A Low-Cost Laboratory Framework for Demonstrating WPA2-PSK Handshake Capture and Password-Risk Assessment

11th International Scientific Conference Technics, Informatics and Education – TIE 2026, (pp. 238-246)

АУТОР(И) / AUTHOR(S): Saša Cvetković , and Georgii Samylkin  

Download Full Pdf   

DOI: https://doi.org/10.46793/TIE26.238C

САЖЕТАК /ABSTRACT:

Wireless networks remain an essential part of modern digital infrastructure, while Wi-Fi Protected Access 2 – Pre-Shared Key (WPA2-PSK) is still widely used in home, educational, and small office environments. Although WPA2-PSK relies on strong cryptographic mechanisms, its practical security depends heavily on the strength of the selected passphrase. This paper presents a low-cost laboratory framework designed to demonstrate the relationship between WPA2-PSK handshake capture, packet-level verification, and offline password-risk assessment. The proposed exercise uses a controlled test network, a Raspberry Pi Zero 2 W device for handshake collection, Wireshark for packet inspection, and Hashcat for demonstrating offline candidate-password verification. The contribution is educational and practical rather than cryptanalytic: it organizes known WPA2-PSK concepts into a reproducible, ethically constrained laboratory workflow suitable for cybersecurity training. The framework helps students understand why the password is not transmitted directly, why captured handshake material can still enable offline testing, and why weak or predictable passphrases remain a major security risk.

КЉУЧНЕ РЕЧИ / KEYWORDS: 

WPA2-PSK; wireless security; cybersecurity education; handshake capture; password assessment; laboratory exercise

 ПРОЈЕКАТ / ACKNOWLEDGEMENT:

This study was partly supported by the Ministry of Science, Technological Development and Innovation of the Republic of Serbia, Grant No. 451-03-33/2026-03/200132, through the University of Kragujevac—Faculty of Technical Sciences Čačak.

ЛИТЕРАТУРА / REFERENCES:

  • Almubayed, A., Alotaibi, B. & Alzahrani, A. (2022). A comprehensive survey of Wi-Fi security: Threats, vulnerabilities, and countermeasures. Journal of Information Security and Applications, 66, 103143. DOI:10.1016/j.jisa.2022.103143
  • Arce, J., Martinez, F. & Lopez, J. (2021). Evaluating WPA2-PSK resilience against dictionary-based password recovery attacks. IEEE Access, 9, 54121-54132. DOI:10.1109/ACCESS.2021.3070658
  • (2004). IEEE standard for information technology–Telecommunications and information exchange between systems–Local and metropolitan area networks–Specific requirements– Part 11: Wireless LAN medium access control (MAC) and physical layer (PHY) specifications: Amendment 6: Medium access control (MAC) security enhancements. IEEE Std 802.11i-2004.
  • Vanhoef, M. & Piessens, F. (2017). Key reinstallation attacks: Forcing nonce reuse in WPA2. Proceedings of the 24th ACM Conference on Computer and Communications Security, 1313-1328. DOI:10.1145/3133956.3134027
  • Vanhoef, M. & Piessens, F. (2013). Advanced Wi-Fi attacks using commodity hardware. Proceedings of the 30th Annual Computer Security Applications Conference, 256-265. DOI:10.1145/2664243.2664277
  • Kumar, A., Garg, R. & Goel, S. (2020). Wireless network attacks: A comprehensive review. International Journal of Computer Applications, 176(28), 20-29. DOI:10.5120/ijca2020919907
  • Wireshark Foundation. (2023). Wireshark user guide. Available at: https://www.wireshark.org/docs/
  • Hashcat Project. (2025). Hashcat: World’s fastest and most advanced password recovery utility. Available at: https://hashcat.net/hashcat/
  • Pwnagotchi Project. (2025). Pwnagotchi: Deep reinforcement learning instrumenting bettercap for WiFi pwning. Available at: https://www.pwnagotchi.ai
  • Carranza, A., Mayorga, D.S., & DeCusatis, C.M. (2018). Comparison of Wireless Network Penetration Testing Tools on Desktops and Raspberry Pi Platforms. The 16th LACCEI International Multi-Conference for Engineering, Education, and Technology: “Innovation in Education and Inclusion”.
    DOI: 10.18687/LACCEI2018.1.1.128.
  • Salib, Emil. (2023). WPA3 Personal and Enterprise Wireless Security Algorithm Labs for Undergraduate Level. DOI: 10.18260/1-2–44438.
  • Wi-Fi Alliance. (2018). WPA3 specification and security enhancements. Available at: https://www.wi-fi.org/discover-wi-fi/security
  • (2025). Weakpass password datasets. Available at: https://weakpass.com

 

Post Views: 16