Wireless Hacking: Wi-Fi Security Testing Guide

Wi-Fi networks broadcast radio signals that can be intercepted by anyone within range. Understanding wireless security protocols is essential for testing and securing these networks. The main protocols are WEP (obsolete and broken), WPA (improved but deprecated), WPA2 (current standard), and WPA3 (newest standard).

WEP (Wired Equivalent Privacy) was the original Wi-Fi security protocol. It uses RC4 encryption with a static key, and its implementation has fundamental flaws that allow the key to be recovered by capturing enough packets — typically within minutes.

WPA2 uses AES encryption and the CCMP protocol, providing significantly stronger security than WEP. However, WPA2-Personal (PSK mode) is vulnerable to offline dictionary attacks if the network handshake is captured and the password is weak.

WPA3 introduces Simultaneous Authentication of Equals (SAE), which replaces the vulnerable PSK handshake. SAE provides forward secrecy and resistance to offline dictionary attacks, making it significantly more secure than WPA2 for personal networks.

Enable monitor mode on your wireless adapter: 'airmon-ng start wlan0'. Monitor mode allows your adapter to capture all wireless frames in range, not just those addressed to your device. Not all adapters support monitor mode — check compatibility before purchasing.

Discover nearby networks using 'airodump-ng wlan0mon'. This displays all accessible networks with their BSSID (MAC address), channel, encryption type, signal strength, and connected clients. Identify your authorized target and note its details.

Focus on the target network: 'airodump-ng -c channel --bssid target_bssid -w capture wlan0mon'. This captures traffic only from the target network and saves it to a file. Connected clients are listed, showing their MAC addresses and data traffic.

Wireless site surveys map the physical coverage area of target networks. Understanding signal strength, interference patterns, and physical boundaries helps plan where attacks might be launched from and identifies rogue access points.

WPA2 cracking requires capturing the four-way handshake that occurs when a client connects to the network. Force a reconnection by sending deauthentication frames: 'aireplay-ng -0 5 -a target_bssid -c client_mac wlan0mon'. The client will reconnect, and airodump captures the handshake.

Crack the captured handshake with a wordlist: 'aircrack-ng -w rockyou.txt capture.cap'. The speed depends on your hardware and wordlist size. GPU-accelerated cracking with Hashcat is dramatically faster for WPA2 handshakes (PMKID or EAPOL).

Evil twin attacks create a rogue access point that mimics a legitimate network. Victims unknowingly connect to the attacker's access point, which can serve captive portals to capture credentials, intercept traffic, or deliver malware.

Wifite2 automates many wireless attacks: 'wifite --kill' scans for networks, captures handshakes, and attempts cracking automatically. It supports WEP, WPA, and WPS attacks with minimal manual intervention.

Use WPA3 or WPA2 with a strong passphrase (minimum 20 characters with mixed character types). Avoid common words, dictionary terms, and any information associated with the organization. A random passphrase generator is ideal.

Disable WPS (Wi-Fi Protected Setup) as it is vulnerable to brute-force attacks against its 8-digit PIN. Even with rate limiting, WPS can be cracked within hours. Most routers enable WPS by default, so verify it is disabled.

Implement 802.1X authentication (WPA2/WPA3-Enterprise) with a RADIUS server for corporate networks. This provides individual user authentication with unique credentials, eliminating the shared-password vulnerability of personal mode.

Use wireless intrusion detection systems (WIDS) to detect rogue access points, deauthentication attacks, and evil twin access points. Regularly audit your wireless environment with tools like Kismet to ensure only authorized access points are operational.