Offensive methodology
Wi-Fi attacks
The weaknesses of wireless networks, from WEP to WPA3 and Enterprise. Test on your own hardware or an explicitly authorised scope: eavesdropping on or attacking a third-party network is illegal.
Scope
LegalCapturing Wi-Fi traffic or disconnecting clients is only allowed on your own network or under a written engagement. Anything else is unlawful interference with a computer system.
Basics
- An adapter that supports monitor mode and injection is required.
- Wi-Fi works by channels (2.4 and 5 GHz); you listen to one channel at a time.
- The WPA handshake is exchanged when a client connects: that is what you try to capture.
Protocols and their weaknesses
| Protocol | Weakness |
|---|---|
| WEP | Broken encryption: the key is recovered from enough captured traffic. Consider it worthless. |
| WPS | The 8-digit PIN can be brute-forced; some routers have a known default PIN. |
| WPA/WPA2-PSK | Capture the handshake then try the password offline: password strength is everything. |
| WPA3-SAE | Far more robust; known attacks target implementations or the WPA2 transition mode. |
| WPA-Enterprise | RADIUS-server authentication; a rogue access point can trap poorly protected credentials. |
Client-side attacks
- Evil twin: a rogue access point with the same name to lure clients.
- Captive portal: a fake login page to capture a password.
- Deauthentication: force a client to reconnect in order to capture the handshake.
Offline cracking
Once the handshake is captured, the password is tried offline with aircrack-ng or hashcat, from a wordlist (rockyou) and rules. A long, random password makes the attack unrealistic: that is the only real defence on the PSK side.
Defensive side
- WPA2/WPA3 with a long, unique password, WPS disabled.
- In a company: WPA-Enterprise with server certificate validation on the client side.
- Monitor for rogue access points and deauthentication frames (wireless intrusion detection system).