offensive-wifi-recon

Name: offensive-wifi-recon
Author: SnailSploit

2.8kstars447forks

How to install offensive-wifi-recon?

snailsploit/claude-red/offensive-wifi-recon

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wifi-recon

Installs into the current project.

Summary

Wi-Fi reconnaissance methodology — adapter selection, monitor mode and packet injection setup, regulatory domain handling, multi-band airspace mapping, hidden SSID discovery, BSSID/ESSID/channel/PMF/encryption fingerprinting, client probe analysis, vendor OUI lookup, war-driving

Files · 1

View on GitHub

SKILL.md

1	# Wi-Fi Reconnaissance
2
3	The first phase of any wireless engagement. Build a complete picture of the airspace before you deauth, evil-twin, or capture handshakes — every later attack depends on knowing the right BSSID, channel, encryption, and client population.
4
5	## Quick Workflow
6
7	1. Pick the right adapter for the target's band(s) and PHY
8	2. Verify monitor mode + injection actually work
9	3. Set the regulatory domain (legal channels and TX power)
10	4. Sweep all bands passively
11	5. Drill down on each in-scope BSSID for client population and PMF status
12	6. Record everything in a structured target list before any active attack
13
14	---
15
16	## Adapter Selection
17
18	\| Chipset \| Strengths \| Notes \|
19	\|---------\|-----------\|-------\|
20	\| Atheros AR9271 (Alfa AWUS036NHA) \| Solid 2.4 GHz monitor + injection \| 802.11n only \|
21	\| Realtek RTL8812AU (AWUS036ACH) \| Dual-band, injection \| Driver: aircrack-ng/rtl8812au \|
22	\| MediaTek MT7612U (AWUS036ACM) \| Stable dual-band \| In-tree driver on modern kernels \|
23	\| MediaTek MT7921AU \| Wi-Fi 6 monitor (limited) \| Patched drivers required \|
24	\| AWUS036AXML / AXM \| Wi-Fi 6E (6 GHz) \| Bleeding edge — verify per release \|
25
26	```bash
27	# Identify your radio
28	lsusb \| grep -iE "(atheros\|realtek\|mediatek\|alfa)"
29	iw dev
30	iw list \| grep -A 8 "Supported interface modes"
31	iw list \| grep -E "Frequencies:" -A 30
32	```
33
34	## Monitor Mode Setup
35
36	```bash
37	# Kill conflicting services
38	sudo airmon-ng check kill
39
40	# Enable monitor mode
41	sudo airmon-ng start wlan0
42	# Or manually
43	sudo ip link set wlan0 down
44	sudo iw wlan0 set monitor control
45	sudo ip link set wlan0 up
46
47	# Verify monitor mode + injection
48	sudo aireplay-ng --test wlan0mon
49	```
50
51	The injection test should report 30/30 ack rates against nearby APs. Lower scores indicate driver, antenna, or position issues.
52
53	## Regulatory Domain
54
55	```bash
56	# Check current
57	iw reg get
58
59	# Set explicitly (us = United States, jp = Japan extended, etc.)
60	sudo iw reg set US
61	```
62
63	Setting the right regdomain unlocks legitimate channels (US: 1–11 on 2.4, 36–165 on 5; JP adds 12–13 + 184+ DFS) and TX power. Operate within the regdomain you're authorized to use.
64
65	## Passive Multi-Band Sweep
66
67	```bash
68	# All bands
69	sudo airodump-ng wlan0mon --band abg
70
71	# 5 GHz only (helps see UNII bands)
72	sudo airodump-ng wlan0mon --band a
73
74	# 6 GHz (requires 6E-capable adapter and updated airodump-ng)
75	sudo airodump-ng wlan0mon --band ax
76
77	# Hop only specific channels
78	sudo airodump-ng wlan0mon -c 1,6,11,36,40,44,48
79	```
80
81	Capture to file for later analysis:
82
83	```bash
84	sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv
85	```
86
87	## Targeted Capture
88
89	Once you've identified an in-scope BSSID:
90
91	```bash
92	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon
93	```
94
95	Pin to the channel — channel-hopping during a focused capture loses frames.
96
97	## Hidden SSIDs
98
99	Hidden APs broadcast beacons with empty ESSID. The name leaks during client probes (active scan) or association requests:
100
101	```bash
102	# Wait for legitimate client to associate, ESSID appears in airodump output
103	# Or, if a client is already associated, deauth them once to force reassociation:
104	sudo aireplay-ng --deauth 1 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
105	```
106
107	(Only deauth with explicit authorization — see `offensive-deauth-disassoc`.)
108
109	## Kismet for War-Driving
110
111	```bash
112	sudo kismet -c wlan0mon
113	# Open https://localhost:2501 for the dashboard
114	```
115
116	Kismet handles GPS integration, plots APs to a map, fingerprints by IE order, identifies probable IoT vendors from OUI prefixes, and tags known-vulnerable models.
117
118	For long-running captures, drop `--no-ncurses` and run headless under `tmux`.
119
120	## Wigle Submission
121
122	If the engagement permits:
123
124	```bash
125	# Export Kismet's .kismet → CSV → Wigle import format
126	kismetdb_dump_devices --in capture.kismet --out devices.csv
127	```
128
129	(Wigle aggregates wireless network observations geographically — useful for mapping but check ROE.)
130
131	## Vendor / OUI Identification
132
133	```bash
134	# Quick OUI lookup
135	echo "AA:BB:CC" \| wireshark-tools/manuf-lookup
136	# Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf
137	```
138
139	Vendor identification informs:
140	- Likely default credentials (router brand → known defaults)
141	- Known firmware bugs (CVE per chipset)
142	- Whether WPS is likely vulnerable (Pixie Dust per chipset)
143	- Whether KRACK / FragAttacks patches are likely applied (vendor patch cadence)
144
145	## Data to Record per Target
146
147	\| Field \| Why \|
148	\|-------\|---

People who liked this also viewed

6 picks

Type

offensive-wifi-recon

2.8kstars447forks

View on GitHub

How to install offensive-wifi-recon?

snailsploit/claude-red/offensive-wifi-recon

$npx -y skills add SnailSploit/Claude-Red --skill offensive-wifi-recon

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Wi-Fi Reconnaissance
2
3	The first phase of any wireless engagement. Build a complete picture of the airspace before you deauth, evil-twin, or capture handshakes — every later attack depends on knowing the right BSSID, channel, encryption, and client population.
4
5	## Quick Workflow
6
7	1. Pick the right adapter for the target's band(s) and PHY
8	2. Verify monitor mode + injection actually work
9	3. Set the regulatory domain (legal channels and TX power)
10	4. Sweep all bands passively
11	5. Drill down on each in-scope BSSID for client population and PMF status
12	6. Record everything in a structured target list before any active attack
13
14	---
15
16	## Adapter Selection
17
18	\| Chipset \| Strengths \| Notes \|
19	\|---------\|-----------\|-------\|
20	\| Atheros AR9271 (Alfa AWUS036NHA) \| Solid 2.4 GHz monitor + injection \| 802.11n only \|
21	\| Realtek RTL8812AU (AWUS036ACH) \| Dual-band, injection \| Driver: aircrack-ng/rtl8812au \|
22	\| MediaTek MT7612U (AWUS036ACM) \| Stable dual-band \| In-tree driver on modern kernels \|
23	\| MediaTek MT7921AU \| Wi-Fi 6 monitor (limited) \| Patched drivers required \|
24	\| AWUS036AXML / AXM \| Wi-Fi 6E (6 GHz) \| Bleeding edge — verify per release \|
25
26	```bash
27	# Identify your radio
28	lsusb \| grep -iE "(atheros\|realtek\|mediatek\|alfa)"
29	iw dev
30	iw list \| grep -A 8 "Supported interface modes"
31	iw list \| grep -E "Frequencies:" -A 30
32	```
33
34	## Monitor Mode Setup
35
36	```bash
37	# Kill conflicting services
38	sudo airmon-ng check kill
39
40	# Enable monitor mode
41	sudo airmon-ng start wlan0
42	# Or manually
43	sudo ip link set wlan0 down
44	sudo iw wlan0 set monitor control
45	sudo ip link set wlan0 up
46
47	# Verify monitor mode + injection
48	sudo aireplay-ng --test wlan0mon
49	```
50
51	The injection test should report 30/30 ack rates against nearby APs. Lower scores indicate driver, antenna, or position issues.
52
53	## Regulatory Domain
54
55	```bash
56	# Check current
57	iw reg get
58
59	# Set explicitly (us = United States, jp = Japan extended, etc.)
60	sudo iw reg set US
61	```
62
63	Setting the right regdomain unlocks legitimate channels (US: 1–11 on 2.4, 36–165 on 5; JP adds 12–13 + 184+ DFS) and TX power. Operate within the regdomain you're authorized to use.
64
65	## Passive Multi-Band Sweep
66
67	```bash
68	# All bands
69	sudo airodump-ng wlan0mon --band abg
70
71	# 5 GHz only (helps see UNII bands)
72	sudo airodump-ng wlan0mon --band a
73
74	# 6 GHz (requires 6E-capable adapter and updated airodump-ng)
75	sudo airodump-ng wlan0mon --band ax
76
77	# Hop only specific channels
78	sudo airodump-ng wlan0mon -c 1,6,11,36,40,44,48
79	```
80
81	Capture to file for later analysis:
82
83	```bash
84	sudo airodump-ng wlan0mon --band abg --write recon --output-format pcap,csv
85	```
86
87	## Targeted Capture
88
89	Once you've identified an in-scope BSSID:
90
91	```bash
92	sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w target wlan0mon
93	```
94
95	Pin to the channel — channel-hopping during a focused capture loses frames.
96
97	## Hidden SSIDs
98
99	Hidden APs broadcast beacons with empty ESSID. The name leaks during client probes (active scan) or association requests:
100
101	```bash
102	# Wait for legitimate client to associate, ESSID appears in airodump output
103	# Or, if a client is already associated, deauth them once to force reassociation:
104	sudo aireplay-ng --deauth 1 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
105	```
106
107	(Only deauth with explicit authorization — see `offensive-deauth-disassoc`.)
108
109	## Kismet for War-Driving
110
111	```bash
112	sudo kismet -c wlan0mon
113	# Open https://localhost:2501 for the dashboard
114	```
115
116	Kismet handles GPS integration, plots APs to a map, fingerprints by IE order, identifies probable IoT vendors from OUI prefixes, and tags known-vulnerable models.
117
118	For long-running captures, drop `--no-ncurses` and run headless under `tmux`.
119
120	## Wigle Submission
121
122	If the engagement permits:
123
124	```bash
125	# Export Kismet's .kismet → CSV → Wigle import format
126	kismetdb_dump_devices --in capture.kismet --out devices.csv
127	```
128
129	(Wigle aggregates wireless network observations geographically — useful for mapping but check ROE.)
130
131	## Vendor / OUI Identification
132
133	```bash
134	# Quick OUI lookup
135	echo "AA:BB:CC" \| wireshark-tools/manuf-lookup
136	# Or check the airodump CSV's BSSID prefix against /usr/share/wireshark/manuf
137	```
138
139	Vendor identification informs:
140	- Likely default credentials (router brand → known defaults)
141	- Known firmware bugs (CVE per chipset)
142	- Whether WPS is likely vulnerable (Pixie Dust per chipset)
143	- Whether KRACK / FragAttacks patches are likely applied (vendor patch cadence)
144
145	## Data to Record per Target
146
147	\| Field \| Why \|
148	\|-------\|---

People who liked this also viewed

6 picks

Type