WiFi Fundamentals and Attacks

WiFi (802.11) is a network that travels through the air, so anyone within range can listen to it, interfere with it, or try to join. WiFi pentesting combines understanding the protocol (channels, frames, encryption modes) with the right hardware (a card supporting monitor mode and injection) to capture handshakes, crack keys, spoof access points, and attack clients. This card is the base; specific attacks have their own card.

Essential concepts

SSID        network name              BSSID   access point (AP) MAC
ESSID       network name (= SSID)     channel   frequency (2.4GHz: 1-14; 5GHz)
STA         client (station)          AP      access point
beacon      frame announcing the network   probe   client looking for known networks
# encryption (worst to best)
Open        no encryption      WEP     broken (crackable in minutes)
WPA/WPA2    PSK (handshake) or Enterprise (802.1X)   WPA3   SAE (more robust)

Hardware: the prerequisite

# you need a WiFi card that supports:
- monitor mode (capture all air traffic, not just yours)
- packet injection (send frames: deauth, etc.)
# typical chipsets: Atheros AR9271, Realtek RTL8812AU, Ralink/MediaTek
iw dev ; airmon-ng                     # see interfaces
airmon-ng start wlan0                   # enable monitor mode -> wlan0mon

Without monitor mode + injection, most WiFi attacks aren’t possible.

Reconnaissance (discover networks and clients)

# scan networks and clients (airodump suite)
airodump-ng wlan0mon                    # all networks: BSSID, channel, encryption, clients
airodump-ng -c <channel> --bssid <AP> -w capture wlan0mon   # focus one AP
# alternatives
kismet                                  # passive detection and mapping
wash -i wlan0mon                        # APs with WPS (see wifi-wps)

From this you get: which networks exist, their encryption, which clients are connected, and which channel to target.

Attack landscape (each has its card)

WEP               trivial cracking (historical) -> aircrack-ng with enough IVs
WPA/WPA2-PSK      capture handshake + crack offline (see wifi-wpa)
WPA3 / PMKID      PMKID attack (clientless), downgrade (see wifi-wpa)
WPS               PIN bruteforce / Pixie Dust (see wifi-wps)
Evil Twin         fake AP + captive portal / deauth (see wifi-eviltwin)
Deauth            disconnect clients (DoS / force reconnection and handshake)
Enterprise        steal 802.1X credentials (evil twin RADIUS)

Deauthentication (the cross-cutting tool)

Deauthentication frames (in WPA2) aren’t protected, so you can disconnect clients at will:

aireplay-ng --deauth 5 -a <BSSID> -c <client> wlan0mon
# uses: DoS, or force a client to reconnect -> capture the handshake (wifi-wpa)
# also forces clients toward an evil twin (wifi-eviltwin)

WPA3 and 802.11w (Management Frame Protection) protect these frames, mitigating deauth.

For the defense

WPA3 (or at least WPA2 with a strong, long password — offline cracking depends on strength).
Disable WPS (vulnerable, see WPS Attacks) and WEP (broken).
802.11w (PMF) to protect management frames (mitigates deauth and evil twin).
WPA2/WPA3-Enterprise (802.1X) with certificates instead of a shared PSK; validate the server certificate on clients (against evil twin RADIUS).
Segment guest WiFi; monitor unauthorized APs (rogue AP detection); hiding the SSID isn’t real defense.

Testing checklist

Card with monitor mode + injection (airmon-ng)
Recon of networks and clients (airodump-ng/kismet)
Identify each network’s encryption (Open/WEP/WPA2/WPA3)
APs with WPS (wash)
Deauth for DoS or to force a handshake
WPA/WPA2-PSK: handshake + crack (WPA/WPA2/WPA3 Attacks)
WPS: PIN/Pixie Dust (WPS Attacks)
Evil twin / captive portal (Evil Twin and Captive Portals)