Capture a WPA2 Handshake

Intercept a WPA2 4-way handshake from your own WiFi using Kali Linux.

Introduction

30 Second Summary

Every time you connect to WiFi, your device and router exchange a secret handshake to prove they both know the password. If someone captures that handshake, they hold everything needed to test whether your password can be cracked offline.

In this project, you will use a USB WiFi adapter connected to a Kali Linux virtual machine to intercept and capture the WPA2 handshake from your own network.

What You'll Build

You will have a verified packet capture file containing the cryptographic exchange your router performs every time a device connects to your WiFi, proving you can perform the foundational step of wireless penetration testing.

By the end of this project, you'll have:

A USB WiFi adapter passed through VirtualBox into your Kali VM, switched into monitor mode and listening to all wireless traffic around you.
A live scan showing every WiFi network nearby with their encryption type, signal strength, and connected clients using airodump-ng.
A captured .cap file containing your network's WPA2 4-way handshake, triggered by a deauthentication attack you sent to force a client to reconnect.
Secret Mission: Crack your own WiFi password using the captured handshake and a wordlist to demonstrate why weak passwords fail even with WPA2 encryption.

Are there any prerequisites?

This project assumes you already have VirtualBox with the Extension Pack installed and a Kali Linux VM set up.

You also need a Realtek RTL8188FTV USB WiFi adapter plugged into your computer and your own WiFi network with at least one other device (phone, tablet, laptop) connected to it.

Before We Start

Before diving into the terminal, let's lock in what you're about to build and why it matters for understanding how WiFi security actually works.

Connect Your RTL8188FTV to the Kali VM

Your Kali Linux VM runs inside VirtualBox, completely isolated from your physical hardware.

The USB WiFi adapter plugged into your Windows machine is invisible to the VM until you explicitly hand it over through USB passthrough. In this step, you will configure VirtualBox to pass the RTL8188FTV adapter directly to Kali, then install any firmware the adapter needs to function.

In this step, get ready to:

Configure VirtualBox USB passthrough for the RTL8188FTV adapter.
Verify the adapter appears inside the Kali VM.
Confirm the wireless network interface is ready for use.

Configure VirtualBox USB passthrough

VirtualBox needs a USB device filter to know which physical device to detach from Windows and hand over to the VM. You will set this up with the Kali VM powered off so VirtualBox can apply the hardware change cleanly.

If your Kali VM is currently running, right-click it in VirtualBox Manager and select Close > Power Off. Wait for it to shut down completely.
In VirtualBox Manager, select your Kali VM from the list on the left.
Click Settings in the toolbar at the top.
Click USB in the left sidebar of the Settings window.
Select the USB 2.0 (OHCI + EHCI) Controller radio button.

Why USB 2.0 instead of USB 3.0?

WiFi adapters like the RTL8188FTV often work more reliably with the USB 2.0 (OHCI + EHCI) controller in VirtualBox. The USB 3.0 (xHCI) controller can cause recognition failures or connection drops with some adapters.

Plug your RTL8188FTV USB WiFi adapter into a USB port on your Windows machine.
Click the + icon on the right side of the USB Device Filters panel. This is the Add USB Device Filter button.
Select the Realtek device from the dropdown list. It will appear with an identifier containing 0bda:f179 or a name like "Realtek Semiconductor Corp. RTL8188FTV".
Click OK to save the settings.

Don't see the Realtek device in the dropdown?

Make sure the adapter is physically plugged in before clicking the + icon.
Confirm the VirtualBox Extension Pack is installed by going to File > Preferences > Extensions. You should see it listed there.
Try a different USB port on your Windows machine.

help me troubleshoot why my RTL8188FTV adapter doesn't appear in the VirtualBox USB device filter dropdown

Boot Kali and verify the adapter is visible

With the USB filter saved, VirtualBox will automatically capture the adapter when the VM starts. Time to boot Kali and confirm the handover worked.

Select your Kali VM in VirtualBox Manager and click Start.
Wait for Kali to boot fully and log in.
If the adapter is not automatically captured, click Devices in the VirtualBox menu bar at the top of the VM window.
Click USB and check the box next to your Realtek adapter to connect it manually.

Now open a terminal inside Kali to verify the adapter is connected.

Right-click on the Kali desktop and select Open Terminal Here.

Keyboard shortcut for the terminal

You can also press Ctrl+Alt+T to open a terminal anywhere in Kali.

What do you expect to see in the output if VirtualBox successfully passed the USB adapter through to Kali?

List all connected USB devices by running this command:

lsusb

You should see a line containing 0bda:f179 Realtek Semiconductor Corp. in the output. This confirms Windows released the adapter and Kali now controls it directly.

Don't see 0bda:f179 in the lsusb output?

Go to Devices > USB in the VirtualBox menu bar and make sure the Realtek adapter is checked.
Try unplugging the adapter from your Windows machine, waiting 5 seconds, then plugging it back in. Then check Devices > USB again.
If it still does not appear, shut down the VM, verify the USB filter is saved in Settings > USB, and restart.

help me get my RTL8188FTV adapter to show up in Kali after configuring VirtualBox USB passthrough

Confirm the network interface exists

The adapter is connected to Kali at the USB level, but Linux also needs the right driver and firmware to create a usable wireless interface. Check whether the system recognized it as a WiFi device.

Check for a wireless interface by running:

iwconfig

✔️ I see wlan0 listed

Your adapter's driver loaded successfully and the wlan0 interface is ready. You can continue to the next step.

ⓧ No wireless interface appears

The adapter needs Realtek firmware to function. Install it now.

Update the package list and install the firmware by running these commands:

sudo apt update

sudo apt install -y firmware-realtek

After the install finishes, you need to reload the adapter so Linux picks up the new firmware.

In the VirtualBox menu bar, click Devices > USB.
Uncheck your Realtek adapter to disconnect it.
Wait 3 seconds, then check it again to reconnect it.
Verify the wireless interface now appears by running:

iwconfig

You should now see wlan0 listed in the output. If it still does not appear, reboot the VM instead:

sudo reboot

After the reboot, log back in and run iwconfig again to confirm wlan0 is present.

Still no wlan0 after installing firmware?

Run lsusb to confirm the adapter is still connected after the reboot.
Try removing and re-adding the USB device from Devices > USB in the VirtualBox menu bar.
If the adapter shows in lsusb but no wireless interface appears even after firmware install, your specific RTL8188FTV revision may have limited driver support. This is a known variability with this chipset.

help me get wlan0 to appear after installing firmware-realtek for my RTL8188FTV in Kali

Your adapter is live inside Kali and ready for wireless operations. Next up, you will switch it into monitor mode so it can listen to all WiFi traffic in the air.

Enable Monitor Mode

Your RTL8188FTV adapter is connected and Kali recognizes it. Now you need to switch it into a mode that can actually capture other devices' traffic.

In normal managed mode, your adapter only receives packets addressed directly to it. Monitor mode makes it listen to every wireless frame in the air, which is how you will intercept handshakes.

In this step, get ready to:

Kill background processes that interfere with monitor mode.
Switch the adapter from managed mode to monitor mode.
Confirm the interface is actively monitoring.

Kill interfering processes

NetworkManager and wpa_supplicant are background services that manage your WiFi connection. They will fight for control of the adapter and pull it out of monitor mode if left running.

Stop all interfering processes by running this command:

sudo airmon-ng check kill

What does this command do?

`airmon-ng check kill` finds every process that could interfere with your wireless adapter and terminates them.

This includes NetworkManager and wpa_supplicant, which normally handle WiFi connections automatically.

You should see output listing the killed processes with their PIDs and names.

Why did my Kali VM lose internet?

Killing NetworkManager means your VM can no longer manage network connections. This is expected. You do not need internet access for the remaining steps in this project.

Command not found?

Make sure you typed sudo before the command. airmon-ng requires root privileges.
The aircrack-ng suite is pre-installed on Kali Linux. If airmon-ng is somehow missing, run sudo apt install aircrack-ng to install it.
Why isn't airmon-ng working in my Kali terminal?

Start monitor mode

Enable monitor mode on your wireless interface by running:

sudo airmon-ng start wlan0

What does this command do?

`airmon-ng start wlan0` tells your adapter to stop acting as a normal WiFi client and start passively capturing all wireless traffic.

If successful, the interface name changes from wlan0 to wlan0mon to indicate it is now in monitor mode.

Look at the output for a message indicating monitor mode is enabled. The interface name should change to wlan0mon.

Confirm monitor mode is active

Before you run the next command, what do you expect to see for your wireless interface? Will it still show wlan0 in managed mode, or something different?

Check your interface status by running:

iwconfig

You should see wlan0mon listed with Mode:Monitor. This confirms your adapter is now listening to all wireless traffic.

✔️ I see wlan0mon with Mode:Monitor

Your adapter successfully entered monitor mode. You are ready to scan for wireless networks.

Continue to the next step.

ⓧ I still see Mode:Managed or got an error

If iwconfig still shows Mode:Managed or you saw errors like "failed to set interface", your RTL8188FTV chipset does not support monitor mode with the current driver.

This is a known limitation of this chipset. The project cannot continue without monitor mode.

Why does this happen?

Monitor mode requires specific chipset and driver support. The RTL8188FTV uses the rtl8xxxu driver, which has inconsistent monitor mode support depending on kernel version.

You now understand exactly why adapter chipset matters for penetration testing. For future projects, consider an adapter with the Atheros AR9271 chipset (e.g., Alfa AWUS036NHA) which has guaranteed monitor mode support.

Try unplugging and replugging the adapter from the VirtualBox Devices > USB menu, then run sudo airmon-ng start wlan0 again.
If it still fails after replugging, reboot the Kali VM entirely and retry the steps from the beginning of this step.
My RTL8188FTV won't enter monitor mode after multiple attempts. What are my options?

Your adapter is now silently listening to every WiFi frame in the air. Next up, you will use it to scan for your own network and find connected devices.

Scan for Your WiFi Network

Your adapter is now in monitor mode, silently listening to all wireless traffic in range. Next up, you need to find your own network in the noise and identify the specific details required to capture its handshake.

A WPA2 handshake only occurs when a client device authenticates with the router. To capture one, you need three pieces of information: your network's BSSID (the router's MAC address), the channel it broadcasts on, and the MAC address of a connected client device.

In this step, get ready to:

Scan all nearby WiFi networks and identify your own network's BSSID and channel.
Identify at least one connected client device on your network.
Start a targeted capture locked to your network's channel and BSSID.

Start scanning all networks

Your adapter can now hear every WiFi frame in the air. Time to see what is out there.

Before you run this, what do you think your adapter will pick up? How many networks do you expect to see?

Start a full scan of all nearby WiFi networks by running this command:

sudo airodump-ng wlan0mon

You should see a live-updating display split into two sections. The top section lists every WiFi network your adapter can hear. The bottom section lists individual client devices and which network they are connected to.

What do the columns mean?

The top section shows one row per network with these key columns:

BSSID is the router's MAC address (a unique hardware identifier like AA:BB:CC:DD:EE:FF).
PWR is the signal strength. The closer to 0, the stronger the signal.
CH is the channel number the network broadcasts on.
ENC is the encryption type. Look for WPA2.
ESSID is the network name (the one you see when connecting from your phone or laptop).

The bottom section shows connected clients. The STATION column is the client device's MAC address. The BSSID column shows which router it is connected to.

Find your own WiFi network name in the ESSID column.
Note down your network's BSSID (the MAC address in the same row).
Note down your network's channel number from the CH column.
Look in the bottom section for a client (STATION) that is associated with your network's BSSID. Note down that client's MAC address.
Press Ctrl+C to stop the scan.

You should now have three values written down: your BSSID, channel, and a client MAC address.

Can't find your network?

If you do not see your network's name at all, check whether your router broadcasts on 5GHz only. The RTL8188FTV is a 2.4GHz-only adapter, so it cannot see 5GHz networks. Log into your router's admin page and make sure 2.4GHz is enabled.
If you see no networks whatsoever, your adapter may have dropped out of monitor mode. Run iwconfig and confirm wlan0mon still shows Mode:Monitor. If it reverted, re-run the airmon-ng start steps from Step 2.
If the bottom section is empty (no clients), make sure another device (phone, laptop, tablet) is actively connected to your WiFi. You need at least one connected client for the next step.

Still stuck? Help me troubleshoot why airodump-ng isn't showing my WiFi network.

Start a targeted capture on your network

The full scan showed every network in range. Now you will lock airodump-ng onto just your network's channel and BSSID. This filters out all the noise and saves captured packets to a file on disk.

Start a targeted capture that writes packets to a file by running this command (substitute your own values):

sudo airodump-ng -c [[CHANNEL="your network's channel number (e.g. 6)"]] --bssid [[BSSID="your router's BSSID (e.g. AA:BB:CC:DD:EE:FF)"]] -w handshake wlan0mon

What does this command do?

-c locks the adapter to a single channel so it does not hop between frequencies.
--bssid filters traffic to only your router's MAC address.
-w handshake tells airodump-ng to write captured packets to files starting with the prefix handshake (e.g. handshake-01.cap).
wlan0mon is your monitor-mode interface.

The display now shows only your network. You should see the BSSID, channel, and encryption type at the top, with packet counts incrementing as traffic flows.

Leave this terminal running. Do not press Ctrl+C.
Look at the top-right area of the output. You will not see a "WPA handshake:" message yet. The handshake only appears when a client device reconnects to the router.

Why no handshake yet?

A WPA2 4-way handshake happens at the moment a device connects to the router. If every device is already connected and no one reconnects, there is no handshake to capture. You could wait hours hoping someone disconnects naturally.

In the next step, you will solve this by forcing a client to briefly disconnect. When it automatically reconnects, your capture will be waiting.

Seeing an error when starting the targeted scan?

Double-check that your BSSID is in the correct format: six pairs of hex characters separated by colons (e.g. AA:BB:CC:DD:EE:FF). A missing colon or extra character will cause a failure.
Make sure the channel number is a plain integer (e.g. 6), not a string like CH6.
Confirm you typed wlan0mon (with a zero, not the letter O). A typo here gives an "interface not found" error.

Need more help? Help me fix an error when running airodump-ng in targeted mode.

Your targeted capture is now running and writing every packet from your network to disk. The stage is set. In the next step, you will force a connected device to reconnect and catch the handshake in the act.

Capture the WPA2 Handshake

You identified your network's BSSID, channel, and a connected client in the previous step. Now it is time to capture the actual authentication exchange.

A WPA2 handshake only happens when a device connects or reconnects to the router. Passively waiting could take hours. By sending a deauthentication frame to a connected client, you force it to disconnect and immediately reconnect, triggering the 4-way handshake while your capture is already running.

In this step, get ready to:

Send a deauthentication packet to force a client device to reconnect.
Verify the WPA2 handshake appears in the airodump-ng output.
Confirm the capture file is valid and contains the handshake.

Send a deauthentication attack

Your airodump-ng capture is running in terminal 1, silently watching for the handshake. To trigger one, you need to kick a device off the network so it reconnects. You will do this from a second terminal using aireplay-ng.

Open a second terminal window in Kali. Keep airodump-ng running in the first terminal.
Send a deauthentication packet to your connected client by running this command:

sudo aireplay-ng -0 1 -a [[YOUR_BSSID="your router's MAC address"]] -c [[CLIENT_MAC="connected client's MAC address"]] wlan0mon

What does this command do?

-0 1 means send 1 deauthentication packet. This is enough to briefly disconnect the client without being disruptive.
-a specifies the access point (your router's BSSID). The deauth frame is crafted to look like it came from this router.
-c specifies the target client device. Only this device gets disconnected.
The client automatically reconnects within seconds, triggering the WPA2 4-way handshake while airodump-ng is capturing.

You should see output confirming the deauthentication packet was sent. The client device might briefly lose its WiFi connection (a momentary blip).

Seeing 'write failed' or no output?

Make sure you typed wlan0mon (the monitor interface), not wlan0.
Double-check that your BSSID and client MAC addresses have no typos. MAC addresses use colons between each pair of characters (e.g. AA:BB:CC:DD:EE:FF).
If you see an injection error, your adapter may not support packet injection. This is a known limitation of some RTL8188FTV units.

Why isn't my aireplay-ng deauth command working?

Verify the handshake was captured

The deauth packet forces the client to reconnect. During reconnection, the 4-way handshake happens and airodump-ng should catch it.

Switch back to your first terminal where airodump-ng is running.
Look at the top-right corner of the airodump-ng output.

You should see a message that reads WPA handshake: followed by your network's BSSID. This confirms the handshake was captured successfully.

What if I do not see the handshake message?

Sometimes one deauth packet is not enough. The timing has to be just right for airodump-ng to catch all the handshake frames.

Switch back to your second terminal.
Send 5 deauth packets instead of 1 by running:

sudo aireplay-ng -0 5 -a [[YOUR_BSSID="your router's MAC address"]] -c [[CLIENT_MAC="connected client's MAC address"]] wlan0mon

Switch back to terminal 1 and check the top-right corner again. If you still do not see it after a few attempts, try moving your adapter closer to the router, or wait for the client device to reconnect manually.

Once you see the WPA handshake: message, press Ctrl+C in terminal 1 to stop airodump-ng.

Confirm the capture file exists

Airodump-ng saved the captured packets to files on disk. You need to verify the handshake is actually inside the capture file before calling it a success.

List the captured files by running:

ls handshake*

You should see several files including handshake-01.cap. This is the packet capture file containing your handshake.

Before you run the next command, what do you think aircrack-ng will tell you about the capture file? Will it find 0 handshakes, or 1?

Verify the handshake is inside the file by running:

sudo aircrack-ng handshake-01.cap

Aircrack-ng scans the file and displays a summary table listing each detected network, the encryption type, and how many handshakes were found. You should see your network name with 1 handshake next to it.

Press Ctrl+C to exit aircrack-ng. You are not cracking anything yet.

What just happened?

You intercepted the cryptographic exchange between your router and a client device. This 4-way handshake contains a hash derived from the WiFi password.

With this file, someone could run a dictionary attack to guess the password offline, without ever connecting to the network again. That is exactly what the Secret Mission explores.

Seeing '0 handshakes' in aircrack-ng?

The handshake might be incomplete. Go back and send another round of deauth packets while running a fresh airodump-ng capture.
Make sure you did NOT use the --ivs flag with airodump-ng. WPA handshake capture requires full packets, not just IVs.
Confirm your client device actually reconnected to the network after the deauth. Check the device's WiFi status.

Help me figure out why aircrack-ng shows 0 handshakes.

You now have a verified handshake-01.cap file containing your network's WPA2 4-way handshake. This is the foundational capture that wireless penetration testers use as the starting point for password analysis.

Secret mission

Crack Your Own WiFi Password

You captured the handshake. Now prove why weak WiFi passwords are dangerous by running a dictionary attack against your own network and watching how fast aircrack-ng finds the key.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely locally inside your Kali VM, so there are no ongoing cloud costs.

Security reminder

Your wordlist.txt file contains your real WiFi password in plaintext. Your handshake-01.cap file contains your network's authentication data. Both are sensitive. If you choose to keep them, store them securely.

Resources you used:

Monitor mode interface (wlan0mon).
Capture files (handshake-01.cap and related output files).
wordlist.txt (contains your real WiFi password).
VirtualBox USB device filter for RTL8188FTV.

Keep everything running

No action needed. Choose this if you plan to continue experimenting with wireless security tools in Kali.

Your adapter stays in monitor mode and your VM keeps running.
Note that NetworkManager and wpa_supplicant are still stopped, so your Kali VM has no internet access until you restore them.
Your wordlist.txt still contains your real WiFi password in plaintext. Keep this in mind.

Pause - I'll come back to this later

Stop monitor mode and shut down the VM cleanly. Your files and USB filter will be waiting when you return.

Stop monitor mode by running:
Restart NetworkManager to restore internet access inside Kali:

sudo airmon-ng stop wlan0mon
sudo systemctl start NetworkManager

Shut down the Kali VM from the desktop menu or by running:

sudo shutdown now

Your VirtualBox USB filter stays configured. Next time you boot the VM with the adapter plugged in, it will be captured automatically.

Delete - I don't want to use this again

Remove all project files, restore your adapter to managed mode, and clean up the VirtualBox USB filter.

Stop monitor mode and restore NetworkManager:

sudo airmon-ng stop wlan0mon
sudo systemctl start NetworkManager

Delete the capture files and wordlist:

rm handshake*
rm wordlist.txt

Confirm the files are gone:

ls

You should no longer see handshake-01.cap or wordlist.txt in the output.
Shut down the Kali VM:

sudo shutdown now

Remove the USB device filter from VirtualBox. Open VirtualBox Manager, select your Kali VM, then click Settings.
Go to USB.
Select the Realtek RTL8188FTV filter in the list and click the Remove icon (the "-" button).
Click OK to save.

Nice Work!

You just performed the foundational step of wireless penetration testing. You connected a physical USB adapter to a virtual machine, put it into monitor mode, and intercepted a real WPA2 handshake from your own network.

You've learned how to:

Pass a physical USB WiFi adapter through VirtualBox into a Kali Linux VM, install firmware, and enable monitor mode to listen to all nearby wireless traffic.
Scan wireless networks with airodump-ng to identify a target network's BSSID, channel, and connected clients.
Capture a verified WPA2 4-way handshake by sending a deauthentication frame with aireplay-ng and confirming the .cap file contains valid authentication data.
Secret Mission: Used aircrack-ng with a custom wordlist to demonstrate a dictionary attack against your own network's password.

Ready to quiz yourself?