Also known as a three-way handshake, this requires the two hosts to be synchronized with each other's initial sequence number (ISN) for a connection to be established, before data transfer begins. The need for us to obtain a TCP handshake is because the hash (a hash is a string or number generated from a string of plain text) is stored within the SYN/ACK packet:
![](https://static.packt-cdn.com/products/9781786466273/graphics/assets/image_03_011.jpg)
- You can use the following command to send a deauthentication to the AP: aireplay-ng --deauth 10 -a 02:13:37:A5:99:E3 -c 10:03:cd:04:06:fe wlan0mon:
- --deauth 10 means sending 10 packets to deauthenticate that device
- -a is the target device (your Wi-Fi router)
- -c is the connected station (connected device on the network):
![](https://static.packt-cdn.com/products/9781786466273/graphics/assets/image_03_012.jpg)
- You're doing this to recapture the TCP handshake, which will be saved in your CrackWPA file:
![](https://static.packt-cdn.com/products/9781786466273/graphics/assets/image_03_013.jpg)
- Now clean it of any unneeded data, and convert it to run with hashcat:
![](https://static.packt-cdn.com/products/9781786466273/graphics/assets/image_03_014.jpg)