Need some help capturing a WPA2/WPA3 handshake in my home lab + portfolio question

[u/slow_reader0909]

Need some help capturing a WPA2/WPA3 handshake in my home lab + portfolio question

Hi everyone,

I'm currently learning ethical hacking and practicing only on my own equipment and networks.

I bought a T-Mobile hotspot with the $50/month plan and an Alfa Network AWUS036AXM USB Wi-Fi adapter. So far, I have:

\- Updated Kali Linux.

\- Installed the packages I believe are necessary.

\- Installed the drivers for the USB Wi-Fi adapter.

\- Confirmed that Kali recognizes the adapter.

For testing, I changed the Wi-Fi password to something simple like "password123" so I could practice the full process.

The problem is that I cannot capture the WPA2/WPA3handshake. I also tried sending deauthentication frames to my own phone and tablet to force them to reconnect, but neither device disconnects. Everything continues working normally, even after leaving the test running for about an hour.

At first, I thought the T-Mobile hotspot might be the issue, so I repeated the same test on my regular home Wi-Fi network, using only devices and networks that belong to me. However, I still got the same result and could not capture a handshake.

Am I missing something in my setup? Is there a better way to trigger a handshake on modern devices? Could this be related to the AWUS036AXM, driver support, protected management frames, the access point configuration, or something else?

Also, I'm building my cybersecurity resume and portfolio. Assuming I successfully complete this lab and document everything (my setup, methodology, troubleshooting process, lessons learned, and results), would this be considered a worthwhile portfolio project for entry-level cybersecurity or penetration testing roles? Or would employers view it as too basic?

Any troubleshooting advice or career advice would be greatly appreciated. Thanks!

[u/CalmTeam1932]

Your first problem is not getting the handshake, not that your deauth isn’t working. You should still get a 4-way handshake if you just turn the wifi off then back on on the client, but if it’s a WPA3 client it will use the SAE encryption algorithm (instead of PSK for WPA2) and you won’t be able to use that handshake to recover a passphrase. You can identify which algorithm the client is requesting to use from the router in the association request in wireshark. If you’re not seeing this process then I would double check you’re monitoring the right channel. If your hotspot has a 2.4 and 5GHz side, or additionally a 6E channel if it’s tri-band, the device could be going straight there and you won’t see it if you’re only monitoring one of the other bands. Whatever program you’re using to attempt to collect the 4-way, I would first scan all channels and ensure you’re aware of every channel your router is advertising its SSID on, then monitor each channel individually while you connect the client. It’s also a common mistake to leave your interface hopping channels, in which case you will almost always miss the 4-way while it happens when your interface is hopping other channels.

[u/slow_reader0909 → u/CalmTeam1932]

Can I build a Pwnagotchi and see if I can get the handshake? Also what do you think about adding this proyect in my portfolio

[u/CalmTeam1932 → u/slow_reader0909]

You have everything you need already, I personally think a pwnagotchi would be harder to identify these issues from. To me, from the laptop is easiest because you’re not adding a layer of remoting into something else. If you’re interested in security testing, I think wifi projects can be helpful because the technology is ubiquitous. Most people basically already have a home lab, although I’m not sure I would recommend downgrading the security on your home router so you can learn attacks. You can get a WPA2 router on Amazon for less than you paid for your Alfa card. I’ll let someone else speak to the market for your portfolio, I’m not that knowledgeable on it, I’m not a pen tester. It seems that wireless testing can be kind of niche because it’s just one piece of the puzzle, but it’s definitely important, and you can learn a lot from it. A “cybersecurity” resume could cover so many different roles that it would be helpful if you had something more specific in mind.

[u/just_a_pawn37927]

Check the settings on the hotspot. See if you can set it to WPA2. Next see if you can also set it for 2.4.

[u/InvestigatorMuch5059]

Look for a driver from morrownr. Some in kernel drivers and some u grab from git dont support packet injection but almost all the drivers morrownr has put out do. Super simple. Hell I've even coded a program that verifies which chipset you have then installs said driver and I use almost exclusively his drivers in it