Ethical Hacking
Wireless Attacks
Wireless networks are unique in the attack surface they present — the signal extends beyond walls, beyond the building, sometimes beyond the car park. Anyone within range can attempt to interact with a wireless network without being physically inside the premises. This lesson covers how that exposure is exploited and how it is assessed in a pen test.
Why wireless security is harder than it looks
A wired network requires physical access to attack — you need to plug something in. A wireless network broadcasts its existence to anyone with a receiver. The SSID, the signal strength, the encryption type, and the authentication method are all visible to a laptop sitting in the car park outside your office. The network itself is the advertisement.
Most organisations deploy wireless correctly on the surface — WPA2 encryption, strong passwords, hidden SSIDs — and consider the job done. The problems surface in the gaps: guest networks that are not properly isolated from internal infrastructure, corporate devices that remember every network they have ever connected to and will auto-connect to anything broadcasting the right SSID, and WPA2 passwords that have never been changed since the network was installed five years ago and are sitting in a Post-it note on the IT manager's desk.
WPA2 — how it works and where it fails
WPA2-Personal — the version used in most homes and small businesses — uses a pre-shared key. Everyone who knows the Wi-Fi password can derive the encryption keys for the network. The handshake that occurs when a device connects to the access point — the four-way handshake — contains enough information to allow offline password cracking. An attacker who captures that handshake can take it away and test millions of password candidates against it without ever interacting with the network again.
WPA2-Enterprise — the version used in larger organisations — uses individual credentials per user, typically validated through a RADIUS authentication server. Each user has their own login. There is no single shared password that, if cracked, gives access to the entire network. WPA2-Enterprise significantly raises the bar but introduces its own complexity: misconfigured RADIUS servers, improperly validated certificates, and users who accept certificate warnings rather than reporting them are all failure modes.
WPA3 — the current standard — addresses several WPA2 weaknesses including the offline cracking problem. WPA3's Simultaneous Authentication of Equals handshake does not expose enough information for offline dictionary attacks. However, WPA3 adoption remains slow. The vast majority of real-world networks a pen tester encounters are still WPA2, and even WPA3 networks frequently support WPA2 in transition mode for backward compatibility — which means attackers can force clients to use the weaker protocol.
Capturing the WPA2 handshake
To capture a WPA2 handshake, a wireless adapter in monitor mode is needed — a mode that allows the card to capture all wireless frames rather than just those addressed to it. Not all wireless adapters support monitor mode. The Alfa AWUS036ACH is the standard choice for pen testing wireless networks because it supports monitor mode and packet injection reliably.
The scenario: You are assessing a client's office wireless network. The scope explicitly covers wireless security assessment. You want to capture the WPA2 four-way handshake so you can test whether the network password is in a common wordlist. This is authorised wireless pen testing — treat it identically to any other active engagement technique.
# Step 1 — identify the wireless interface name
# iwconfig lists all wireless interfaces and their current mode
iwconfig
# Step 2 — put the wireless adapter into monitor mode
# airmon-ng start enables monitor mode on the specified interface
# The interface is renamed — typically wlan0 becomes wlan0mon
# Kill any processes that might interfere with monitor mode
airmon-ng check kill
airmon-ng start wlan0
# Step 3 — scan for nearby wireless networks
# airodump-ng lists all visible access points with their BSSID, channel,
# signal strength, encryption type, and SSID
# -i specifies the monitor mode interface
airodump-ng wlan0mon
# Step 4 — target a specific network and capture its handshake
# --bssid the MAC address of the target access point
# --channel the Wi-Fi channel the AP is broadcasting on
# -w the filename prefix for the captured data files
# The capture runs until a four-way handshake is seen in the top-right corner
airodump-ng --bssid AA:BB:CC:DD:EE:FF \
--channel 6 \
-w /tmp/handshake_capture \
wlan0mon
# Step 5 — speed up handshake capture by deauthenticating a connected client
# This forces the client to reconnect and perform a new handshake immediately
# -0 send deauth frames 15 = number of deauth packets to send
# -a the access point BSSID -c the client MAC address to deauthenticate
# Run this in a second terminal while airodump-ng is still capturing
aireplay-ng -0 15 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0monBreaking it down:
The top-right corner of airodump-ng displays this message the moment a complete four-way handshake is captured. Once you see it, the capture file contains everything needed for offline cracking. At this point the active capture can be stopped — no further interaction with the wireless network is required. The cracking phase happens entirely on your local machine.
The 802.11 standard includes deauthentication frames that can be sent by the access point to disconnect a client. These frames have no authentication in WPA2 — any device can send them, claiming to be the access point. Sending forged deauth frames to a connected client forces a disconnect, and the client immediately reconnects — triggering the four-way handshake that airodump-ng captures. If you are willing to wait, a passive capture will catch the handshake the next time any client connects naturally.
PSK means Pre-Shared Key — this is WPA2-Personal. Every user knows the same password. Cracking the handshake reveals that one password and gives access to the entire network. If this were WPA2-Enterprise (showing EAP in the AUTH column), the attack would be more complex — no single shared password exists to crack. The AUTH column in airodump-ng output is one of the first things to check when assessing a target network.
Cracking the captured handshake with aircrack-ng
Once the handshake is captured, cracking is identical in principle to offline hash cracking from Lesson 21. The captured file contains the WPA2 handshake material. aircrack-ng hashes each password candidate from a wordlist and compares it against the captured handshake. A match means the password is found. Speed depends entirely on the machine's CPU — for faster cracking, hashcat can target WPA2 handshakes with GPU acceleration using mode 22000 after converting the capture file with the hcxtools suite.
# Crack the WPA2 handshake using aircrack-ng and a wordlist
# -w path to the wordlist file
# -b the BSSID of the target access point (helps if multiple networks were captured)
# The last argument is the capture file (.cap extension)
aircrack-ng -w /usr/share/wordlists/rockyou.txt \
-b AA:BB:CC:DD:EE:FF \
/tmp/handshake_capture-01.cap
# For faster GPU-accelerated cracking using hashcat:
# Step 1 — convert the .cap file to hashcat's format using hcxtools
hcxpcapngtool -o /tmp/handshake.hc22000 /tmp/handshake_capture-01.cap
# Step 2 — crack with hashcat using WPA2 mode (22000)
# -m 22000 WPA2/WPA3 hash mode
# -a 0 dictionary attack
hashcat -m 22000 -a 0 \
/tmp/handshake.hc22000 \
/usr/share/wordlists/rockyou.txtBreaking it down:
The password follows the classic enterprise password pattern — company name plus a year plus an exclamation mark. This style of password satisfies most complexity policies (uppercase, lowercase, number, symbol) while being completely predictable. Rockyou.txt does not contain it as a literal entry, but a wordlist built from the company name during the OSINT phase — combined with common year and symbol suffixes — would catch it in seconds. This is the moment where good pre-engagement recon pays off during the wireless phase.
aircrack-ng on CPU runs approximately 7,200 passwords per second for WPA2 — substantially slower than MD5 cracking because WPA2 uses PBKDF2 with 4,096 rounds of HMAC-SHA1, making each candidate compute-intensive by design. hashcat on an RTX 3070 GPU achieves approximately 400,000 WPA2 candidates per second — still far slower than MD5 but fast enough to exhaust a 14-million-entry wordlist in about 35 seconds.
Evil twin access points — attacking the client, not the network
Cracking WPA2 requires capturing a handshake and running a wordlist. An evil twin attack takes a completely different approach — instead of attacking the cryptography, it attacks the user's trust in the network name. The attacker creates a rogue access point broadcasting the same SSID as the legitimate network, sends deauthentication frames to push clients off the real network, and waits for them to connect to the fake one instead.
Once connected to the evil twin, the attacker can present a captive portal — a fake login page — asking the user to re-enter the Wi-Fi password to "verify their identity." Many users comply without suspicion, handing over the network password directly. The rogue AP can also perform a MITM attack against everything the victim transmits — all traffic flows through the attacker's machine before being forwarded to the real internet.
This attack is particularly effective in environments where employees regularly connect to guest Wi-Fi networks in hotel lobbies, airport lounges, and conference centres. Corporate devices that auto-connect to remembered SSIDs will silently join an evil twin broadcasting a familiar SSID — without the user doing anything at all.
Wireless vulnerabilities beyond WPA2 cracking
WPA2 handshake cracking and evil twin attacks get the most attention in wireless pen testing — but the full wireless assessment covers several additional areas that are frequently overlooked and consistently produce findings in real engagements.
Guest network isolation
Guest wireless networks should be completely isolated from corporate infrastructure — no access to internal servers, printers, or any other network resource. Failure to enforce this isolation is one of the most common wireless findings. A guest network that can reach internal IP ranges bypasses all the perimeter security that protects the corporate network from the internet. The test is simple: connect to the guest network and attempt to reach internal IP ranges with ping and nmap. Finding open internal services from a guest connection is a critical misconfiguration finding.
WPS PIN vulnerability
Wi-Fi Protected Setup uses an 8-digit PIN to simplify device registration. Due to a design flaw, the PIN is validated in two 4-digit halves independently — reducing the effective keyspace from 100 million to 11,000 combinations. The Reaver tool exploits this to brute-force the WPS PIN and recover the WPA2 password directly, bypassing the need to capture and crack a handshake. WPS should be disabled on any production access point. Many routers still ship with it enabled by default.
Rogue access points planted by employees
Employees who find the corporate wireless policy too restrictive sometimes plug personal routers or wireless access points into corporate ethernet ports — creating an unsanctioned wireless network that bypasses all wireless security controls. These rogue APs are typically unencrypted, not monitored, and provide direct access to the corporate wired network to anyone within range of the signal. Wireless intrusion detection systems monitor for APs broadcasting from within the corporate IP space and alert on any device not in the approved AP inventory.
PMKID attack — no client interaction needed
Discovered in 2018, the PMKID attack captures a single frame from the access point beacon — no connected client and no four-way handshake required. The PMKID value in the frame is derived from the pre-shared key and can be used for offline dictionary cracking in exactly the same way as a captured handshake. hcxdumptool captures PMKID frames and hcxtools converts them for hashcat. On networks with no currently connected clients where capturing a handshake would require waiting, the PMKID method is more practical.
Wireless security best practices
A thorough wireless pen test produces findings across multiple categories. The remediation recommendations need to be equally specific — not "improve wireless security" but specific configuration changes with measurable outcomes.
Teacher's Note: Wireless pen testing requires a dedicated wireless adapter that supports monitor mode and packet injection — the built-in adapter in most laptops does not. The Alfa AWUS036ACH and AWUS036NHA are the standard choices. Check that your adapter supports both before arriving at a client engagement — finding out it does not work in the car park is not ideal timing.
Quiz
Scenario:
Scenario:
Scenario:
Up Next · Lesson 34
Covering Tracks
Log clearing, artefact removal, and how attackers erase evidence of their presence — and what defenders watch for to catch them doing it.