
═══ LINUX / macOS ═══
Command — copy this
grep LAB_SSID "$HOME/cyberlium-lab/t15-wifi/roe.txt" 2>/dev/null nmcli -f SSID,SECURITY device wifi list 2>/dev/null | grep -i wpa | head -5 echo 'Use long random PSK on YOUR AP — never crack neighbor handshakes'
Primary tools to practice this lesson: nmcli, grep. Reference sites: PSK selection (https://www.wi-fi.org/discover-wi-fi/security); aircrack-ng (https://www.aircrack-ng.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Passphrase hygiene
Random 15+ character passphrases resist practical offline guessing.
SSID in PMK derivation means common SSIDs do not weaken crypto but appear in every capture file name.
3. Course boundary
Lab may demonstrate crack on YOUR disposable lab PSK you rotate after — not neighbor networks.
No sharing capture files from public spaces. No 'crack my friend's Wi-Fi' homework.
4. What you ship: offline PSK risk paragraph
Offline vs online contrast. Strong passphrase rule. $LAB_SSID-only testing.
5. What you record before the next lesson
Risk paragraph + passphrase policy sentence.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Run hashcat on a handshake from the coffee shop next door.
- Right: Explain offline risk. Next: lab SSID only.
Mission: PSK risk notes
1) Write offline vs online in one line each. 2) Write passphrase strength rule. 3) Write NEVER crack stranger captures.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Why does SSID matter in PMK?”
APPLY: Offline PSK attack needs:
APPLY: True or False: Weak PSK fails even with WPA2.
APPLY: Stranger handshake cracking:
Lab SSID Only
Part of Wireless Hacking — Handshake and PSK Literacy.
Handshake Lab
Part of Wireless Hacking — Handshake and PSK Literacy.
Quiz — Handshake and PSK Literacy
Part of Wireless Hacking — Handshake and PSK Literacy.