Skill: WiFi Penetration Testing

Supplementary Files:

• payloads.md — WiFi attack commands and payloads categorized by Monitor mode, reconnaissance, handshake capture, WEP/WPA cracking, Evil Twin, WPS attacks, deauthentication, PMKID, and Enterprise
• test-cases.md — Structured test case list (10 scenarios with severity levels, attack categories, and statistics)

Summary

Wifi Pentest skill domain covering network attack operations.

Tools: aircrack-ng, airodump-ng, aireplay-ng, airbase-ng, wifite, reaver, wash, hashcat (+6 more)

Domain: network-attack

MITRE ATT&CK: TA0046-Initial Access

Description

WiFi security assessment skills: covering wireless network reconnaissance, WPA/WPA2 handshake capture and offline cracking, WPS PIN brute forcing, Evil Twin attacks, wireless sniffing, and deauthentication attacks. Built on the aircrack-ng toolchain and practical experience, suitable for authorized penetration testing and security audit scenarios.

Core Principle: The WPA2-PSK 4-Way Handshake contains encrypted pre-shared key information that can be brute-forced offline; the WPS 8-digit PIN has only 11,000 valid combinations, which can be exhaustively searched within hours.

Use Cases

1. Enterprise WiFi Security Audit - Assess organizational wireless network encryption strength and configuration vulnerabilities (WPS enabled, weak passwords, default credentials)
2. Red Team Wireless Penetration - Gain network access through Evil Twin or WPS attacks as an entry point for internal network penetration
3. Router Security Hardening Assessment - Test home/enterprise router wireless security configurations, verify WPA3 compatibility and WPS disabled status
4. CTF Wireless Challenges - WiFi cracking challenges in competition environments (handshake analysis, hidden SSID discovery, client tracking)
5. Wireless Intrusion Detection Validation - Simulate deauthentication attacks and Rogue AP deployment to test WIDS/WIPS detection capabilities

Core Tools

Tool	Purpose	Command Example
aircrack-ng	WPA/WPA2/WEP password cracking	aircrack-ng -w rockyou.txt handshake-01.cap
airodump-ng	Wireless network scanning and handshake capture	airodump-ng wlan0mon --channel 6 --bssid TARGET --write cap
aireplay-ng	Deauthentication packet injection, ARP replay	aireplay-ng -0 5 -a BSSID wlan0mon
airbase-ng	Create fake AP (Evil Twin)	airbase-ng -e "Corp_WiFi" -c 6 wlan0mon
wifite	Automated WiFi attack framework	wifite --kill --dict rockyou.txt
reaver	WPS PIN brute forcing	reaver -i wlan0mon -b BSSID -vv -K
wash	WPS status scanning	wash -i wlan0mon
hashcat	GPU-accelerated password cracking	hashcat -m 22000 hash.hc22000 rockyou.txt
hcxpcapngtool	Handshake format conversion (cap -> hc22000)	hcxpcapngtool -o out.hc22000 handshake.cap
kismet	Wireless intrusion detection and passive reconnaissance	kismet -c wlan0mon
bettercap	Man-in-the-middle attacks and network sniffing	bettercap -iface wlan0mon
hostapd-wpe	Rogue AP targeting WPA2-Enterprise	hostapd-wpe hostapd.conf

Methodology

Attack Chain

1. Interface Setup     -> Enable Monitor mode (airmon-ng / iw)
2. Network Discovery   -> Passive scanning (airodump-ng / kismet)
3. Target Selection    -> Evaluate signal strength, encryption type, WPS status, client count
4. Capture Handshake   -> Passive waiting or active deauthentication (aireplay-ng -0)
5. Offline Crack       -> Dictionary/mask attack (aircrack-ng / hashcat)
   +-- WPS Attack      -> Pixie Dust or PIN brute force (reaver)
   +-- Evil Twin       -> Rogue AP + credential phishing (airbase-ng / hostapd-wpe)

Key Decision Points:

• WPS Open -> Prioritize reaver attack (10 minutes - 10 hours)
• Strong Signal + Online Clients -> Deauthentication + handshake capture (5-15 minutes)
• WPA2-Enterprise -> Evil Twin + hostapd-wpe credential interception
• Expected Weak Password -> aircrack-ng dictionary attack; complex password -> hashcat GPU acceleration

Defense Perspective

Attack Vector	Defense Measure
WPA2-PSK Dictionary Cracking	Upgrade to WPA3 (SAE replaces PSK), use complex passwords >12 characters
WPS PIN Brute Forcing	Disable WPS functionality (turn off in router admin interface)
Deauthentication Attacks	Enable 802.11w (Management Frame Protection)
Evil Twin	Deploy WIDS (kismet), 802.1X enterprise authentication, certificate binding
Wireless Sniffing	Use VLAN isolation, VPN over WiFi, TLS encryption for all traffic
Default Credentials	Change router default passwords and SSIDs, regularly update firmware

Security Configuration Priority: WPA3 > WPA2-AES (disable TKIP) > Disable WPS > Strong Password > 802.11w > MAC Filtering (supplementary)

Practical Steps

Detailed payloads in payloads.md, complete test checklist in test-cases.md.

Quick Reference

1. Monitor Mode — airmon-ng start wlan0 or iw dev wlan0 set type monitor
2. Network Reconnaissance — airodump-ng wlan0mon --band abg
3. Handshake Capture — airodump-ng wlan0mon -c 6 --bssid TARGET --write cap + aireplay-ng -0 5 -a BSSID wlan0mon
4. Password Cracking — aircrack-ng -w dict.txt cap-01.cap or hashcat -m 22000 hash.hc22000 dict.txt
5. WPS Attack — reaver -i wlan0mon -b BSSID -vv -K
6. Automation — wifite --kill --dict rockyou.txt

Defense Evasion Techniques

WiFi Attack Stealth

• Directional antennas: Limit RF footprint to target only; reduces detection range.
• Brief operation: <30 second operations (e.g., PMKID capture); below detection threshold.
• Mimic legitimate AP: Use same SSID, BSSID, channel as legitimate AP; evil twin stealth.

WPA3 Stealth

• Dragonfly attack: Abuse SAE handshake; newer WPA3 attacks less detected.
• OWE (Opportunistic Wireless Encryption): Some deployments don't monitor OWE transitions.
• Mesh abuse: 802.11s mesh networks; less monitoring than infrastructure mode.

Common Pitfalls

• Forgetting to kill interfering processes before monitor mode: NetworkManager, wpa_supplicant, and avahi-daemon will conflict with monitor mode and cause channel hopping or interface resets. Always run airmon-ng check kill before enabling monitor mode.
• Ignoring channel width and band selection: Modern APs may operate on 5GHz or 6GHz bands with 40/80/160MHz channel widths. Specifying only 2.4GHz with --band b will miss half the targets. Use --band abg for comprehensive discovery.
• Weak dictionary selection for cracking: Using a generic wordlist like rockyou.txt against a corporate WiFi with a strong password policy wastes time. Generate targeted dictionaries using cewl on the organization's website and combine with rule mutations.

Automation and Scripting

Automate WiFi assessments with wifite for one-command full attack chains, or build custom scripts using the aircrack-ng toolchain for granular control. Use Python with scapy to craft custom 802.11 frames for targeted deauthentication or probe testing. Schedule automated scans during business hours when employees are connected (higher chance of capturing handshakes) using cron jobs that run airodump-ng in background capture mode and alert on successful handshake captures.

Reporting and Documentation

WiFi penetration test reports should include a wireless environment map showing all discovered access points with their BSSID, channel, encryption type, signal strength, and associated client count. Document the full attack path for each exploited target: capture method (passive/deauth), handshake quality, cracking time, and recovered password. Include specific remediation recommendations ranked by priority (disable WPS, upgrade to WPA3, strengthen password, enable 802.11w). Attach raw capture files as evidence and note any WIDS/WIPS detection during testing.

Legal and Ethical Considerations

WiFi testing is particularly sensitive because radio signals do not respect network boundaries — you may inadvertently capture traffic from neighboring networks outside your authorized scope. Use directional antennas to focus on target networks, set specific BSSID filters in airodump-ng to avoid capturing non-target traffic, and never attempt to crack networks not explicitly listed in the engagement letter. Deauthentication attacks disrupt legitimate users and should only be performed during agreed-upon testing windows. In many jurisdictions, even passive monitoring of WiFi traffic without authorization violates wiretapping laws.

Integration with Other Tools

WiFi penetration testing naturally leads into network-level assessment once access is obtained. After cracking a WPA2-PSK password, connect to the target network and immediately run network-pentest reconnaissance (nmap, arp-scan) to map the internal infrastructure. Use bettercap for MITM attacks on the wireless LAN to capture additional credentials. WiFi findings also inform physical security assessments — an AP with a strong signal detectable from the parking lot indicates insufficient physical containment of wireless signals.

Case Studies and Examples

• Corporate WPS attack: During an enterprise assessment, wash revealed WPS was enabled on a legacy AP despite the IT team claiming it was disabled. Reaver cracked the 8-digit PIN in 4 hours, providing the WPA2 passphrase without capturing a single handshake. The root cause was a firmware update that had reset WPS to its default enabled state.
• Evil Twin credential phishing: Deployed a rogue AP with the same SSID as the corporate network in the lobby area. Within 30 minutes, three employees had connected and submitted their domain credentials to the captive portal, which were validated against the real authentication server in real-time.
• PMKID attack on clientless AP: The target AP had no connected clients, making deauthentication-based handshake capture impossible. Using hcxdumptool, a PMKID was extracted from the AP's first response frame, enabling offline cracking without requiring any client to be present.

Detection Methods

Enterprise wireless intrusion detection systems (WIDS) like Kismet and commercial sensors detect attacks through several signatures: deauthentication floods trigger alerts when the rate of deauth frames exceeds a threshold, rogue AP detection identifies unauthorized BSSIDs broadcasting trusted SSIDs, and PMKID request anomalies flag active attacks against the AP. Defenders should monitor for unusual channel usage, unexpected probe requests, and MAC address spoofing patterns. Testers should assess WIDS coverage as part of the engagement.

Advanced Techniques

Beyond basic WPA2 cracking, advanced WiFi testing includes: PMKID attacks (using hcxdumptool/hcxtools) that require no connected clients and no deauthentication, enterprise 802.1X credential harvesting via hostapd-wpe rogue APs, VLAN hopping through wireless bridges, KRACK attacks against WPA2 key installation, and side-channel attacks leveraging frame timing analysis to infer encrypted traffic patterns. For WPA3, explore Dragonblood vulnerabilities (Dragonfly key exchange downgrade and timing side-channels) where applicable.

Tool Comparison Matrix

Tool	Best For	Speed	Coverage	Skill Level
wifite	Automated full attack chain	Fast	Broad (automated)	Beginner
aircrack-ng suite	Granular manual attacks	Variable	Complete	Intermediate
hashcat	GPU-accelerated cracking	Very fast	Broad (300+ modes)	Intermediate
reaver/bully	WPS PIN brute force	Slow	Narrow (WPS only)	Beginner
kismet	Passive reconnaissance	Passive	Very broad	Intermediate
hostapd-wpe	Enterprise credential theft	N/A	Narrow (Enterprise)	Advanced

Performance and Remediation

WiFi cracking performance depends heavily on hardware and approach. GPU cracking with hashcat can test billions of candidates per second against WPA2 handshakes, making even moderately strong passwords vulnerable. Use hcxpcapngtool to clean and convert capture files for optimal hashcat performance. For handshake capture, positioning matters more than patience — a strong signal (PWR > -50) produces clean captures; weak signals produce corrupt handshakes that fail cracking regardless of dictionary quality. Prioritize WiFi remediation by impact: immediately disable WPS on all access points, upgrade to WPA3-SAE where hardware supports it, enforce minimum 12-character passwords for WPA2-PSK networks, enable 802.11w Management Frame Protection, and deploy 802.1X enterprise authentication for corporate networks.

Hacker Laws

Law	WiFi Scenario Application
Minimize Attack Surface	Disable WPS, hide SSID (supplementary), turn off remote management to reduce attackable entry points
First Principles	Understand 802.11 frame structure and 4-Way Handshake key derivation (PMK -> PTK -> MIC), design attack strategies from the protocol level
Obscurity Is Not Security	Hidden SSIDs and MAC filtering cannot replace strong encryption; SSIDs can still be captured in Beacon/Probe frames
Trust but Verify	Practically test claims of "WPA3 configured"; scan to confirm WPS is truly disabled; use actual cracking to verify password strength

Learning Resources

Workspace Internal Resources

• Course Outline: memory/wifi-cracking-course.md — 7-stage complete course (WiFi Fundamentals -> Information Gathering -> WPA2 Cracking -> WEP -> WPS -> Enterprise -> Defense Hardening)
• Practice Log: chronicle/2026-03/2026-03-27-wifi-cracking.md — 2026-03-27 WiFi cracking practice (3 targets scanned, 2 handshakes successfully captured, workspace organized)

External Recommendations

• Books: "Kali Linux Wireless Penetration Testing", "Hacking Exposed Wireless"
• Online Courses: Udemy WiFi Hacking & Penetration Testing, Pentester Academy Wireless LAN Security
• Lab Environments: WiFi Pineapple (dedicated hardware), airbase-ng (virtual AP), own router (legal target)
• Tool Documentation: aircrack-ng.org, hashcat.net

Legal Disclaimer: Only conduct testing on networks you own or have explicit authorization to test. Unauthorized WiFi cracking is illegal (under China's Cybersecurity Law, penalties can include up to 7 years imprisonment).

---

This skill's supplementary files: payloads.md, test-cases.md Related skills: skills/network-pentest/SKILL.md, skills/post-exploitation/SKILL.md External resources: aircrack-ng.org, hashcat.net