← Back to Blog
29 Jul 2026 Cybersecurity, Ethical Hacking

My First Wi-Fi Security Lab: What I Learned Testing WPA2 on My Own Network

Captured my first WPA2 handshake and cracked a weak password in under a minute. Here’s what actually happens behind the scenes and why password strength matters.

My First Wi-Fi Security Lab: What I Learned Testing WPA2 on My Own Network

Date: July 27, 2026
Category: Cybersecurity / Ethical Hacking

Introduction

One of the reasons I got interested in cybersecurity was that I wanted to understand how attacks actually work instead of only reading about them. Wi-Fi security seemed like a good place to start because it's something almost everyone uses, yet many people don't realize how much password strength matters.

For this lab, I set up a controlled environment using my own router and hardware to see how WPA2 authentication works and how offline password recovery is performed after capturing a valid handshake.

Everything in this post was done against my own network for educational purposes.

Hardware

I kept the setup simple:

Nothing about the hardware was particularly expensive, which was part of the reason I wanted to try this experiment.

Enabling Monitor Mode

The first step was putting the Wi-Fi adapter into monitor mode so it could capture raw 802.11 traffic instead of behaving like a normal client.

sudo airmon-ng start wlan0

One thing I learned fairly quickly is that many guides still reference iwconfig, but on newer systems it's largely deprecated. I used iw dev instead to verify that the interface had successfully switched to monitor mode.

Finding My Access Point

Next, I scanned nearby wireless networks.

sudo airodump-ng wlan0mon

I located my own access point and noted its BSSID and operating channel before stopping the scan.

Capturing the WPA2 Handshake

Instead of scanning every network, I started a capture focused only on my router.

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Since my devices were already connected, there wasn't an active authentication exchange to capture. To generate a new handshake, I disconnected one of my own devices so it would reconnect automatically.

Once the client reauthenticated, Airodump-ng displayed the message indicating that a WPA handshake had been captured, and the capture was saved as capture-01.cap.

Seeing that message was satisfying because it confirmed the capture had worked exactly as expected.

Preparing the Capture

Modern versions of Hashcat use the 22000 hash format, so the capture first needed to be converted.

hcxpcapngtool -o handshake.22000 capture-01.cap

The conversion completed successfully and detected a valid EAPOL handshake, which meant the capture was ready for offline password recovery.

How the Handshake Works

One thing I initially misunderstood was what the WPA2 handshake actually contains. The handshake does not include the Wi-Fi password, even in encrypted form. Instead, it contains cryptographic information that proves both the client and the router know the same password without ever transmitting it.

When Hashcat loads the captured handshake, it doesn't decrypt anything. Instead, it takes a password guess, derives the same cryptographic keys that the router and client would generate, and checks whether the result matches the captured handshake. If it doesn't match, the guess is discarded. If it does, the correct password has been found.

This is why WPA2 attacks are considered offline attacks: once a valid handshake has been captured, password guesses can be tested locally without interacting with the router again. As a result, the strength of the Wi-Fi password becomes the most important factor in resisting this type of attack.

Running Hashcat

For this lab, I intentionally configured my test network with an 8-digit numeric password so I could measure how quickly a relatively weak password could be recovered.

I launched Hashcat with a simple numeric mask attack.

.\hashcat.exe -m 22000 -a 3 handshake.22000 ?d?d?d?d?d?d?d?d

Hashcat detected my RTX 3050 without any issues and averaged roughly 342,000 guesses per second.

The complete keyspace for an 8-digit numeric password contains 100 million possible combinations, so the estimated runtime was only a few minutes. Because the password happened to be relatively early in that range, it was recovered in under a minute.

During the attack, GPU utilization stayed close to 98%, while temperatures remained around 75°C.

What I Learned

The biggest takeaway wasn't how to crack a password, it was understanding why password strength matters so much.

An 8-digit numeric password feels reasonably secure from a human perspective, but it only represents 100 million possibilities. Modern GPUs can work through that search space surprisingly quickly.

A few other things stood out:

Final Thoughts

This was my first hands-on wireless security lab, and it helped connect a lot of concepts that had previously only made sense in theory.

Reading about WPA2 attacks is useful, but capturing a handshake yourself and seeing an offline attack succeed against a deliberately weak password gives you a much better understanding of why strong passwords are so important.

As soon as I finished the experiment, I replaced the test password on my own network with a long, randomly generated passphrase.

I'm looking forward to exploring more areas of wireless security as I continue learning.

Tools

Hardware Used

← All Posts
OG