WPA2-PSK attacks

When it applies

An authorized wireless assessment where a WPA2-Personal (pre-shared key) network is in scope and you have a monitor-mode-capable adapter within radio range. This is pentest-only — wireless testing needs physical proximity and authorization for the specific SSIDs (record them in scope.txt).

Why it works

WPA2-PSK derives its session keys from the passphrase and values exchanged in the 4-way handshake. Capture that handshake (or a single PMKID from the AP) and you can brute the passphrase offline — no further interaction with the network, no lockout. Weak/guessable PSKs fall quickly.