--- name: conducting-wireless-network-penetration-test-ac900a80889c description: > Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection. domain: cybersecurity subdomain: penetration-testing tags: [wireless-pentest, WiFi-security, WPA2, WPA3, evil-twin] version: 1.0.0 author: mahipal license: Apache-2.0 --- # Conducting Wireless Network Penetration Test ## When to Use - Assessing the security of enterprise wireless networks including guest, corporate, and IoT WiFi segments - Testing whether attackers within physical proximity can compromise wireless authentication and access internal networks - Validating wireless intrusion detection/prevention system (WIDS/WIPS) capabilities against known attack techniques - Evaluating the effectiveness of WPA3 migration and transition mode configurations - Testing network segmentation between wireless and wired networks after a wireless network compromise **Do not use** against wireless networks without written authorization from the network owner, for jamming or denial-of-service attacks against wireless infrastructure unless explicitly authorized, or in environments where wireless disruption could affect life-safety systems. ## Prerequisites - Written authorization specifying target SSIDs, BSSIDs, and physical testing locations - External WiFi adapter supporting monitor mode and packet injection (Alfa AWUS036ACH, TP-Link TL-WN722N v1) - Kali Linux or equivalent with up-to-date wireless tools (aircrack-ng suite, hostapd, bettercap) - Physical access to the testing location during authorized testing hours - Knowledge of the target's wireless architecture (SSIDs, authentication types, RADIUS infrastructure) ## Workflow ### Step 1: Wireless Reconnaissance Discover and map all wireless networks in the target environment: - Enable monitor mode: `airmon-ng start wlan0` - Capture wireless traffic: `airodump-ng wlan0mon -w recon --output-format csv,pcap` to discover all SSIDs, BSSIDs, channels, encryption types, and connected clients - Identify target networks from the authorized scope and note their security configurations (WEP, WPA2-Personal, WPA2-Enterprise, WPA3-SAE, WPA3-Transition) - Enumerate connected clients and their signal strengths to understand client distribution - Check for hidden SSIDs by capturing probe requests from clients: `airodump-ng wlan0mon --essid-regex ".*" -c ` - Identify rogue access points by comparing discovered BSSIDs against the client's authorized AP inventory ### Step 2: WPA2-Personal Handshake Capture and Cracking For WPA2-PSK networks, capture the 4-way handshake and attempt offline cracking: - Target the specific AP: `airodump-ng wlan0mon -c --bssid -w capture` - Deauthenticate a connected client to force re-authentication: `aireplay-ng -0 5 -a -c wlan0mon` - Verify handshake capture in airodump-ng (WPA handshake indicator appears) - Crack the captured handshake: - Dictionary attack: `aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap` - GPU-accelerated: `hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt` - Rule-based: `hashcat -m 22000 capture.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule` - For PMKID capture (clientless): `hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng --filtermode=2 --filterlist_ap=` ### Step 3: WPA2-Enterprise Attack For 802.1X/EAP networks, attempt credential capture through rogue RADIUS: - Identify the EAP type in use (PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS) by capturing association requests - Set up a rogue AP mimicking the enterprise SSID using `hostapd-mana` with a rogue RADIUS server - Configure hostapd-mana to accept all EAP authentication attempts and capture RADIUS handshakes - When clients connect to the rogue AP, capture MSCHAPv2 challenge-response pairs - Crack captured credentials with `asleap` or convert to hashcat format: `hashcat -m 5500 captured_ntlm.txt wordlist.txt` - If EAP-TLS is in use (certificate-based), document that credential capture is not feasible and the organization has implemented strong wireless authentication ### Step 4: Evil Twin Attack Deploy a rogue access point to intercept client connections: - Create an evil twin AP matching the target SSID: configure `hostapd` with the same SSID and channel - Set up a captive portal using `dnsmasq` for DHCP and DNS, and a web server presenting a fake login page - Deauthenticate clients from the legitimate AP to force reconnection to the evil twin - Capture credentials submitted through the captive portal - For WPA3-Transition mode networks: exploit the downgrade vulnerability by creating a WPA2-only evil twin that transition-mode clients will connect to - Document all captured credentials and the attack path from wireless access to internal network ### Step 5: Post-Compromise Network Assessment After gaining wireless network access, assess network segmentation: - Connect to the compromised wireless network using captured credentials - Scan the network segment for accessible hosts and services: `nmap -sn ` - Test if wireless clients can reach internal servers, databases, or management interfaces - Verify that VLAN segmentation properly isolates guest, corporate, and IoT wireless networks - Test if wireless-to-wired segmentation is enforced by attempting to access servers on the wired network - Document all accessible resources from the wireless network to demonstrate segmentation failures ## Key Concepts | Term | Definition | |------|------------| | **Evil Twin** | A rogue access point that mimics a legitimate SSID to trick clients into connecting, enabling man-in-the-middle attacks and credential capture | | **4-Way Handshake** | The WPA2 authentication exchange between client and AP that establishes encryption keys; captured handshakes can be cracked offline | | **WPA3-SAE** | Simultaneous Authentication of Equals; WPA3's key exchange protocol that resists offline dictionary attacks and provides forward secrecy | | **Transition Mode** | WPA3 backward compatibility mode that supports both WPA2 and WPA3 clients, potentially vulnerable to downgrade attacks | | **PMKID Attack** | A clientless attack that captures the Pairwise Master Key Identifier from the AP's first EAPOL frame, allowing offline cracking without capturing a full handshake | | **802.1X/EAP** | Enterprise wireless authentication using RADIUS and Extensible Authentication Protocol, providing per-user credentials instead of a shared pre-shared key | | **Deauthentication Attack** | Sending spoofed deauthentication frames to disconnect clients from an AP, forcing them to reconnect and enabling handshake capture or evil twin attacks | ## Tools & Systems - **Aircrack-ng Suite**: Comprehensive wireless auditing toolkit including airodump-ng (capture), aireplay-ng (injection), and aircrack-ng (cracking) - **Hostapd-mana**: Modified hostapd for creating rogue access points with EAP credential capture capability - **Bettercap**: Network attack framework with WiFi modules for deauthentication, handshake capture, and evil twin deployment - **Hashcat**: GPU-accelerated password cracking supporting WPA2 (mode 22000), MSCHAPv2 (mode 5500), and PMKID formats - **Kismet**: Wireless network detector, sniffer, and intrusion detection system for passive monitoring ## Common Scenarios ### Scenario: Wireless Security Assessment for a Corporate Office **Context**: A financial services company has 3 SSIDs: CorpWiFi (WPA2-Enterprise for employees), GuestWiFi (captive portal), and IoT-Net (WPA2-PSK for printers and conferencing systems). The tester is authorized to test all three networks from the lobby and conference rooms. **Approach**: 1. Wireless reconnaissance identifies all 3 SSIDs across 12 access points with 87 connected clients 2. IoT-Net WPA2-PSK handshake captured and cracked in 3 minutes (password: Company2024!) 3. From IoT-Net, scan reveals the subnet can reach internal servers including the print server and file shares, demonstrating inadequate segmentation 4. Evil twin attack against CorpWiFi captures 4 employee MSCHAPv2 hashes via hostapd-mana; 2 are cracked revealing passwords 5. GuestWiFi captive portal bypass achieved using MAC address spoofing of an already-authenticated device 6. Document that IoT-Net provides a direct path to the internal network bypassing WPA2-Enterprise authentication **Pitfalls**: - Conducting deauthentication attacks during business hours without coordinating with the client, causing visible WiFi disruptions - Not testing WPA3 transition mode for downgrade vulnerabilities when the organization has begun WPA3 migration - Focusing only on password cracking and missing network segmentation issues that are often the higher-risk finding - Testing from a single location and missing rogue APs deployed in other areas of the facility ## Output Format ``` ## Finding: Weak WPA2-PSK on IoT Network with Inadequate Segmentation **ID**: WIFI-001 **Severity**: Critical (CVSS 9.4) **Affected SSID**: IoT-Net (BSSID: AA:BB:CC:DD:EE:FF) **Encryption**: WPA2-Personal (PSK) **Description**: The IoT wireless network uses a weak pre-shared key that was cracked in 3 minutes using a standard dictionary attack. Once connected to IoT-Net, the tester discovered that the wireless VLAN is not properly segmented from the internal corporate network, providing unrestricted access to file servers, the Active Directory domain controller, and the internal database server. **Proof of Concept**: 1. Captured WPA2 handshake: airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w iot 2. Cracked PSK in 3 minutes: aircrack-ng -w rockyou.txt iot-01.cap -> Key: Company2024! 3. Connected to IoT-Net and scanned: nmap -sn 10.20.0.0/24 4. Accessible from IoT-Net: DC01 (10.20.0.5:445), FILESVR (10.20.0.10:445), DBSVR (10.20.0.15:3306) **Impact**: An attacker within wireless range (tested from the public lobby) can join the IoT network and gain direct network access to the corporate infrastructure, bypassing the WPA2-Enterprise authentication required for employee access. **Remediation**: 1. Implement a complex 20+ character PSK for IoT-Net, rotated quarterly 2. Deploy VLAN segmentation to isolate IoT-Net from the corporate network 3. Implement firewall rules allowing IoT devices to reach only their required services 4. Migrate IoT devices to 802.1X authentication with device certificates where supported 5. Deploy WIDS to detect deauthentication attacks and rogue access points ``` --- Source attribution: luokai0 Original project: https://github.com/luokai0/ai-agent-skills-by-luo-kai/blob/4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c/ai-agent-skills/21-external-registries/08-pinkpixel-collection/conducting-wireless-network-penetration-test/SKILL.md License: Apache-2.0 License information: https://www.apache.org/licenses/LICENSE-2.0 Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 1. Definitions. "License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document. "Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License. "Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity. "You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License. "Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files. "Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types. "Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below). "Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof. "Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to the Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution." "Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by the Licensor and subsequently incorporated within the Work. 2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form. 3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed. 4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions: (a) You must give any other recipients of the Work or Derivative Works a copy of this License; and (b) You must cause any modified files to carry prominent notices stating that You changed the files; and (c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and (d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding any notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License. 5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions. 6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file. 7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License. 8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages. 9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability. END OF TERMS AND CONDITIONS APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. Please do not remove or change the license header comment from a contributed file except when necessary. Copyright 2026 mukul975 Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. # Mega AI Hub resource metadata Creator / publisher: luokai0 Original project: https://github.com/luokai0/ai-agent-skills-by-luo-kai/blob/4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c/ai-agent-skills/21-external-registries/08-pinkpixel-collection/conducting-wireless-network-penetration-test/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Security Engineer Specialties: Testing Tools: Aircrack Ng, Kali Linux Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: 9e7e3bc8ee66aa931afaa8313cdd7fef8fcd67d927b80790c2d7c41130573303