WiFi Pentesting

Beginner-Friendly Wireless Security Testing Guide
From Easy Attacks to Advanced Research Attacks

Legal and Safety Notice#

Use this guide only on Wi-Fi networks that you own or have written permission to test.

Do not test public Wi-Fi networks or networks that are outside the approved scope.

For tests that can disconnect users or change authentication behavior, always use:

Test SSID

Test Access Point

Test Client

Test Account

Isolated Lab

Attack Roadmap#

This list goes from easier tests to harder and more advanced tests.

1. Deauthentication Attack
2. WPS Attack
3. WPA/WPA2 Dictionary Attack
4. WEP IVs Attack
5. PMKID Attack
6. Evil Twin
7. WPA2-Enterprise Attacks
8. WPA3 Transition Mode Attacks
9. KRACK
10. SSID Confusion
11. AirSnitch
12. FragAttacks
13. Dragonblood
14. Fragile Frames
15. SAECRED
16. Dragondoom

1. Deauthentication Attack#

Difficulty

Beginner

Definition#

This attack targets Wi-Fi management frames.

Management Frames

A fake deauthentication frame can tell a client that it must disconnect from the access point.

Pentest Goal#

Check if a test device can be disconnected by fake deauthentication frames.

Do not target real employees.

Requirements#

Kali Linux

Monitor-Mode Wi-Fi Adapter

Aircrack-ng

Test Access Point

Test Client

Step 1#

Enable monitor mode.

sudo airmon-ng start wlan0

Step 2#

Scan nearby Wi-Fi networks.

sudo airodump-ng wlan0mon

Find the test network information.

BSSID

Channel

Test Client MAC Address

Step 3#

Send only one deauthentication test packet to your test device.

sudo aireplay-ng --deauth 1 -a <TEST_AP_BSSID> -c <TEST_CLIENT_MAC> wlan0mon

Step 4#

Check if the test device disconnects.

Step 5#

Repeat the test after enabling:

Protected Management Frames

PMF

Vulnerable Result#

The test client disconnects easily because of a fake management frame.

Fix#

Enable:

PMF

Use modern Wi-Fi security settings.

Official Reference#

https://www.aircrack-ng.org/doku.php?id=deauthentication (opens in a new tab)

2. WPS Attack#

Difficulty

Beginner

Definition#

WPS is a feature that helps users connect devices to Wi-Fi more easily.

Wi-Fi Protected Setup

The old security problem is mainly related to:

WPS PIN

The attacker does not break AES encryption.

The attacker tries to attack the WPS registration process.

Pentest Goal#

Check if WPS is enabled and if the router allows too many PIN tries.

Requirements#

Reaver

Wash

Monitor-Mode Wi-Fi Adapter

Test Access Point

Step 1#

Enable monitor mode.

sudo airmon-ng start wlan0

Step 2#

Look for access points with WPS.

sudo wash -i wlan0mon

Step 3#

Choose only your test access point.

Write down:

BSSID

Channel

Step 4#

On a test access point only, use the tool to check WPS PIN security.

sudo reaver -i wlan0mon -b <TEST_AP_BSSID> -c <CHANNEL> -vv

Do not run a long test against a production router.

Vulnerable Result#

The access point allows many PIN tries without a strong lockout.

Fix#

Disable WPS if it is not needed.

Update the router firmware.

Enable lockout protection.

Official PoC#

https://github.com/t6x/reaver-wps-fork-t6x (opens in a new tab)

3. WPA/WPA2 Dictionary Attack#

Difficulty

Beginner

Definition#

This attack tries possible Wi-Fi passwords from a wordlist.

The attacker first captures authentication data.

4-Way Handshake

Then the attacker tests passwords offline.

Offline Password Guessing

This does not directly break AES encryption.

Pentest Goal#

Check if the Wi-Fi password is weak and easy to guess.

Use a test password that you already know.

Requirements#

Aircrack-ng

or:

Hashcat

Test Wi-Fi Network

Test Password

Step 1#

Start capturing traffic from the test network.

sudo airodump-ng --bssid <TEST_AP_BSSID> --channel <CHANNEL> --write capture wlan0mon

Step 2#

Let your test device connect normally.

Do not disconnect real users.

Step 3#

Create a small test wordlist.

Company-Test-2026!
WrongPassword
Another-Test-Password

Step 4#

Test the wordlist.

aircrack-ng -w test-wordlist.txt -b <TEST_AP_BSSID> capture-01.cap

Vulnerable Result#

The Wi-Fi test password is found quickly using a simple wordlist.

Fix#

Use a long and random Wi-Fi password.

Do not use the company name, year, phone number, or easy words.

Official Reference#

https://www.aircrack-ng.org/doku.php?id=aircrack-ng (opens in a new tab)

Hashcat Reference#

https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (opens in a new tab)

4. WEP IVs Attack#

Difficulty

Beginner to Intermediate

Definition#

This attack targets old WEP Wi-Fi networks.

WEP

WEP uses a small value called:

Initialization Vector

IV

Because of old design problems, collecting many IVs can help recover the WEP key.

Pentest Goal#

Check that the company is not using WEP anywhere.

Requirements#

Aircrack-ng

Airodump-ng

Old Test Access Point

Step 1#

Use only an old test access point.

Step 2#

Start capturing packets.

sudo airodump-ng --bssid <TEST_AP_BSSID> --channel <CHANNEL> --write wep-test wlan0mon

Step 3#

Watch the amount of captured data.

Data Packets

IVs

Step 4#

Test the capture.

aircrack-ng wep-test-01.cap

Vulnerable Result#

The WEP key can be recovered after collecting enough traffic.

Fix#

Remove WEP completely.

Use:

WPA2

or:

WPA3

Official Reference#

https://www.aircrack-ng.org/doku.php?id=aircrack-ng (opens in a new tab)

5. PMKID Attack#

Difficulty

Intermediate

Definition#

Some WPA/WPA2 networks can provide authentication data called:

PMKID

This data can be used for offline password testing.

The real problem is still a weak Wi-Fi password.

Pentest Goal#

Check password strength using a known test password.

Requirements#

hcxdumptool

hcxtools

Hashcat

Step 1#

Use only the approved test Wi-Fi network.

Step 2#

Capture wireless authentication data using the official tool.

Save the result as:

PCAPNG

Step 3#

Convert the capture.

hcxpcapngtool -o test.22000 capture.pcapng

Step 4#

Create a small test wordlist.

Company-Test-2026!
Wrong-Password
Another-Test

Step 5#

Test the password offline.

hashcat -m 22000 test.22000 test-wordlist.txt

Vulnerable Result#

The test password is found quickly using a simple wordlist.

Fix#

Use a long and random password.

Use WPA3 when possible.

WPA3-SAE

Official Tools#

https://github.com/ZerBea/hcxdumptool (opens in a new tab)

https://github.com/ZerBea/hcxtools (opens in a new tab)

6. Evil Twin#

Difficulty

Intermediate

Definition#

An Evil Twin is a fake Wi-Fi access point that copies the name of a trusted network.

Evil Twin

Rogue Access Point

The goal is to check if a test device connects to the fake network.

Pentest Goal#

Check how company devices react to a fake Wi-Fi network with the same name.

Requirements#

hostapd

or:

Airbase-ng

Test Client

Isolated Lab

Step 1#

Create a test Wi-Fi network.

COMPANY-WIFI-TEST

Step 2#

Save this network on the test device.

Step 3#

Turn off the original test access point.

Step 4#

Create a second test access point with the same SSID.

Example:

interface=wlan0
driver=nl80211
ssid=COMPANY-WIFI-TEST
channel=6

Step 5#

Watch the test device.

Check if it:

• Connects automatically
• Shows a warning
• Asks the user to confirm
• Refuses the connection

Vulnerable Result#

The device connects automatically to an untrusted access point.

Fix#

Use strong Wi-Fi authentication.

For enterprise Wi-Fi, use correct certificate validation.

Certificate Validation

Official Reference#

https://www.aircrack-ng.org/doku.php?id=airbase-ng (opens in a new tab)

7. WPA2-Enterprise Attacks#

Difficulty

Intermediate

Definition#

Company Wi-Fi often uses central authentication.

WPA2-Enterprise

802.1X

RADIUS

A common security test is to check if the client verifies the RADIUS server certificate before sending login information.

Pentest Goal#

Check if company devices correctly validate the authentication server certificate.

Use only a test account.

Requirements#

Test Account

Test Endpoint

hostapd-wpe

or:

EAPHammer

Step 1#

Create a test account.

wifi-pentest-test

Step 2#

Use a company-managed test device.

Step 3#

Inside the lab, create a fake enterprise Wi-Fi access point with an untrusted certificate.

Step 4#

Use only the test account.

Do not collect real employee credentials.

Step 5#

Check if the device rejects the fake certificate.

Secure Result#

The device refuses the connection.

Vulnerable Result#

The device tries to authenticate even when the RADIUS certificate is not trusted.

Fix#

Configure:

Trusted CA

RADIUS Server Name

Certificate Validation

Official PoC#

https://github.com/OpenSecurityResearch/hostapd-wpe (opens in a new tab)

Alternative Tool#

https://github.com/s0lst1c3/eaphammer (opens in a new tab)

8. WPA3 Transition Mode Attacks#

Difficulty

Intermediate

Definition#

WPA3 Transition Mode allows old and new devices to use the same Wi-Fi network.

It can support both:

WPA2-PSK

and:

WPA3-SAE

This is useful for compatibility, but the older WPA2 path can still be available.

Pentest Goal#

Check if a modern device can fall back to WPA2 when the company expects WPA3 only.

Requirements#

WPA3 Test Client

Test Access Point

Wireshark

Step 1#

Capture the test network information.

Look at:

RSN Information Element

AKM Suites

Step 2#

Check if the network supports both:

PSK

and:

SAE

Step 3#

Connect a modern test device.

Check that it uses:

SAE

Step 4#

Inside the lab, turn off the original test access point.

Step 5#

Create another test access point with the same test SSID and test password.

Use:

WPA2-PSK Only

Step 6#

Check if the device connects automatically using WPA2.

Risky Result#

The device automatically falls back to the older security mode.

Fix#

Use:

WPA3-Only

when old device support is not needed.

Use separate Wi-Fi networks for old devices.

Research Reference#

https://wpa3.mathyvanhoef.com/ (opens in a new tab)

9. KRACK#

Difficulty

Intermediate to Advanced

Definition#

KRACK means:

Key Reinstallation Attack

The attack checks if a client can be forced to reinstall an encryption key that it already used.

This can reset important encryption state.

Pentest Goal#

Check if a test device is still affected by old KRACK problems.

Requirements#

Kali Linux

KRACK Test Scripts

Test Wi-Fi Credentials

Step 1#

Use a test device with the same system version used in the company.

Step 2#

Clone the official project.

git clone https://github.com/vanhoefm/krackattacks-scripts.git
cd krackattacks-scripts/krackattack

Step 3#

Build the test environment.

./build.sh
./pysetup.sh

Step 4#

If required by the project, disable hardware crypto during testing.

sudo ./disable-hwcrypto.sh

Step 5#

Run the official test scripts against the test device.

Use only the test network credentials.

Vulnerable Result#

The official tool reports key reinstallation behavior.

Fix#

Update:

Operating System

Wi-Fi Drivers

Access Point Firmware

Official PoC#

https://github.com/vanhoefm/krackattacks-scripts (opens in a new tab)

Research Website#

https://www.krackattacks.com/ (opens in a new tab)

10. SSID Confusion#

Difficulty

Advanced

Definition#

SSID Confusion is a Wi-Fi attack where a client can be confused about which network name it is really using.

SSID Confusion

The problem is more important when the same credentials are used on more than one Wi-Fi network.

Pentest Goal#

Check if a test client is affected by the official research scenario.

Requirements#

Modified hostapd

Wi-Fi Adapter

Test Client

Step 1#

Clone the official project.

git clone https://github.com/vanhoefm/ssid-confusion-hostap.git
cd ssid-confusion-hostap

Step 2#

Create a test configuration.

interface=wlan0
ctrl_interface=wpaspy_ctrl
channel=1
ssid=connectssid
wpa_ptk_rekey=10

Step 3#

Start the modified access point.

./hostapd hostapd_test.conf

Step 4#

Before the test client connects, change the fake SSID.

./hostapd_cli -p wpaspy_ctrl raw "FAKESSID changedssid"

Step 5#

Let the test device try to connect.

Vulnerable Result#

The device connects in a way that shows the SSID confusion behavior.

Fix#

Update clients and access points.

Do not reuse the same credentials on Wi-Fi networks with different trust levels.

Official PoC#

https://github.com/vanhoefm/ssid-confusion-hostap (opens in a new tab)

Research Paper#

https://papers.mathyvanhoef.com/wisec2024.pdf (opens in a new tab)

11. AirSnitch#

Difficulty

Advanced

Definition#

AirSnitch checks problems with client isolation.

Client Isolation

On a guest Wi-Fi network, one client should normally not communicate directly with another client.

AirSnitch checks if this isolation can be bypassed.

Pentest Goal#

Check if two test clients can communicate when client isolation should block them.

Requirements#

Two Test Clients

Compatible Wi-Fi Adapters

AirSnitch

Guest Wi-Fi

Step 1#

Clone the project.

git clone https://github.com/vanhoefm/airsnitch.git
cd airsnitch

Step 2#

Run the setup script.

sudo ./setup.sh

Step 3#

Configure the test clients using the project instructions.

client.conf

Step 4#

Check if the group key is shared in a risky way.

./airsnitch.py wlan2 --check-gtk-shared wlan3 --no-ssid-check

Step 5#

Test client-to-client isolation.

./airsnitch.py wlan2 --c2c-ip wlan3 --no-ssid-check

Step 6#

Check if one test client can reach the other test client.

Vulnerable Result#

The clients can communicate even when isolation is enabled.

Fix#

Update access points and wireless controllers.

Review guest isolation and VLAN rules.

VLAN Isolation

Official PoC#

https://github.com/vanhoefm/airsnitch (opens in a new tab)

12. FragAttacks#

Difficulty

Advanced

Definition#

FragAttacks are Wi-Fi attacks related to how frames are split and joined.

Fragmentation

Aggregation

Some problems come from the Wi-Fi design.

Other problems come from bad device implementations.

Pentest Goal#

Check if a test device or test access point is affected by the official FragAttacks test cases.

Requirements#

Compatible Wi-Fi Adapter

FragAttacks Tool

Test Client

or:

Test Access Point

Step 1#

Clone the project.

git clone https://github.com/vanhoefm/fragattacks.git
cd fragattacks

Step 2#

Read the supported hardware list.

Using the wrong adapter can give wrong results.

Step 3#

Prepare the test device using the official instructions.

Step 4#

Start with a simple test.

./fragattack.py wlan0 ping

Step 5#

Test one case at a time.

Do not run every test at once on a production network.

Vulnerable Result#

The official tool shows unsafe frame handling.

Fix#

Update:

Firmware

Operating System

Wi-Fi Drivers

Official PoC#

https://github.com/vanhoefm/fragattacks (opens in a new tab)

Research Website#

https://www.fragattacks.com/ (opens in a new tab)

13. Dragonblood#

Difficulty

Advanced

Definition#

Dragonblood is a group of attacks against some WPA3 authentication implementations.

SAE

Some research problems included:

Downgrade Attacks

Side-Channel Attacks

Denial of Service

Pentest Goal#

Check a test WPA3 device with the official research tool.

Requirements#

Dragonslayer

WPA3 Test Access Point

Kali Linux

Step 1#

Clone the project.

git clone https://github.com/vanhoefm/dragonslayer.git
cd dragonslayer

Step 2#

Install the dependencies from the official documentation.

Step 3#

Build the tool.

./build.sh

Step 4#

Run only the test that matches your lab setup.

Example:

sudo ./dragonslayer-client.sh -i wlan0 -a 3

Step 5#

Compare the result with the device firmware version and vendor security updates.

Vulnerable Result#

The tool reports behavior related to a known WPA3 implementation problem.

Fix#

Update:

hostapd

wpa_supplicant

Access Point Firmware

Official PoC#

https://github.com/vanhoefm/dragonslayer (opens in a new tab)

Research Website#

https://wpa3.mathyvanhoef.com/ (opens in a new tab)

14. Fragile Frames#

Difficulty

Advanced Research

Definition#

Fragile Frames is later research that checks if fixes for earlier Wi-Fi frame attacks are really working.

It is related to:

FragAttacks

The research found that some devices still had incomplete protections.

Pentest Goal#

Start in a lab or simulation first.

Then test a real company device only if the test is approved.

Requirements#

Linux

Python Virtual Environment

Compatible Wi-Fi Hardware

Simulation Lab

Step 1#

Clone the project.

git clone https://github.com/vanhoefm/fragattacks-survey-public.git
cd fragattacks-survey-public

Step 2#

Create the Python environment.

python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Step 3#

Start with the simulation environment.

hwsim

Step 4#

Configure only the test adapters and test MAC addresses.

Step 5#

Run one test at a time and save the results.

Vulnerable Result#

The device still accepts unsafe frame behavior that should already be blocked.

Fix#

Update firmware, drivers, and operating systems.

Retest after important updates.

Official Research Project#

https://github.com/vanhoefm/fragattacks-survey-public (opens in a new tab)

15. SAECRED#

Difficulty

Research Level

Definition#

SAECRED studies WPA3 authentication behavior.

It tests many protocol states and unusual message sequences.

SAE

Protocol State Machine

Fuzzing

The goal is to find bad or unexpected behavior.

Pentest Goal#

Run the test only on a lab copy of the same access point or software used by the company.

Do not start this test directly on production Wi-Fi.

Requirements#

OCaml

Dune

cvc5

SAECRED

WPA3 Lab

Step 1#

Clone the project.

git clone https://github.com/izdar/SAECRED.git
cd SAECRED

Step 2#

Install the required packages.

opam install menhir alcotest ppx_bitstring yojson ocamlgraph lwt lwt_ppx

Step 3#

Install:

cvc5

Step 4#

Check the project paths and update them for your lab if needed.

Step 5#

Build the project.

dune build

Step 6#

Run the framework.

dune exec sbf

For debug output:

dune exec sbf -- --debug

Step 7#

Watch for:

Crash

Unexpected Authentication State

Persistent Failure

Denial of Service

Fix#

Update the WPA3 authentication software and firmware.

Retest after patching.

Official PoC#

https://github.com/izdar/SAECRED (opens in a new tab)

16. Dragondoom#

Difficulty

Expert Research Level

Definition#

Dragondoom is different from normal Wi-Fi attacks.

It studies side-channel problems in some WPA3-related cryptographic operations.

Side-Channel Attack

One example looks at CPU cache behavior.

Cache Attack

The research can involve:

OpenSSL

hostapd

This is not a simple attack that you run with one Wi-Fi adapter.

Pentest Goal#

Check the affected software versions inside a controlled lab.

Requirements#

Dedicated Linux Lab

hostapd

OpenSSL

Research Artifact

Controlled Hardware

Step 1#

Find the versions used by the company.

hostapd Version

OpenSSL Version

Step 2#

Build a lab that is as close as possible to the real environment.

Step 3#

Clone the research project.

git clone https://gitlab.inria.fr/ddealmei/artifact_dragondoom.git
cd artifact_dragondoom

Step 4#

Follow the project build instructions.

The exact setup can depend on the CPU, operating system, and library versions.

Step 5#

Run the research test only on the local lab system.

Step 6#

Compare the result with a fixed or side-channel-resistant implementation.

Defensive Reference#

Dragonstar

https://github.com/ddealmei/dragonstar (opens in a new tab)

Official Research Artifact#

https://gitlab.inria.fr/ddealmei/artifact_dragondoom (opens in a new tab)

Recommended Company WiFi Pentest Workflow#

Phase 1#

Start with passive discovery.

Wireless Recon

Collect:

SSID

BSSID

Channel

Security Mode

Cipher

AKM

PMF

Phase 2#

Run low-impact checks.

Passive Capture

Security Configuration Review

WPS Review

Password Policy Review

Phase 3#

Use dedicated test devices.

Test Client

Test Access Point

Test:

Deauthentication Resistance

Evil Twin Behavior

Enterprise Certificate Validation

WPA3 Transition Mode

Phase 4#

Run advanced tests during an approved test window.

KRACK

SSID Confusion

AirSnitch

FragAttacks

Phase 5#

Run research-level tests inside a separate lab.

Dragonblood

Fragile Frames

SAECRED

Dragondoom

Evidence to Collect#

For every test, save:

Date and Time

Test SSID

Test BSSID

Test Client

Access Point Model

Firmware Version

Security Mode

PMF Status

Tool Version

Packet Capture

Screenshot

Observed Result

Expected Result

Impact

Recommended Fix

Finding Template#

Title:
Affected SSID:
Affected AP:
Affected Client:
Attack/Test:
Severity:
Description:
Evidence:
Impact:
Reproduction Summary:
Recommended Fix:
Retest Result:

Final Notes#

You do not need to run every attack on the production network.

A professional pentest should use the safest test that proves the security problem.

Advanced attacks should be tested on a lab copy of the real system when possible.

Do not collect real employee passwords unless the approved test scope clearly allows it.

Main References#

Aircrack-ng

https://www.aircrack-ng.org/ (opens in a new tab)

Reaver

https://github.com/t6x/reaver-wps-fork-t6x (opens in a new tab)

hcxdumptool

https://github.com/ZerBea/hcxdumptool (opens in a new tab)

hcxtools

https://github.com/ZerBea/hcxtools (opens in a new tab)

Hashcat WPA/WPA2

https://hashcat.net/wiki/doku.php?id=cracking_wpawpa2 (opens in a new tab)

KRACK

https://github.com/vanhoefm/krackattacks-scripts (opens in a new tab)

SSID Confusion

https://github.com/vanhoefm/ssid-confusion-hostap (opens in a new tab)

AirSnitch

https://github.com/vanhoefm/airsnitch (opens in a new tab)

FragAttacks

https://github.com/vanhoefm/fragattacks (opens in a new tab)

Fragile Frames

https://github.com/vanhoefm/fragattacks-survey-public (opens in a new tab)

Dragonblood

https://github.com/vanhoefm/dragonslayer (opens in a new tab)

SAECRED

https://github.com/izdar/SAECRED (opens in a new tab)

Dragondoom

https://gitlab.inria.fr/ddealmei/artifact_dragondoom (opens in a new tab)

WPA2-Enterprise

https://github.com/OpenSecurityResearch/hostapd-wpe (opens in a new tab)