PMKID Attack
Definition
A 2018 technique by Jens Steube (hashcat author) that derives the Pairwise Master Key Identifier from a single EAPOL frame the AP advertises, removing the need to capture a client handshake. Hashcat mode -m 16800.
- Discovered by
- Jens Steube, hashcat author
- Year
- 2018
- Target
- WPA / WPA2-PSK networks
- Capture requirement
- Single EAPOL frame from the access point
- Hashcat mode
- -m 16800
Common questions
How does the PMKID attack differ from a traditional handshake capture?+
A traditional attack needs a full four-way handshake between a client and the AP, often forcing a deauthentication to capture it. The PMKID attack instead pulls the identifier straight from the AP's own advertisement, so no client needs to be connected or disrupted at all.
Does the PMKID attack work against every WPA2 access point?+
No. Some access point firmware does not include the PMKID field in its frames, and the technique does not apply to WPA3-SAE networks, so an examiner or attacker still needs to confirm the target advertises PMKID before relying on it.
Related terms
- 4-Way Handshake
- The WPA/WPA2 key-establishment exchange between client and AP. Captured frames let an offline dictionary attack recover a weak PSK. WPA3 replaces this...
- BSSID / ESSID
- BSSID is the MAC address of the access point (or virtual AP). ESSID is the human-readable network name broadcast in beacons. Multiple...
- Evil Twin
- A rogue AP broadcasting the same ESSID as a legitimate network at a stronger signal, so clients with cached profiles auto-associate. Often...
- IMSI Catcher
- A rogue base station (commercial: Stingray, Hailstorm, KingFisher; research: USRP plus srsRAN or YateBTS) that impersonates a cellular cell, forces nearby phones...
- KRACK
- Key Reinstallation Attack, CVE-2017-13077, disclosed by Mathy Vanhoef in 2017. By replaying message 3 of the 4-way handshake, the client is forced...