cowpatty

cowpatty is designed for auditing WPA-PSK and WPA2-PSK networks to identify weak passphrases. It performs dictionary attacks by testing passphrases against captured 4-way handshakes to recover the pre-shared key (PSK). The tool requires a libpcap capture file containing the authentication handshake, a dictionary of potential passphrases, and the target network SSID.

The workflow involves two main components: genpmk for precomputing Pairwise Master Keys (PMKs) from a passphrase dictionary and the target SSID, and cowpatty for performing the actual dictionary attack against the captured handshake. This precomputation step significantly speeds up the cracking process by avoiding real-time PMK calculations during the attack.

Use cases include wireless penetration testing and security assessments where identifying weak WPA/2-PSK passphrases is necessary to evaluate network security posture.

cowpatty attacks WPA-PSK authentication by exploiting the 4-way handshake process. The genpmk tool precomputes PMK hash files from passphrase dictionaries using PBKDF2-HMAC-SHA1 with 4096 iterations for the given SSID. cowpatty then reads libpcap captures, extracts the 4-way handshake (ANonce, SNonce, MIC), and tests dictionary passphrases by recomputing PMKs from the precomputed file and deriving PTK to verify MIC authenticity. Successful passphrase recovery reveals the PSK.