Listen to this Post
Introduction:
In the ever-evolving landscape of cybersecurity, wireless networks remain one of the most accessible yet vulnerable entry points for attackers. Understanding the mechanics of WiFi security—from legacy WEP protocols to modern WPA2—is fundamental for any penetration tester or security enthusiast. This article breaks down the core concepts of WiFi hacking, inspired by the TryHackMe “WiFi Hacking 101” room, providing a technical roadmap for capturing and cracking handshakes using the aircrack-ng suite.
Learning Objectives:
- Differentiate between BSSID, SSID, and ESSID in wireless networking.
- Analyze the vulnerabilities of WEP, WPA, and WPA2 security protocols.
- Understand the technical details of the 4-Way Handshake and PTK generation.
- Execute a practical WiFi password cracking attack using aircrack-ng tools.
- Identify the differences between WPA2-PSK and WPA2-EAP with RADIUS servers.
You Should Know:
1. Deconstructing the Network: BSSID, SSID, and ESSID
Before attacking a network, you must understand its anatomy. These three identifiers are the foundation of wireless communication.
– SSID (Service Set Identifier): This is the “friendly” name of the network you see when scanning for WiFi (e.g., “Starbucks WiFi”). It is simply a label to distinguish one network from another.
– BSSID (Basic Service Set Identifier): This is the MAC (Media Access Control) address of the wireless access point (router). It is a unique, hardware-level identifier for the specific device broadcasting the signal.
– ESSID (Extended Service Set Identifier): This refers to a network name shared by multiple access points in a large-scale network (like a campus or enterprise). While the SSID remains the same, each access point will have its own unique BSSID.
Linux Command to view these:
List all visible WiFi networks and their details sudo iw dev wlan0 scan | egrep "SSID|BSSID"
Note: Replace `wlan0` with your wireless interface name.
- The Evolution of WiFi Security: From WEP to WPA2
Understanding the history of encryption helps explain why certain attacks work.
– WEP (Wired Equivalent Privacy): Uses the RC4 stream cipher and a static key. Its fatal flaw is the reuse of Initialization Vectors (IVs). Because IVs are short and transmitted in plaintext, they eventually repeat, allowing an attacker to collect enough encrypted packets to statistically derive the key.
– WPA (Wi-Fi Protected Access) / WPA2: Introduced TKIP (Temporal Key Integrity Protocol) and later CCMP (AES). WPA2 operates in two main modes:
– WPA2-PSK (Pre-Shared Key): Designed for home users. All clients use a single passphrase (the WiFi password) to connect.
– WPA2-EAP (Extensible Authentication Protocol): Designed for enterprises. It requires a RADIUS Server for centralized authentication. Users have individual credentials, making the network more secure but complex to manage.
3. The 4-Way Handshake and PTK
The cornerstone of WPA2 security is the 4-Way Handshake. This occurs when a client connects to the network. It verifies that the client knows the password without ever sending the password itself over the air.
1. The Process: The Access Point (AP) and the client use the Pre-Shared Key (derived from the password), the SSID, and random numbers (nonces) exchanged during the handshake to generate a PTK (Pairwise Transient Key) . This PTK is used to encrypt all subsequent traffic.
2. The Vulnerability: If an attacker captures this handshake, they have the nonces and the encrypted data. They cannot derive the PTK without the original password, but they can take the captured handshake file and attempt to brute-force the password locally (offline).
How to Capture the Handshake (Using aircrack-ng):
1. Put card in monitor mode sudo airmon-ng start wlan0 <ol> <li>Find the target BSSID and channel sudo airodump-ng wlan0mon</p></li> <li><p>Focus on the target channel and write output to a file sudo airodump-ng -c [bash] --bssid [bash] -w capture wlan0mon</p></li> <li><p>(Optional) Force a reconnect to capture the handshake faster by de-authenticating a client sudo aireplay-ng -0 2 -a [bash] -c [bash] wlan0mon
4. Cracking the Password with Aircrack-ng
Once you have the `.cap` file containing the 4-Way Handshake, the real work begins. The `aircrack-ng` tool tests potential passwords from a wordlist against the handshake.
– How it works: It takes a word from the list, combines it with the SSID and captured nonces to mathematically generate a candidate PTK. If this candidate key successfully decrypts a piece of the captured handshake data, the password is correct.
Linux Command:
Cracking the capture file with a wordlist aircrack-ng -w /path/to/wordlist.txt -b [bash] capture-01.cap
Note: The success of this step relies entirely on the quality of your wordlist (e.g., rockyou.txt).
5. WPA2-EAP and the RADIUS Factor
In an enterprise environment, the handshake is different because the authentication is brokered by a RADIUS Server. The client never talks directly to the AP for authentication; instead, the AP acts as a middleman to the RADIUS server.
– Security Implication: Attacking WPA2-EAP usually involves setting up a rogue access point with the same SSID to trick the client into authenticating with you (the attacker) instead of the real RADIUS server, capturing the hashed credentials in the process.
6. Securing Your Network Against These Attacks
Understanding the attack is the first step to defense.
– Disable WEP/WPS: Ensure your router uses WPA2-AES (or WPA3 if available). WPS (Wi-Fi Protected Setup) is a major backdoor that can be brute-forced in hours.
– Strong Passphrases: Since PSK cracking relies on wordlists, use a long, complex password (20+ characters) that is not a dictionary word.
– MAC Filtering: While not a primary defense (MACs can be spoofed), it adds an extra layer of friction for script kiddies.
– Enterprise Networks: Use WPA2-EAP with strong certificates and ensure your RADIUS server is patched and configured to reject weak authentication methods.
What Undercode Say:
- Key Takeaway 1: WiFi security is a mathematical arms race. WPA2 is secure only if the passphrase is strong. The protocol itself is robust, but the human-chosen key is the weakest link, making dictionary attacks the primary threat.
- Key Takeaway 2: The “4-Way Handshake” is not a vulnerability; it is a necessary process. The vulnerability lies in the ability to capture it and attack it offline. Network administrators should monitor for de-authentication floods (using
aireplay-ng) as a primary indicator of an attempted handshake capture.
Analysis: The transition from WEP to WPA2 solved the issue of IV reuse and static keys, but introduced a dependency on cryptographic nonces and dictionary-resistant passwords. The tools discussed (aircrack-ng) have remained relevant for nearly two decades because the fundamental flaw they exploit—weak user passwords—remains unpatched. For defenders, this means that technical controls must be supplemented by strict password policies and intrusion detection systems that monitor for the tell-tale signs of packet injection and de-auth attacks. The real lesson from the “WiFi Hacking 101” room is that visibility into layer 2 (the data link layer) is just as critical as monitoring higher-level traffic.
Prediction:
As WPA3 becomes ubiquitous, we will see a shift in WiFi hacking away from the 4-Way Handshake. WPA3 introduces Simultaneous Authentication of Equals (SAE), which is resistant to offline dictionary attacks. However, the transition period will be messy; attackers will likely target the “downgrade attack,” forcing clients and APs to negotiate back to WPA2 to exploit the older handshake. Furthermore, the rise of IoT devices on guest networks will continue to provide lateral movement opportunities even if the primary WiFi key remains uncracked.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Abdel Rahman – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
