pentest-wireless

name	pentest-wireless
description	Wireless penetration testing — 802.11, Bluetooth/BLE, Zigbee. Use when the user mentions Wi-Fi pentest, WPA/WPA2 crack, PMKID attack, WPA3 Dragonblood, WPS Pixie Dust / Reaver / Bully, Evil Twin, KARMA, MANA, hostapd-mana, eaphammer, captive portal, PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, 802.1X, aircrack-ng, hcxdumptool, hashcat WPA, BLE GATT, Sniffle, Ubertooth, BIAS, KNOB, Zigbee KillerBee, sub-GHz.

Pentest — Wireless

Apply 07-wireless/ from the pentest-templates library.

Library root

$PENTEST_LIBRARY — caminho absoluto deste repositório clonado (definido pelo instalador; veja INSTALL.md).

Read 07-wireless/00-overview.md first.

Phase order

1. 07-wireless/01-recon-monitoring.md — adapter setup, AP/client inventory, PNL profiling.
2. 07-wireless/02-wpa-wpa2-attacks.md — handshake capture, PMKID, hashcat crack.
3. 07-wireless/03-wpa3-attacks.md — Dragonblood, transition-mode downgrade.
4. 07-wireless/04-wps-attacks.md — Pixie Dust, online PIN brute.
5. 07-wireless/05-evil-twin-rogue-ap.md — KARMA, MANA, captive portal.
6. 07-wireless/06-enterprise-eap.md — PEAP-MSCHAPv2 inner-auth capture.
7. 07-wireless/07-bluetooth-zigbee.md — BLE GATT, pairing abuse, Zigbee key sniff.

How to operate

1. Adapter check: monitor mode + injection on 2.4 / 5 / 6 GHz before any capture (01-recon-monitoring.md).
2. WPA/WPA2 capture path is hcxdumptool → hashcat (PMKID, then 4-way handshake fallback).
3. Enterprise: capture PEAP-MSCHAPv2 inner-auth via Evil Twin with hostapd-mana / eaphammer; submit MSCHAPv2 to crack.sh for guaranteed ≤24h crack when in scope.
4. BLE/Zigbee at consumer-Wi-Fi engagement level: pair sniffing (Sniffle) + GATT enumeration. For sub-GHz / LoRa / Z-Wave / NFC use pentest-iot-ot/03-radio-rf.md.

When NOT to use

• Cellular / 4G / 5G (regulated tooling, out of typical scope).
• IoT-device-RF specifically → pentest-iot-ot.

Pre-conditions

• Wi-Fi adapter with monitor + injection (Alfa AWUS036ACS/ACH/ACM, AR9271, MT76).
• 5/6 GHz capability for current-gen testing.
• BLE / Zigbee / SDR hardware as needed.
• ROE permission for active deauth and Evil Twin.

OPSEC

• Wireless engagements physically bounded; SOC visibility limited but environmental disruption possible.
• Deauth in regulated environments (hospital, ICS) — confirm acceptable.
• Evil Twin can capture credentials of unintended bystanders — scope tightly.
• Verify radio-TX legality in jurisdiction.

References inside the library

• Tooling: tools/install-wireless.md, tool-mappings/07-wireless-tools.md.
• Frameworks: frameworks/osstmm.md (SPECSEC channel).