# Hacking Wireless Networks

> Chapter 16 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/hacking-wireless-networks

**Official objective:** 8.1 — Understand wireless encryption standards, attack vectors, and tools used to compromise wireless networks.

## Introduction

Wireless encryption keeps your Wi-Fi data private even though it travels through open air that anyone can sniff. For the CEH exam, you must understand which standards are strong (WPA2, WPA3), which is broken (WEP), and how attackers capture handshakes to crack passwords.

## The Overhead-Projector Analogy

400 pages of confidential blueprints for a new skyscraper are locked inside a steel filing cabinet. To get a copy, a thief must either pick the lock (a hard, slow task) or persuade a security guard to let them walk out with the whole cabinet (social engineering).

Now imagine that instead of a cabinet, the architect stands in a meeting room and flashes each page onto a screen using an overhead projector. The thief, sitting in the audience, simply holds up a smartphone and photographs every page as it appears. They never touch the cabinet, never break a lock, and never speak to a guard. The architect sees a blur of light; the thief captures 400 pages in 30 minutes.

Wireless networks are exactly that overhead projector. Wired Ethernet (the filing cabinet) requires physical access to a cable or a switch port. Wi-Fi broadcasts data through the air using radio waves. Anyone within range—a car parked outside, a neighbour two floors up—can "see" that data if it isn't encrypted. Encryption (WPA2, WPA3) scrambles the pages so the photo is useless. But if the encryption is weak (WEP) or the password is guessed (brute-force or phishing), the thief decodes the photos just as easily. The core problem is that radio waves don't respect walls, locks, or security badges. The signal is literally public property; only the encryption keeps it private.

## Core explanation

A wireless network replaces the physical Ethernet cable with radio waves. Your laptop contains a wireless Network Interface Controller (NIC) that transmits and receives on specific radio frequencies—typically 2.4 GHz or 5 GHz. An Access Point (AP), also called a wireless router, acts as a central hub. The AP broadcasts its presence by sending out beacon frames (small packets of data that announce the network name, called the SSID (Service Set Identifier)). Your device scans these beacons, you select a network, and your device performs an association process to join.

Encryption is the mechanism that scrambles data so only authorised devices can read it. There are three main standards you must know for the exam:

- Wired Equivalent Privacy (WEP) — WEP was the first encryption standard for Wi-Fi, developed in 1999. It uses the RC4 stream cipher and a static key (a fixed password shared by all devices). WEP is fundamentally broken because the RC4 algorithm has a mathematical flaw: an attacker can capture enough data packets (around 20,000 to 50,000) to calculate the key using tools like Aircrack-ng. WEP also uses a small Initialization Vector (IV) of only 24 bits, which means the same IV repeats after a short time, allowing replay attacks. The CEH exam treats WEP as completely insecure—never use it.

- Wi-Fi Protected Access 2 (WPA2) — WPA2 replaced WPA in 2004 and is still the most common standard today. It uses AES-CCMP (Advanced Encryption Standard with Counter Mode Cipher Block Chaining Message Authentication Code Protocol). AES is a strong block cipher approved by the U.S. government. WPA2 can operate in two modes: Personal (WPA2-PSK) where a pre-shared key (the Wi-Fi password) is used, and Enterprise (WPA2-802.1X) which uses a separate authentication server (like RADIUS). The main vulnerability in WPA2-PSK is the 4-Way Handshake. When a device connects, it exchanges four packets with the AP that contain cryptographic material. An attacker can capture these packets (a process called "capturing the handshake") and then run offline brute-force or dictionary attacks against the password. The KRACK (Key Reinstallation Attack) vulnerability in 2017 exploited a flaw in the 4-Way Handshake itself, allowing attackers to decrypt traffic without knowing the password.

- Wi-Fi Protected Access 3 (WPA3) — WPA3 was introduced in 2018 to address WPA2's shortcomings. It uses Simultaneous Authentication of Equals (SAE), also known as the Dragonfly Key Exchange, which provides perfect forward secrecy—even if the password is later compromised, past traffic remains secure. WPA3 also replaces the 4-Way Handshake with a more robust authentication process that resists offline dictionary attacks. The exam considers WPA3 the current gold standard, though many consumer routers still default to WPA2.

Attackers also target wireless networks through deauthentication attacks. An attacker sends spoofed deauthentication frames (packets that tell a device to disconnect) to force a client to re-connect. When the client re-connects, the 4-Way Handshake is generated again, and the attacker captures it. This is the most common first step in WPA/WPA2 cracking.

Beyond encryption cracking, attackers use rogue access points—an evil twin—where they set up an AP with the same SSID as a legitimate network. Unsuspecting users connect to the rouge AP, and the attacker can monitor or modify all their traffic. This is a type of man-in-the-middle (MITM) attack. The tool Airbase-ng is commonly used to create these rogue APs.

Finally, the exam expects you to know the key wireless security tools: Aircrack-ng suite (airmon-ng to enable monitor mode on your NIC, airodump-ng to capture packets, aireplay-ng to inject packets and conduct deauthentication attacks, aircrack-ng to crack WEP and WPA2 keys), Kismet (a sniffer and intrusion detection system), Wireshark (for deep packet inspection), and Reaver (for brute-forcing WPS PINs on routers where Wi-Fi Protected Setup is enabled).

## Real-world context

An IT security consultant is hired to test the wireless network of a medium-sized retail company with 30 employees. The company uses WPA2-PSK with a single password printed on a sticker in the break room.

The consultant starts with reconnaissance. They use a laptop with a wireless NIC that supports monitor mode (many built-in NICs do not; a USB adapter like the Alfa AWUS036ACH is common). They boot a Linux distribution like Kali Linux, which has all the necessary tools pre-installed. The first command is `airmon-ng start wlan0` to enable monitor mode on the interface.

Next, they run `airodump-ng wlan0mon` to scan all nearby networks. They note the BSSID (the MAC address of the target AP), the channel it operates on, and the SSID. They then focus the capture on that single channel by specifying `airodump-ng -c 6 --bssid XX:XX:XX:XX:XX:XX -w capture wlan0mon`. The `-w capture` flags save all captured packets to files named "capture-01.cap", etc.

If no client is currently connecting, the consultant needs to force a connection to capture the handshake. They open a second terminal and run `aireplay-ng -0 10 -a XX:XX:XX:XX:XX:XX -c YY:YY:YY:YY:YY:YY wlan0mon`. The `-0` flag sends deauthentication packets; the `10` tells it to send ten packets; `-a` is the AP's BSSID; `-c` is the client's MAC address. The client disconnects and immediately reconnects, generating the 4-Way Handshake. Airodump-ng displays "WPA handshake: XX:XX:XX:XX:XX:XX" to confirm capture.

With the handshake captured, the consultant runs `aircrack-ng -w wordlist.txt capture-01.cap`, supplying a dictionary file of common passwords. If the password is "Summer2023!", aircrack-ng finds it quickly. The consultant then reports that the password is weak and recommends WPA3 with a 20-character random password, or migrating to WPA2-Enterprise with individual certificates.

In a more advanced test, the consultant might set up a rogue AP using `airbase-ng -e "CompanyWiFi" -c 6 wlan0mon` and then use a tool like `ettercap` to perform ARP spoofing on the dummy network, capturing login credentials from users who connect. This demonstrates the danger of evil twin attacks.

## Exam focus

The CEH (312-50) exam tests wireless network hacking in the Network Security domain. Expect 3–5 questions directly on this topic. The examiners love to test your ability to distinguish between encryption standards and their exact weaknesses.

Key exam concepts you must memorise:

- WEP uses RC4 and a 24-bit IV. It is cracked by capturing 20,000–50,000 packets. The tool is Aircrack-ng. Know that WEP is broken and should never be used.
- WPA2 uses AES-CCMP (or TKIP for backward compatibility; TKIP is also broken but less exam-famous). The attack vector is the 4-Way Handshake. The KRACK attack exploits the handshake itself.
- WPA3 uses SAE (Dragonfly Key Exchange). It resists offline dictionary attacks and provides perfect forward secrecy.
- Deauthentication attacks force clients to reconnect to capture the handshake. The command is `aireplay-ng -0`.
- Evil twin / rogue AP attacks use the same SSID as a legitimate network. The tool Airbase-ng or `hostapd` can set these up.
- WPS (Wi-Fi Protected Setup) has an 8-digit PIN that can be brute-forced in hours because the protocol validates halves of the PIN independently (check for Reaver and Pixie Dust attack).

Common exam traps:
- The exam might state that a network uses "WEP-128" and ask whether it is secure. WEP-128 still uses RC4 and is still broken—the key length does not fix the IV reuse flaw. The answer is always "no".
- A question might describe a deauthentication attack but call it "disassociation". Disassociation is a different frame type, but the attack concept is the same. Look for "force client to re-connect" to identify it.
- They might ask which tool is used to crack WPA2: (a) John the Ripper (for password hashes), (b) Hashcat (GPU-based cracking), (c) Aircrack-ng. Aircrack-ng is the correct answer for the wireless handshake, though Hashcat can also crack handshakes. The exam often expects Aircrack-ng.
- A scenario about a "rogue AP" might describe a user maliciously connecting to an unknown network—but the attack is the attacker setting up the AP, not the victim connecting. Read carefully.
- They love to test that WPA2-Enterprise uses 802.1X and RADIUS, whereas WPA2-Personal uses PSK.

For specific attack chains, remember: (1) Enable monitor mode (airmon-ng), (2) Scan (airodump-ng), (3) Deauth (aireplay-ng -0), (4) Capture handshake, (5) Crack (aircrack-ng or hashcat). This sequence appears in multiple choice format, often asking "what is the next step?"

## Step by step

1. **Enable Monitor Mode** — Use the command `airmon-ng start wlan0` on a Linux system (Kali) to switch your wireless NIC from managed mode (normal client) to monitor mode. Monitor mode allows the NIC to capture all packets on a channel without associating to a network—essential for sniffing Wi-Fi traffic.
2. **Scan for Target Network** — Run `airodump-ng wlan0mon` to display all visible access points and clients. Identify your target by BSSID (MAC address) and channel. Record these details. Focus the scan on that channel to reduce noise and capture relevant packets.
3. **Capture the 4-Way Handshake** — Run `airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon`. If no client is connected, use `aireplay-ng -0 10 -a [BSSID] wlan0mon` to send deauthentication frames, forcing a client to disconnect and reconnect. The handshake will appear in the airodump output as "WPA handshake: [BSSID]".
4. **Crack the Password** — Run `aircrack-ng -w /path/to/wordlist.txt capture-01.cap`. The tool compares each password in the wordlist against the handshake. If the password is in the list, it is displayed. For complex passwords, use hashcat with GPU acceleration.
5. **Launch a Rogue AP Attack (Optional)** — Use `airbase-ng -e "TargetSSID" -c [channel] wlan0mon` to create an evil twin AP. Then use a tool like `ettercap` or `dnsmasq` to serve fake DHCP and DNS, redirecting traffic to capture login credentials or inject malicious payloads.

## Comparisons

### WEP vs WPA2

**WEP:**
- Uses RC4 stream cipher
- 24-bit Initialization Vector
- Cracked by capturing 20k-50k packets

**WPA2:**
- Uses AES-CCMP block cipher
- 128-bit block, 4-Way Handshake
- Cracked by offline dictionary attack on handshake

### WPA2-Personal vs WPA2-Enterprise

**WPA2-Personal:**
- Single pre-shared key (PSK)
- No authentication server
- Vulnerable to offline dictionary attack on PSK

**WPA2-Enterprise:**
- 802.1X with RADIUS server
- Unique credentials per user
- Resists offline attacks; vulnerable to rogue RADIUS

### Deauthentication Attack vs Disassociation Attack

**Deauthentication Attack:**
- Sends spoofed deauth frames from AP to client
- Forces client to disconnect and reconnect
- Used to capture WPA handshake

**Disassociation Attack:**
- Sends spoofed disassociation frames
- Also disconnects client but from a different management frame type
- Less common in exam; both achieve same goal

### Aircrack-ng vs Hashcat

**Aircrack-ng:**
- CPU-based password cracking
- Works directly on .cap files
- Slower for large wordlists

**Hashcat:**
- GPU-based (faster)
- Requires converting .cap to .hccapx format
- Handles complex hash modes and large dictionaries

## Diagram

_The typical step-by-step process an attacker follows to compromise a WPA2-PSK wireless network._

```mermaid
flowchart TD
    A[Attacker Laptop with Kali Linux] --> B[Enable Monitor Mode (airmon-ng)]
    B --> C[Scan Networks (airodump-ng)]
    C --> D[Select Target AP (BSSID + Channel)]
    D --> E[Capture 4-Way Handshake or Deauth Client (aireplay-ng -0)]
    E --> F[Crack Password (aircrack-ng / hashcat)]
    F --> G[Access Network / Perform MITM]
    G --> H[Evil Twin (airbase-ng) or ARP Spoofing]
```

## Common misconceptions

- **Misconception:** WPA2 is completely secure because it uses AES encryption. **Reality:** WPA2-PSK is vulnerable to offline dictionary attacks on the captured 4-Way Handshake. The AES encryption itself is strong, but the pre-shared key (password) can be guessed if weak. (People confuse the strength of the encryption algorithm with the strength of the authentication mechanism. The exam tests that you know the vulnerability is in the handshake, not in AES.)
- **Misconception:** If a Wi-Fi network has a password, it is encrypted and safe from eavesdropping. **Reality:** A password does not encrypt data unless the protocol is WPA2 or WPA3. Open networks (no password) send data in plaintext. Even with a password, if the encryption is WEP, an attacker can crack it easily. (Many beginners equate 'password' with 'encryption'. The exam distinguishes between authentication (password) and encryption (protocol).)
- **Misconception:** A deauthentication attack permanently disconnects a device from the network. **Reality:** A deauthentication attack only forces a client to disconnect temporarily. The client typically reconnects immediately, generating the handshake the attacker needs. It does not damage the device or permanently block access. (The word 'deauthentication' sounds permanent and destructive. The exam tests that you understand it is a short-term manipulation to force reconnection.)
- **Misconception:** WPA3 is completely immune to all attacks. **Reality:** WPA3 resists offline dictionary attacks and provides forward secrecy, but it is not immune to everything. For example, downgrade attacks can force clients to use WPA2 instead, and side-channel attacks on Dragonfly implementations have been demonstrated. (Beginners want a 'perfect' solution. The exam wants you to recognise that WPA3 is the strongest option but still a target for downgrade and implementation flaws.)
- **Misconception:** Only advanced hackers can crack WPA2 passwords; it requires expensive equipment. **Reality:** Any laptop with a compatible wireless NIC and free tools (Aircrack-ng, Kali Linux) can capture and crack a WPA2 handshake if the password is weak. A dictionary file with common passwords is freely available online. (The difficulty of cracking is exaggerated in pop culture. The exam tests that the tools are accessible and the process is straightforward.)

## Key takeaways

- WEP uses RC4 with a 24-bit IV and is broken after capturing 20,000–50,000 packets.
- WPA2-PSK uses a 4-Way Handshake that can be captured via a deauthentication attack and cracked offline.
- WPA3-SAE uses Simultaneous Authentication of Equals to resist offline dictionary attacks and provide perfect forward secrecy.
- The typical attack chain is: enable monitor mode (airmon-ng), scan (airodump-ng), deauthenticate (aireplay-ng -0), capture handshake, crack (aircrack-ng or hashcat).
- An evil twin attack uses a rogue access point with the same SSID to perform a man-in-the-middle attack.
- Wi-Fi Protected Setup (WPS) with an 8-digit PIN can be brute-forced because the protocol validates halves of the PIN separately.
- WPA2-Enterprise uses 802.1X and a RADIUS server; WPA2-Personal uses a pre-shared key.
- KRACK (Key Reinstallation Attack) exploits the 4-Way Handshake in WPA2 to decrypt traffic without knowing the password.

## FAQ

**What is the difference between WPA2-Personal and WPA2-Enterprise?**

WPA2-Personal uses a single pre-shared key (password) for all users. WPA2-Enterprise uses 802.1X authentication with a RADIUS server, giving each user a unique credential (often a certificate) and better security.

**Can WPA3 be cracked the same way as WPA2?**

No. WPA3 uses SAE, which prevents offline dictionary attacks by requiring real-time interaction with the AP for each password guess. However, downgrade attacks and side-channel attacks are possible in some implementations.

**What is a deauthentication attack used for?**

It forces a client to disconnect from an AP, usually to capture the 4-Way Handshake when the client reconnects. It is a first step in cracking WPA2-PSK passwords.

**What is an evil twin attack?**

An attacker sets up a rogue access point broadcasting the same SSID as a legitimate network. Users connect to it thinking it is real, allowing the attacker to intercept or modify their traffic (man-in-the-middle).

**How long does it take to crack WPA2?**

It depends on password complexity. A weak password like "password123" might be cracked in seconds using a wordlist. A strong 20-character random password could take centuries with current hardware.

**What is KRACK?**

Key Reinstallation Attack is a vulnerability in the WPA2 4-Way Handshake that allows an attacker to decrypt traffic by forcing reuse of nonces and session keys. It affected all WPA2 networks but can be patched.

## Check your understanding

1. **Which encryption standard uses a 24-bit Initialization Vector and is considered completely broken?**

   Answer: WEP (Wired Equivalent Privacy). It uses RC4 with a 24-bit IV and can be cracked after capturing 20,000 to 50,000 packets.

2. **What is the first command an attacker runs in Kali Linux to enable wireless packet capture?**

   Answer: `airmon-ng start wlan0` switches the wireless interface to monitor mode, allowing it to capture all Wi-Fi packets on a channel.

3. **What is the purpose of a deauthentication attack in the context of cracking WPA2?**

   Answer: To force a client to disconnect and reconnect, generating the 4-Way Handshake that can be captured and cracked offline.

4. **What is the main security improvement of WPA3 over WPA2?**

   Answer: WPA3 uses Simultaneous Authentication of Equals (SAE), which provides perfect forward secrecy and prevents offline dictionary attacks.

5. **What is an evil twin attack?**

   Answer: An attacker sets up a rogue access point with the same SSID as a legitimate network to perform a man-in-the-middle attack on connecting users.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/hacking-wireless-networks