cowpatty

cowpatty cracks a captured WPA/WPA2 handshake against a wordlist, the same job aircrack-ng does. What it adds is genpmk, its companion binary: since the PMK derivation is salted with the network’s SSID, genpmk precomputes the PBKDF2 hash for every word in a wordlist against one specific SSID once, then cowpatty -d reuses that file to crack handshakes from that same SSID near-instantly on every later run — wifite shells out to it as one of its cracking backends.

It lives at Security → Wireless Attacks → cowpatty (a subcategory — cowpatty and genpmk each get their own entry).

The help it prints

cowpatty 4.8 - WPA-PSK dictionary attack. <[email protected]>

Usage: cowpatty [options]

	-f 	Dictionary file
	-d 	Hash file (genpmk)
	-r 	Packet capture file
	-s 	Network SSID (enclose in quotes if SSID includes spaces)
	-2 	Use frames 1 and 2 or 2 and 3 for key attack (nonstrict mode)
	-c 	Check for valid 4-way frames, does not crack
	-h 	Print this help information and exit
	-v 	Print verbose information (more -v for more verbosity)
	-V 	Print program version and exit

genpmk --help (used to precompute the hash file cowpatty -d reads):

genpmk 1.3 - WPA-PSK precomputation attack. <[email protected]>
Usage: genpmk [options]

	-f 	Dictionary file
	-d 	Output hash file
	-s 	Network SSID
	-h 	Print this help information and exit
	-v 	Print verbose information (more -v for more verbosity)
	-V 	Print program version and exit

After precomputing the hash file, run cowpatty with the -d argument.

Examples

# Straight dictionary attack against a captured handshake
cowpatty -r capture-01.cap -f /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -s "TargetSSID"

# Precompute the hash file once for a given SSID (slow)
genpmk -f /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -d TargetSSID.hash -s "TargetSSID"

# Reuse the precomputed hash file — much faster on every later run
cowpatty -r capture-01.cap -d TargetSSID.hash -s "TargetSSID"