| name | wireless-overview |
| description | Top-level index for the Decepticon 802.11 wireless attack suite. Routes the WirelessOperator to the correct leaf skill based on the target AP's crypto column (PSK / SAE / MGT / WPS) and engagement posture. BLE, Zigbee, Z-Wave, LoRaWAN, and sub-GHz live under iot/ by design — link provided below to prevent duplication.
|
| allowed-tools | Bash Read Write |
| metadata | {"subdomain":"wireless","when_to_use":"Wi-Fi, 802.11, WPA2, WPA3, EAP, enterprise, evil-twin, deauth, WPS, PSK, SAE, wireless attack, airspace, WLAN, rogue AP","tags":["wifi",802.11,"wpa2","wpa3","eap","evil-twin","deauth","wps"],"mitre_attack":"T1040, T1557, T1110.001"} |
802.11 Wireless Attack Suite — Operator Index
Load your wireless workflow (loaded into your system prompt) first on every iteration (hardware mode
check, phase progression, scope rules, KG node contract). This file
is the routing layer on top of it.
Playbook table
| Leaf skill | Crypto column / trigger | Primary MITRE | Status |
|---|
| wpa2-psk | WPA2 PSK, WPA PSK | T1040, T1110.001 | shipped |
| wpa3-sae | WPA3 SAE, WPA2 WPA3 transition mode | T1557, T1040 | shipped |
| wpa-enterprise-eap | MGT, WPA-Enterprise, 802.1X | T1557, T1110.001 | shipped |
| wps-pixie-dust | WPS column non-empty, WPS flag in wash | T1110.001, T1040 | shipped |
| evil-twin-karma | Open / PSK, PNL probe leakage, captive portal | T1557, T1556 | shipped |
| deauth-pmf | Any target needing client reconnect or 802.11w posture finding | T1498, T1040 | shipped |
| krack-fragattacks | Legacy / embedded supplicant, key-reinstallation / fragmentation test | T1557, T1040 | shipped |
BLE GATT, Zigbee Touchlink, Z-Wave, LoRaWAN, and sub-GHz attacks
are scoped to standard/iot/. Cross-reference that suite when the
objective targets non-802.11 RF.
Hardware mode pointer
Leaf skills inherit the mode check from the wireless workflow:
mode = plan/roe.json:machine_enforcement.wireless.mode
"in_sandbox" → USB passthrough, monitor mode inside Kali
"dropbox" → ssh <dropbox> -- '<cmd>' for every wireless op
"none" → refuse, return outcome=blocked
Crypto-mode decision tree
airodump-ng --write-interval 1 --output-format csv ...
Read the ENC/CIPHER/AUTH columns:
ENC=WPA2, AUTH=PSK → wpa2-psk
ENC=WPA3, AUTH=SAE → wpa3-sae
ENC=WPA2+WPA3, AUTH=SAE+PSK → wpa3-sae (transition-mode downgrade path)
AUTH=MGT / 802.1X → wpa-enterprise-eap
WPS column non-empty → wps-pixie-dust (run in parallel with PSK path)
Open / no credential needed → evil-twin-karma (KARMA/portal capture)
After selecting the primary leaf, always check:
- deauth-pmf: needed if Path B (four-way) is chosen OR as standalone PMF finding
- krack-fragattacks: applicable when target is legacy/embedded/poor-patch-cadence
KG node contract
All wireless leaf skills write the same node types (mirrors the wireless workflow):
| Node kind | Typical props |
|---|
Network | ssid, bssid, channel, crypto, pmf_state |
Host | mac, oui, last_seen_bssid |
Credential | secret_type, ssid, bssid, psk/eap_identity/eap_challenge |
Finding | title, cve_ids (if applicable), severity, remediation |
OPSEC posture cross-reference
| posture | techniques permitted |
|---|
stealth | PMKID (wpa2-psk Path A), passive PMF detect (deauth-pmf), Pixie-Dust only |
standard | + targeted deauth (1 frame), EAP capture, WPS Pixie-Dust |
loud | + broadcast deauth, evil-twin, KARMA, beacon flood, online WPS brute |
Evil-twin always requires explicit permitted_actions: evil_twin in
plan/roe.json regardless of posture — see the wireless workflow scope rules in your system prompt.
