# Handshakes

### Automatic Handshake Capture

Handshakes are part of normal WiFi traffic when a client joins or refreshes a network.

The WiFi Pineapple can automatically collect handshakes which are caught during a recon scan, with no extra effort.

Automatic handshake capture can be enabled in the Recon panel.

![Handshake collection card](https://3511988592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mhuhsyl_byoEWXOc5EU%2Fuploads%2FcBZfHvwQ5Uv7B0XhRZEe%2FScreenshot%20from%202022-05-03%2014-35-20.png?alt=media\&token=fb4f7a5a-8356-441e-a295-fb4f29f482d4)

### Direct Handshake Capture

A specific network may be targeted for handshake capture by selecting the network, then selecting "Capture Handshakes" from the menu:

![Capturing handshakes from a network](https://3511988592-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mhuhsyl_byoEWXOc5EU%2Fuploads%2F5EbZovWkF0nlJ7tWLc42%2FScreenshot%20from%202022-05-03%2011-11-11.png?alt=media\&token=88798df2-0cf5-4c14-8cec-ac795f2e4004)

Directed handshake capture parks the WiFi Pineapple on the same channel as the target device and waits for handshake packets.  Remaining on the target channel increases the chances of capturing a complete handshake.

Causing clients to reconnect by using the "Deauthenticate All Clients" option, or deauthenticating a specific client, can increase the chances of capturing a handshake.

### EvilWPA Handshakes

The EvilWPA access point clone is able to capture partial handshakes presented by a client, even when it is not possible to fully authenticate the client.

These half-handshakes can be leveraged by hashcat to attack the original passphrase.