PMKID Attack

`pmkid` / `pm` — PMKID Capture + Crack

Captures the PMKID from a single EAPOL M1 frame and optionally cracks the WPA2 password on-device. No client required.

By default pm is active (clientless): it spoofs a client MAC and sends the AP an open Authentication + Association Request, so the AP immediately replies with M1 carrying the PMKID — no waiting for a real client. Add passive for a silent, transmit-nothing sniff that only waits for a real client to associate.

CMD> pm <index|bssid> [channel]           ← active (forces the PMKID)
CMD> pm passive <index|bssid> [channel]   ← silent, no-TX sniff
CMD> pm 2
CMD> pm AA:BB:CC:DD:EE:FF 6
CMD> pm passive 2

Mode	Command	Transmits?	Needs a real client?
Active (default)	`pm <idx>`	Yes (auth + assoc)	No — forces M1 on demand
Passive	`pm passive <idx>`	No	Yes — waits for one to associate

How PMKID works

The AP embeds a PMKID in every EAPOL M1 frame it sends to associating clients:

PMKID = HMAC-SHA1-128(PMK, "PMK Name" || AP_MAC || STA_MAC)

Because the PMKID is derived directly from the PMK (which comes from the password), cracking it only requires one M1 frame — no M2, no deauth, no client interaction needed.

Step 1 — Capture

CMD> sw          ← scan first to build index
CMD> pm 2        ← target AP at index 2

In the default active mode, Al-Anqa spoof-associates to the AP to force it to send M1 straight away (retried every 800 ms until captured). In passive mode it just listens and the AP sends M1 whenever any client naturally associates. When a PMKID is found in the Key Data, the screen shows:

[PMKID CAPTURED!]
A1B2C3D4E5F6A7B8   ← first 8 bytes preview
[c] crack   [q] stop

Note: Not all APs include the PMKID KDE in M1. If you see M1 seen — no PMKID in Key Data, that AP does not embed a PMKID — use ws instead. (Software APs such as hostapd deliberately omit the PSK PMKID; most consumer routers include it.)

Step 2 — Crack

Press c after capture to start on-device cracking.

Al-Anqa computes PBKDF2-SHA1(passphrase, SSID, 4096) → PMK → HMAC-SHA1-128("PMK Name"||AP||STA) and compares against the captured PMKID.

Wordlist source	Path	Behaviour
SD wordlist	`/apps/pmkid/wordlist.txt`	Tried first, unlimited size
Built-in list	(embedded)	101 common WPA passwords, used as fallback

Results are saved to /apps/pmkid/cracked.csv with a PMKID tag to distinguish from handshake cracks.

Offline cracking with hashcat

Pull the PCAP from SD and convert:

hcxpcapngtool -o hash.hc22000 /apps/pmkid/AA-BB-CC-DD-EE-FF.cap
hashcat -m 22000 hash.hc22000 wordlist.txt

Keys

Key	Action
`c`	Start cracking (after PMKID captured)
`q`	Stop capture or cracking

Files

Path	Contents
`/apps/pmkid/<BSSID>.cap`	Raw 802.11 PCAP (libpcap, linktype 105)
`/apps/pmkid/cracked.csv`	Cracked PMKID passwords
`/apps/pmkid/wordlist.txt`	Custom wordlist (one password per line, ≥8 chars)

vs WPA Sniff (`ws`)

	`pm` (PMKID)	`ws` (Handshake)
Frames needed	M1 only	M1 + M2
Client required	No	Yes (or deauth to force)
Deauth sent	No	Yes, every 4s
Router support	~80% of modern routers	Universal
Stealth	Higher	Lower