DEV Community

Trix Cyrus
Trix Cyrus

Posted on

How to Hack Wi-Fi Networks: A Comprehensive Guide for Advanced Penetration Testing

#cybersecurity #python #programming #beginners

Author: Trix Cyrus

Waymap Pentesting tool: Click Here
TrixSec Github: Click Here
TrixSec Telegram: Click Here

Disclaimer: This article is intended solely for educational purposes and to help organizations improve their network security. Unauthorized access to networks is illegal and unethical. Always perform these tests only on systems you own or have explicit permission to audit.

Introduction

Wi-Fi networks are a critical component of modern communication, but they are also a common target for attackers. As a cybersecurity professional, understanding how Wi-Fi networks are compromised can help you design better defenses. This advanced guide dives into penetration testing techniques for modern Wi-Fi security protocols like WPA2 and WPA3.

1. Understanding Wi-Fi Security Protocols

Before diving into advanced attacks, familiarize yourself with the key Wi-Fi security protocols:

  • WEP: Outdated and highly insecure.
  • WPA/WPA2 (PSK): Uses a pre-shared key for encryption. WPA2 is widely used but has exploitable vulnerabilities.
  • WPA3: Offers improved encryption and resistance to offline dictionary attacks but isn't foolproof.

2. Setting Up Your Environment

Tools Required:

  • Kali Linux: A Linux distribution with built-in Wi-Fi hacking tools.
  • Aircrack-ng Suite: For capturing and cracking Wi-Fi handshakes.
  • hcxtools: For advanced WPA2 and WPA3 attacks.
  • Wireshark: For packet analysis.
  • External Wi-Fi Adapter: Ensure it supports monitor mode and packet injection.

Configure the Environment:

  1. Install Kali Linux on a VM or dedicated system.
  2. Update all tools to the latest version.
  3. Ensure your Wi-Fi adapter is working correctly. Test it using: 
   airmon-ng start wlan0
Enter fullscreen mode Exit fullscreen mode

3. Advanced WPA2 Hacking Techniques

3.1. Capturing Handshakes

  1. Enable monitor mode: 
   airmon-ng start wlan0
Enter fullscreen mode Exit fullscreen mode
  1. Scan for networks: 
   airodump-ng wlan0mon
Enter fullscreen mode Exit fullscreen mode
  1. Target a specific network and capture handshake packets: 
   airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon
Enter fullscreen mode Exit fullscreen mode
  1. Deauthenticate clients to force reconnections (optional): 
   aireplay-ng -0 10 -a [BSSID] wlan0mon
Enter fullscreen mode Exit fullscreen mode

3.2. Cracking the Handshake

Use a robust wordlist for brute-forcing:

aircrack-ng -w [wordlist] -b [BSSID] capture-01.cap
Enter fullscreen mode Exit fullscreen mode

Alternatively, use hashcat for GPU-accelerated cracking:

hashcat -m 2500 capture.hccapx [wordlist]
Enter fullscreen mode Exit fullscreen mode

3.3. PMKID Attack

The PMKID attack bypasses the need for a full handshake:

  1. Use hcxdumptool to capture PMKID: 
   hcxdumptool -i wlan0mon -o dump.pcapng --enable_status=1
Enter fullscreen mode Exit fullscreen mode
  1. Convert to hash format and crack: 
   hcxpcapngtool -o pmkid.hc22000 dump.pcapng
   hashcat -m 22000 pmkid.hc22000 [wordlist]
Enter fullscreen mode Exit fullscreen mode

4. Hacking WPA3 Networks

WPA3 introduces Simultaneous Authentication of Equals (SAE), making it resistant to dictionary attacks. However, side-channel vulnerabilities can be exploited.

4.1. Downgrade Attack

Many WPA3 routers still support WPA2 for backward compatibility. Force devices to connect using WPA2:

  1. Monitor the network and identify WPA3-enabled devices.
  2. Deauthenticate WPA3 clients to force reconnections via WPA2.

4.2. Exploiting SAE Handshake

Using tools like Dragonblood:

  1. Clone the repository and install dependencies: 
   git clone https://github.com/vanhoefm/dragonblood.git
   cd dragonblood
Enter fullscreen mode Exit fullscreen mode
  1. Test for side-channel vulnerabilities: 
   python dragonforce.py -i wlan0mon
Enter fullscreen mode Exit fullscreen mode

5. Bypassing Captive Portals

Many public Wi-Fi networks use captive portals to authenticate users. To bypass:

  • MAC Address Spoofing: Use macchanger to mimic an authenticated device. 
  macchanger -r wlan0
Enter fullscreen mode Exit fullscreen mode
  • DNS Spoofing: Intercept DNS queries to redirect users to an open network.
  • MITM Tools: Tools like Ettercap or Bettercap can bypass portal restrictions.

6. Defending Against Wi-Fi Attacks

  • Use WPA3 where possible.
  • Disable WPS to avoid brute-forcing attacks.
  • Regularly update router firmware.
  • Enable MAC address filtering.
  • Use VLANs to segment your network.

Conclusion

Wi-Fi hacking techniques have evolved with advancements in security protocols. As a penetration tester, mastering these methods will enhance your ability to identify vulnerabilities and propose robust defenses. Always remember to operate ethically and responsibly while conducting security assessments.

Here are some specific Wi-Fi hacking scenarios and tools you can explore in greater depth:

1. Advanced WPA2 Scenarios

Scenario: Targeting Enterprise Wi-Fi Networks (WPA2-Enterprise)

WPA2-Enterprise networks use RADIUS servers for authentication, making them more secure than WPA2-PSK. However, misconfigurations can be exploited:

  • Evil Twin Attack:
    • Set up a rogue access point using tools like Airbase-ng or Fluxion.
    • Capture credentials when users connect to your fake AP.
    • Test credentials using a RADIUS server emulator.

Scenario: Hidden SSID Discovery

Hidden SSIDs can still be revealed by monitoring probe requests:

  1. Start Wi-Fi monitoring: 
   airodump-ng wlan0mon
Enter fullscreen mode Exit fullscreen mode
  1. Deauthenticate connected clients to capture the SSID: 
   aireplay-ng -0 5 -a [BSSID] wlan0mon
Enter fullscreen mode Exit fullscreen mode

2. WPA3-Focused Tools and Techniques

Dragonblood Vulnerability Testing

  • Use Dragonblood to test WPA3 routers for vulnerabilities like side-channel attacks or downgrade attacks: 
  python dragonforce.py -i wlan0mon
Enter fullscreen mode Exit fullscreen mode
  • Test for SAE group downgrades and password partitioning vulnerabilities.

WPA3 Evil Twin Attack

Some WPA3 routers fall back to WPA2 under specific conditions. Set up an Evil Twin AP to exploit this:

  • Use hostapd-wpe to set up a rogue WPA2 AP.
  • Capture WPA2 credentials and use them to test WPA3 fallback.

3. Captive Portal Exploits

Scenario: Bypassing Hotel or Public Wi-Fi Portals

Captive portals redirect users to a login page. You can bypass them by:

  • Spoofing DNS Responses:

    • Intercept DNS traffic using Bettercap: 
    bettercap -iface wlan0
    • Redirect users to an alternate page or open network.

  • MAC Address Cloning:

    • Find the MAC address of an authenticated device using airodump-ng.
    • Clone the MAC address with macchanger: 
    macchanger -m [MAC_ADDRESS] wlan0

4. IoT and Smart Home Devices

Scenario: Hacking IoT Devices on Wi-Fi

IoT devices often use insecure protocols or weak encryption. Test for vulnerabilities by:

  1. Sniffing Unencrypted Traffic: Use Wireshark to capture IoT traffic.
  2. Exploiting UPnP: Universal Plug and Play is often misconfigured on IoT devices, allowing unauthorized access.
  3. Brute Forcing Web Interfaces: Test default credentials using Hydra: 
   hydra -l admin -P [password_list] [IP_ADDRESS] http-get /
Enter fullscreen mode Exit fullscreen mode

5. Post-Exploitation Scenarios

Scenario: MITM Attacks on Wi-Fi

Once connected to a network, you can perform advanced man-in-the-middle (MITM) attacks:

  • Using Bettercap:

    • Start ARP spoofing: 
    bettercap -iface wlan0 -eval "arp.spoof on"
    • Intercept and analyze traffic for sensitive data.

  • SSL Strip: Downgrade HTTPS to HTTP to capture credentials.

6. Exploring Specialized Tools

6.1. Wifiphisher

Automate phishing attacks to capture WPA credentials or login details from captive portals.

  • Set up a fake portal to trick users: 
  wifiphisher
Enter fullscreen mode Exit fullscreen mode

6.2. Airgeddon

An all-in-one toolkit for Wi-Fi hacking, including Evil Twin APs, DoS attacks, and captive portal bypasses.

6.3. Wireshark Filters

Use Wireshark to analyze captured packets efficiently:

  • Filter by protocol: 
  wlan.fc.type_subtype == 0x08
Enter fullscreen mode Exit fullscreen mode
  • Isolate SSIDs or MAC addresses for detailed analysis.

~Trixsec

Top comments (0)

Read next

_prakhar_ profile image

How Does Machine Learns (Intro to Machine Learning)

Prakhar Khandelwal -

sean2024 profile image

Day 2: Leetcode

sean2024 -

leandroveiga profile image

Unlocking C# 13: A Deep Dive into the Latest Features for Modern Developers

Leandro Veiga -

ravikishan profile image

Introducing NexaPHP: A Lightweight MVC PHP Framework

Ravi Kishan -