EAPOL Hunter

A passive WiFi 4-way handshake capture tool with automatic channel hopping.

What it does

Listens on a monitor-mode wireless interface and captures WPA/WPA2 4-way EAPOL handshakes as clients connect to access points. When a complete handshake is captured, it saves a PCAP file ready for offline password cracking with aircrack-ng or hashcat.

It also passively captures beacon frames so SSIDs are automatically associated with handshakes — no manual input required.

Channel hopping

Every 5 minutes the script cycles through channels 1–11 (2.4 GHz). This means it will eventually see traffic on every channel without you having to manage it manually. If you are targeting a specific AP, lock the channel yourself with iw before running.

Requirements

• Python 3
• Scapy — pip install scapy
• A wireless card that supports monitor mode
• iw or iwconfig (for channel switching)
• Root / sudo privileges

Usage

sudo python3 eapol_hunter.py <interface> [bssid]

Argument	Description
interface	Monitor-mode interface (e.g. wlan0mon)
bssid	Optional — filter for a specific AP MAC address

Examples

# Capture from all APs on all channels
sudo python3 eapol_hunter.py wlan0mon

# Capture only from a specific AP
sudo python3 eapol_hunter.py wlan0mon AA:BB:CC:DD:EE:FF

Putting your card into monitor mode

sudo ip link set wlan0 down
sudo iw wlan0 set monitor none
sudo ip link set wlan0 up

Or with aircrack-ng tools:

sudo airmon-ng start wlan0
# interface will typically be renamed to wlan0mon

Output

Each captured handshake is saved to a .pcap file in the current directory:

handshake_AABBCCDDEEFF_20260218_081005.pcap

The file includes a beacon frame (for SSID) followed by the 4 EAPOL messages. The terminal shows extracted cryptographic values (ANonce, SNonce, MIC) and the exact commands to crack the handshake.

Cracking captured handshakes

aircrack-ng:

aircrack-ng -w wordlist.txt handshake_AABBCCDDEEFF_20260218_081005.pcap

hashcat (via hcxtools):

hcxpcapngtool -o output.hc22000 handshake_AABBCCDDEEFF_20260218_081005.pcap
hashcat -m 22000 output.hc22000 wordlist.txt

Legal

Only use this tool on networks you own or have explicit written permission to test. Unauthorised interception of network traffic is illegal in most jurisdictions.