OSWP PEN-210

Wireless Security Study Guide

Introduction

These techniques, commands, and procedures are intended solely for educational purposes and in preparation for the Offensive Security PEN-210 (OSWP) exam. They involve methodologies that can be illegal if misused.

These notes are consolidated from multiple sources and organized by attack flow from initial reconnaissance to advanced wireless attacks on WEP, WPA/WPA2, WPA3, and WPA2-Enterprise networks.

Disclaimer: All information provided here is intended for educational purposes only. Test these techniques only on networks and systems you own or have explicit permission to test. Unauthorized use may be illegal and punishable by law.

WiFi Hacking MindMap

1. Dependencies & Environment Setup

Bash script to install all the listed tools in this Notes:

Check your Kali (or Linux) version:

2. Basic Tools & Commands

Common Wi-Fi Utilities

airmon-ng Essentials

airodump-ng Essentials

aireplay-ng Essentials

aircrack-ng Essentials

Other Aircrack-NG Tools

  • airolib-ng: Manage PMK databases for WPA precomputation

  • airdecap-ng: Decrypt a WEP/WPA/WPA2 traffic capture offline

  • airgraph-ng: Generate relationship graphs (CAPR / CPG) from airodump CSV

3. Wireless Reconnaissance

Scanning & Channel Hopping

  1. Put interface into monitor mode:

  1. Scan with airodump-ng:

  1. Focus on a specific channel:

  1. Filter by handshake: Watch the top-right corner for “WPA handshake” or check with aircrack-ng capture.cap.

Hidden SSIDs

When a network does not broadcast its SSID, you can:

  1. Deauthenticate a client. When it reconnects, the ESSID will appear briefly in the capture.

  1. Brute force hidden SSIDs with a dictionary of possible names:

MAC Filtering & MAC Spoofing

If fake authentication fails repeatedly, the AP may be filtering MAC addresses. Use airodump-ng to identify a valid client MAC, wait until it goes offline, then spoof it:

4. Open & Captive Portal Attacks

  1. Connect to an Open Wi-Fi:

  1. MAC bypass: If there's a captive portal restricting MAC addresses, impersonate a MAC of an already-authenticated client:

  1. Phishing on captive portal: Tools like wifiphisher, Fluxion, or Airgeddon can create a rogue AP with a captive portal that harvests credentials.

5. WEP Attacks

WEP is deprecated but still tested on OSWP. These are the classic attacks:

ARP Replay Attack (Connected Clients)

  1. Monitor & capture:

  1. Fake authentication (optional, if open auth):

  1. ARP replay:

  1. Deauth (to trigger ARP generation):

  1. Crack once enough IVs collected:

Interactive Packet Replay

Fake Authentication

Useful for some WEP injection attacks that require association.

Deauthentication Attack on WEP

Forces WEP clients to reconnect, generating ARP packets (which you can replay).

Fragmentation Attack

Chop Chop Attack

Bypassing Shared Key Authentication

  1. Deauth a real client & capture the PRGA XOR.

  2. Fake auth using the XOR keystream:

  1. ARP replay to generate IVs:

  1. Crack with aircrack-ng once enough IVs are collected.

6. WPS Attacks

Identifying WPS Networks

Check the Lck column. If No, WPS might be brute-forced.

Online & Offline (Pixie Dust) Attacks

Bully is an alternative with similar options:

Null PIN & Known PIN Databases

Or use custom PIN lists (e.g., default WPS PINs for certain vendors).

7. WPA/WPA2 Attacks

Handshake Capture & Cracking

  1. Capture:

  • Verify handshake (top-right corner in airodump-ng or aircrack-ng <OUTFILE>.cap).

  • Crack with dictionary:

PMKID (Client-less Attack)

Cracking with aircrack-ng, hashcat, coWPAtty, Pyrit, John

8. WPA3 & SAE

Offline Brute Force

WPA3 uses SAE (Simultaneous Authentication of Equals) for handshake. If an AP is misconfigured or if it reverts to WPA2-PSK for older clients, you can still capture a handshake or a PMKID.

Offline SAE brute forcing can sometimes be done with tools like hcxdumptool + hashcat (mode 22000).

Downgrade Attacks

If a network supports both WPA2 and WPA3 (transition mode), you can force a downgrade by sending deauth or forging beacons that only advertise WPA2. The client might reconnect with WPA2-PSK, letting you capture a normal 4-way handshake to crack.

9. WPA2-Enterprise (MGT) Attacks

Basic Concepts

  • EAP: Framework used for authentication

  • RADIUS: Usually the backend server handling authentication

  • Common EAP methods: PEAP, EAP-TTLS, EAP-TLS, EAP-MSCHAPv2, EAP-GTC, etc.

  • EAP Identity: Often sent in plaintext (username@domain).

Capturing Usernames & Certificates

  1. Monitor MGT networks:

  1. Look for “Response, Identity” with Wireshark filter:

  1. Certificate capture:

or in Wireshark filter:

Evil Twin (Rogue AP) for WPA-Enterprise

Use hostapd-mana, eaphammer, or berate_ap to create a fake AP with the same SSID & EAP types.

(then hostapd-mana /etc/hostapd-mana/myconfig.conf)

Deauthenticate legit clients so they connect to the rogue AP:

EAP & MSCHAPv2 Cracking

When a client connects to your rogue AP using MSCHAPv2 (PEAP-MSCHAPv2, EAP-TTLS/MSCHAPv2), you capture the challenge/response:

or

Relay Attacks (wpa_sycophant)

wpa_sycophant can relay MSCHAPv2 from a victim (connected to your rogue AP) to the real AP, effectively allowing you to join the real network without cracking the password.

  1. Create rogue AP with --wpa-sycophant (in hostapd-mana or berate_ap).

  2. Run wpa_sycophant with a config pointing to the real ESSID.

  3. Deauth the target so it joins your rogue AP. Meanwhile, your wpa_sycophant tries connecting to the real AP with the victim’s credentials.

10. Rogue Access Points & Evil Twin

Open Rogue AP

Start a DHCP server (e.g., dnsmasq) so clients get IP addresses.

WPA/WPA2 Rogue AP

Then:

WPA2-Enterprise Rogue AP

Use hostapd-mana or eaphammer with --auth wpa-eap and the right TLS certs.

KARMA / MANA / Loud MANA / Known-Beacons

  • KARMA: Rogue AP responds to directed probe requests from clients for SSIDs in their PNL (Preferred Network List).

  • MANA: Enhanced version of KARMA.

  • Loud MANA: Sends beacons for all SSIDs discovered from clients or from a known wordlist.

  • Known-Beacons: Systematically broadcast beacons for a huge SSID list (like a dictionary) to lure devices that probe those names.

11. Captive Portals & Credential Harvesting

Tools like wifiphisher, Fluxion, Airgeddon can create a captive portal:

  1. Evil Twin or Karma/MANA AP

  2. dnsmasq for DHCP & DNS

  3. Apache or lighttpd to host the phishing page

  4. iptables or nftables to force HTTP traffic to the captive portal

Fluxion & Airgeddon automatically handle:

  • Launching fake AP

  • Deauthing victim

  • Captive portal that asks for WPA passphrase

  • Verification with the captured handshake

12. Miscellaneous Commands

PreviousA Red Teamer’s Guide to Wi-Fi ExploitsNextRed Teamer Gadgets

Last updated