WiFi Hacking & Security

WEP: A Catastrophic Design

Wired Equivalent Privacy (WEP) was the original 802.11 security protocol introduced in 1997. It used the RC4 stream cipher with a 40-bit key (or 104-bit with WEP2) concatenated with a 24-bit Initialization Vector (IV). The fundamental flaw was the IV size: with only 2²⁴ (16.7 million) possible values, a busy network would exhaust all IVs within hours, causing IV reuse — a fatal weakness for any stream cipher.

The Fluhrer-Mantin-Shamir (FMS) attack, published in 2001, exploited weak IVs to recover the WEP key by analyzing captured packets. With approximately 40,000–80,000 captured packets (achievable in minutes on an active network), the key could be recovered. The PTW (Pyshkin-Tews-Weinmann) attack in 2007 reduced this to only 20,000–40,000 packets. Publicly available tools like aircrack-ng could crack WEP in under 5 minutes on any properly configured capture.

WEP's additional flaw was the use of CRC-32 for integrity checking, which is linear — an attacker could modify encrypted packets and predict the correct CRC without knowing the key. Combined with the weak IV scheduling, WEP provided effectively zero security against any motivated attacker.

WPA: TKIP Temporarily Saves Us

Wi-Fi Protected Access (WPA) was introduced in 2003 as an interim solution while WPA2 was finalized. WPA used the Temporal Key Integrity Protocol (TKIP), which addressed WEP's most critical weaknesses without requiring new hardware:

• Per-packet key mixing: TKIP derived a unique encryption key for each packet by combining the base key, transmitter address, and packet sequence number. This eliminated the IV reuse problem that destroyed WEP
• 48-bit IV (TSC): The TKIP Sequence Counter replaced WEP's 24-bit IV with a 48-bit counter, making IV exhaustion practically impossible (2⁴⁸ packets at 10,000 packets/sec = 17,800 years)
• MIC (Message Integrity Code): TKIP added Michael, a 64-bit MIC that provided per-packet integrity checking, replacing WEP's linear CRC-32
• Key rotation: TKIP supports dynamic key rotation, changing the temporal key after a configurable number of packets (default: 1000)

However, TKIP was later found vulnerable. The Beck-Tews attack (2008) could decrypt short packets and inject limited traffic on TKIP networks. The Ohigashi-Morii attack (2009) further refined these weaknesses. TKIP is now deprecated in favor of CCMP/AES.

WPA2: The Long Reign

WPA2, finalized in 2004, mandated AES-CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) for encryption. It provided strong 128-bit encryption that remained cryptographically secure. The 4-way handshake derives the Pairwise Transient Key (PTK) from the Pre-Shared Key (PSK) and nonces exchanged between the client and access point:

WPA2 4-Way Handshake:

  Client                              AP
    |                                  |
    |  1. ANonce (random)              |
    |  <-------------------------------|
    |                                  |
    |  SNonce (random) + MIC           |
    |  ------------------------------>|
    |                                  |
    |  2. PTK = PBKDF2(PMK, ANonce, SNonce, MAC)
    |  GTK (Group Temporal Key)        |
    |  <-------------------------------|
    |                                  |
    |  3. ACK + MIC                    |
    |  ------------------------------>|
    |                                  |
    |  4. Confirm                      |
    |  <-------------------------------|

  PMK = Pre-Master Key (derived from PSK passphrase)
  PTK = Pairwise Transient Key (per-session encryption)
  GTK = Group Temporal Key (broadcast/multicast encryption)

The only practical attack against properly implemented WPA2 was brute-forcing weak passwords. A 8+ character random passphrase was considered safe. WPA2 became the standard for 14 years with no known cryptographic weaknesses — until 2017.

KRACK: Breaking WPA2

In 2017, Mathy Vanhoef and Frank Piessens discovered Key Reinstallation AttaCKs (KRACK) — a fundamental flaw in the WPA2 4-way handshake itself. The attack exploits how clients handle retransmission of handshake message 3:

• Mechanism: When a client receives message 3, it installs the PTK and sends message 4. If the AP retransmits message 3 (due to message 4 loss), the client reinstalls the same PTK, resetting the packet counter to zero
• Consequence: The reset counter allows an attacker to replay previously transmitted packets, decrypt WPA2-encrypted traffic, and forge packets. The attack is against the protocol, not the implementation — it affects all WPA2 clients
• Requirements: The attacker must be within WiFi range and know the network SSID. The attack requires no knowledge of the PSK/passphrase
• Impact: Linux and Android 6.0 were most vulnerable (wpa_supplicant installs an all-zero encryption key). Windows and iOS were less affected (only partial key reset). WPA3 is immune by design

WPA3: The New Standard

WPA3, announced in 2018 and certified since 2019, introduces several fundamental security improvements:

• SAE (Simultaneous Authentication of Equals): Replaces PSK-based key exchange with Dragonfly handshake. Resistant to offline dictionary attacks — an attacker cannot capture the handshake and brute-force the passphrase offline. Each authentication attempt requires active communication with the AP, limiting online attacks to ~100 attempts/second
• 192-bit security suite (WPA3-Enterprise): CCM mode with GCMP-256 encryption, HMAC-SHA-384 for key derivation, and ECDSA-384 for digital signatures. Targets government and financial applications requiring CNSA (Commercial National Security Algorithm) compliance
• Forward secrecy: Each session derives unique encryption keys from ephemeral key exchange. Compromising the passphrase does not allow decryption of previously captured traffic
• Opportunistic Wireless Encryption (OWE): Provides encryption on open networks without requiring a passphrase. Each client gets a unique encryption key derived via Diffie-Hellman, preventing passive eavesdropping on public WiFi

Common Attack Vectors

• Deauthentication flood: Sending forged deauth frames to disconnect clients, forcing them to reconnect and generate handshake traffic for capture. Effective against WPA2-Personal but not WPA3 (SAE prevents offline capture)
• Evil twin AP: Creating a rogue access point with the same SSID as a target network. Clients connect to the attacker's AP, which can intercept traffic or capture handshake credentials
• PMKID attack: A client-less attack where the attacker sends a single EAPOL frame to the AP, which responds with a PMKID value that can be brute-forced offline. Works against WPA2 without capturing a client handshake
• WPS brute force: Wi-Fi Protected Setup uses an 8-digit PIN (with checksum). The second half of the PIN is validated separately, reducing the effective keyspace from 10⁸ to 10⁴+10³ = 11,000 attempts — crackable in hours

WPA2 Attack Methods

The primary attack against WPA2-Personal is capturing the 4-way handshake and performing an offline dictionary attack. The attacker uses a deauthentication flood (sending forged deauth and disassociation frames with the AP's source address) to disconnect a client. When the client reconnects, the attacker captures the full 4-way handshake using airodump-ng or Wireshark. The captured handshake contains the ANonce, SNonce, and MIC — enough to verify a candidate passphrase offline. Tools like aircrack-ng derive the PMK from each candidate passphrase using PBKDF2-HMAC-SHA1 (4096 iterations), compute the PTK, and check if the MIC matches.

The PMKID attack (2018, demonstrated by Jens <atom>Steube) eliminates the need for a client. The attacker sends a single EAPOL frame to the AP requesting association. The AP responds with an association response containing a PMKID — a value derived from the PMK, the AP's MAC address (BSSID), and the client's MAC address. The attacker captures this PMKID and performs the same offline dictionary attack as with a captured handshake. The PMKID attack is faster to execute (no deauthentication required, no client needed) and works silently — the AP logs a normal association attempt with no indication of attack. It is defeated by WPA3's SAE, which does not expose the PMKID in association frames.

Hashcat supports WPA2 cracking via the -m 22000 hash mode (formerly-m 2500 for hccapx). The input is a .hc22000 file exported from hcxpcapngtool, containing the handshake PMKID, MAC addresses, and ANonce/SNonce. Hashcat leverages GPU acceleration for PBKDF2-SHA1 computations. WPA2's strength lies entirely in password entropy — the protocol itself is computationally expensive to attack, but not infeasible for weak passwords.

GPU Password Cracking Speeds

WPA2 uses PBKDF2-HMAC-SHA1 with 4096 iterations to derive the PMK from the passphrase. This is intentionally slow — it is the main computational burden for both legitimate authentication and offline cracking. The following table shows verified single-GPU hash rates for WPA2 cracking (hashcat mode 22000):

Single-GPU WPA2 PBKDF2-SHA1 benchmark speeds. Actual performance varies by driver version, system RAM, and hashcat optimization. Multiple GPUs scale near-linearly.

Password Complexity vs Crack Time

Using the formula Time = (Character Set^Length) / Hash Rate, the following table shows crack times on an RTX 3070 (~750,000 H/s) — a common consumer GPU available for $300-500 used:

Crack times assume exhaustive search of the entire keyspace. Average time to crack is half the maximum. Green = impractical; Yellow = feasible with resources; Red = minutes to days.

RTX 4090 vs Older GPUs: Why Hardware Matters

The RTX 4090's 1.8M H/s is approximately 9x faster than a GTX 1060 (200,000 H/s) for WPA2 cracking. Here is how the same passwords perform across common GPUs:

Even the fastest consumer GPU cannot crack a 12-character random alphanumeric password in any practical timeframe. The limiting factor is password entropy, not GPU speed.

Why Numeric-Only Passwords Fail

An 8-digit numeric PIN (e.g., 38472651) has only 100 million combinations (10^8). On an RTX 3070, this takes approximately 2.2 minutes to exhaustively search. On a GTX 1080 (320,000 H/s), it takes 5.2 minutes. This is not a limitation of GPU technology — it is a fundamental property of the keyspace. Adding a single numeric digit to make a 9-digit PIN (10^9 = 1 billion combinations) increases crack time to 22 minutes on RTX 3070. A 10-digit numeric PIN (10^10) takes 3.7 hours. The math is exponential with digit count but linear with GPU speed — no GPU makes numeric passwords safe.

Real-world WiFi passwords are often numeric because users find them easier to dictate or share. Many ISPs default to 8-digit numeric PINs on provided hardware. This is a design choice that prioritizes convenience over security. The airodump-ng handshake capture + hashcat attack demonstrated in under 5 minutes shows why numeric-only passphrases are inadequate.

Why Mixed Alphanumeric Beats Everything Else

The keyspace of a password grows exponentially with its length but polynomially with its character set. Compare:

• 10 digit hexadecimal (16 characters): 16^10 = 1.1 trillion combinations = 17 days on RTX 3070
• 10 digit alphanumeric (62 characters): 62^10 = 83 quadrillion combinations = 3.2 years on RTX 3070
• 12 digit alphanumeric (62 characters): 62^12 = 3.2 quintillion combinations = 12,000 years on RTX 3070

Adding 4 characters (10 → 12) with the full alphanumeric set increases difficulty by a factor of 38 million. This dwarfs any GPU improvement. The RTX 4090 vs GTX 1060 is only a 9x speedup — but going from 10 to 12 alphanumeric characters is effectively a 38,000,000x increase in difficulty. This is why password length and character diversity matter far more than GPU resistance.

Practical recommendation: Use 12+ characters from the full ASCII printable character set (95 characters). A 12-character random alphanumeric (62^12) password is crackable in 12,000 years on a single RTX 3070 — not because the algorithm is weak, but because the keyspace is astronomically large. Even a GPU cluster would take centuries.

Hashcat Usage for WPA2 Cracking

# Capture handshake with hcxdumptool or airodump-ng
hcxdumptool -i wlan0 -o capture.pcapng --active=1 --enable_status=1

# Convert to hashcat format
hcxpcapngtool -o wpa2hash.hc22000 capture.pcapng

# Crack with dictionary attack (fast, effective against weak passwords)
hashcat -m 22000 -a 0 wpa2hash.hc22000 wordlist.txt

# Rule-based attack (mutate passwords from wordlist)
hashcat -m 22000 -a 0 wpa2hash.hc22000 rockyou.txt -j 'c T0$'

# Brute force 8-digit numeric only
hashcat -m 22000 -a 3 wpa2hash.hc22000 '?d?d?d?d?d?d?d?d'

# Hybrid: password + 2 digits (e.g., "password01" through "password99")
hashcat -m 22000 -a 6 wpa2hash.hc22000 wordlist.txt '?d?d'

# GPU performance check
hashcat -m 22000 -b

Hashcat's -b flag runs a built-in benchmark. Use --forceif your drivers require it. For WPA2, hashcat automatically applies the 4096-iteration PBKDF2. The GPU utilization depends on driver version, power limits, and temperature throttling. Use hashcat -d 1 --gpu-only to target a specific device.

Evil Twin Attacks

An evil twin attack creates a rogue access point that mimics a legitimate network's SSID and BSSID. The attacker uses hostapd-mana(a modified version of hostapd with karma/mana extensions) to broadcast a matching SSID. When a client's auto-connect feature selects the stronger evil twin signal, the attacker's AP becomes the man-in-the-middle. hostapd-manasupports WPA2-Personal, WPA2-Enterprise (with credential capture), and open networks. The tool can respond to any SSID probe request — a technique called "karma" — making it effective even against clients that do not auto-connect.

The deauthentication attack forces clients to disconnect from the legitimate AP and reconnect to the evil twin. The attacker injects 802.11 deauthentication frames (management frame subtype 0x0C) with the legitimate AP's BSSID as the source address. These frames are unauthenticated in WPA2 — the client cannot distinguish them from legitimate deauths. Tools like aireplay-ng --deauth 10 -a [AP_BSSID] -c [CLIENT_MAC] send targeted deauths, or mdk4 d wlan0 floods all clients on a channel. The client disconnects, scans for available APs, and associates with the evil twin. WPA3 mitigates this with protected management frames (PMF, 802.11w), which authenticate deauth frames — but many WPA3 networks still allow optional PMF for backward compatibility.

The captive portal attack extends evil twin by presenting a fake login page. After capturing the WPA2 handshake (for offline cracking), the attacker configures a captive portal (using create_ap, airgeddon, or a custom nginx/Flask server) that intercepts all HTTP traffic and redirects to a phishing page mimicking the WiFi provider — a hotel, airport, or corporate login. The user enters credentials, which the attacker harvests. This attack works against both open and WPA2 networks (after handshake capture). Detection requires checking the AP's BSSID against known MAC addresses, verifying certificate pinning on enterprise networks, and monitoring for unexpected captive portal redirects on previously open networks.

WPS Attacks

Wi-Fi Protected Setup (WPS) was designed to simplify WiFi configuration. It uses an 8-digit PIN (e.g., 12345678) stored in the AP's non-volatile memory. The PIN is validated in two halves: the first 4 digits are checked first, and if correct, the last 3 digits are checked (the 8th digit is a checksum). This splits the keyspace from 10⁸ (100 million) combinations to 10⁴ + 10³ = 11,000 combinations. Tools like Reaver and Bully automate the brute force by sending WPS M-series messages to the AP and measuring response times. A typical WPS PIN can be cracked in 2–5 hours on a single AP. The attack works regardless of the WPA2 passphrase length — WPS PIN bypasses WPA2 authentication entirely.

The Pixie Dust attack (2014, demonstrated by Dominique Bongard) exploits weak WPS implementations that generate predictable nonces. In the WPS Diffie-Hellman key exchange, the AP sends a public key (E-S1 and E-S2 values). If the AP uses a weak random number generator — common in Realtek, Ralink, and Broadcom chipsets — the E-S1 and E-S2 values can be predicted or brute-forced from the M1/M2 exchange. The attacker recovers the WPS private key in under 5 seconds without brute-forcing the PIN. The Pixie Dust attack is detected by observing rapid WPS authentication success — a legitimate PIN brute force takes hours, while Pixie Dust completes in seconds.

WPS should be disabled on all production networks. Most consumer routers expose a "Disable WPS" option in the admin interface, but some firmware continues to respond to WPS requests even when "disabled" — requiring firmware modification or VLAN isolation to fully mitigate. Enterprise networks should use 802.1X (WPA2/WPA3-Enterprise) with RADIUS authentication, eliminating PSK-based vulnerabilities entirely. For home users, disabling WPS and using a 12+ character random WPA2/WPA3 passphrase provides strong protection against all known offline attack methods.