armourinfosec/Wireless-Security-and-WiFi-Penetrati: wireless Security & WiFi Penetration Testing

A one-month, lab-driven curriculum that takes a learner from wireless fundamentals to enterprise Wi-Fi penetration testing — 802.11 standards and encryption, monitor-mode capture, reconnaissance and traffic analysis, WEP/WPA/WPA2 cracking, WPA3 and TKIP attacks, rogue access points and wireless MITM, and enterprise (EAP/RADIUS) assessment with professional reporting.

Curriculum home: Vault Catalog

Course Information

[!NOTE] What this course is A study-and-practice track built as an Obsidian knowledge base. Each module is a folder with its own Readme hub and a set of single-topic notes containing tagged, copy-ready command snippets. It is designed to be read in order but is fully cross-linked for reference use.

Course Description

Master wireless security testing and Wi-Fi penetration testing end to end: 802.11 standards and frame types, encryption and authentication (WEP, WPA/TKIP, WPA2/CCMP, WPA3), adapter setup for monitor mode and packet injection, reconnaissance and traffic analysis, security-control bypass, denial-of-service, WEP cracking, Chop-Chop and packet-replay attacks, the Caffe Latte client-side attack, WPA/WPA2 handshake and PMKID cracking, Cowpatty and precomputed-table attacks, advanced WPA-TKIP and WPA3 (KRACK/Dragonblood) attacks, rogue access points and wireless MITM — then apply those skills to enterprise WPA (EAP/RADIUS) assessment, wireless hardening, and penetration-test reporting.

The program is delivered through reproducible, hands-on labs against equipment you own and control, so every technique is paired with a working capture, attack, or configuration you can build, break, and defend.

[!WARNING] Authorized testing only Every technique here is documented for education, detection, and defense. Wireless attacks — deauthentication, jamming, rogue access points, handshake capture, and key cracking — are illegal against networks you do not own or lack explicit written permission to assess. Practice only in your own isolated RF lab, a CTF, or a sanctioned engagement.

Overview

The Wireless Security & WiFi Penetration Testing program provides practical, assessment-ready skills across wireless reconnaissance, attack, and defense. It is designed for ethical hackers, penetration testers, red-team operators, and wireless security analysts, and progresses from 802.11 fundamentals to advanced enterprise attacks.

By the end of the course, students will be able to:

• Configure wireless adapters for monitor mode and packet injection
• Discover hidden SSIDs and enumerate wireless infrastructure
• Perform wireless DoS and deauthentication attacks
• Crack WEP encryption using multiple attack techniques
• Capture and crack WPA/WPA2 handshakes and PMKIDs
• Deploy evil-twin and rogue access-point attacks
• Conduct wireless Man-in-the-Middle attacks
• Perform advanced WPA/TKIP and WPA3 exploitation
• Assess enterprise WPA (EAP/RADIUS) deployments
• Provide wireless hardening and remediation recommendations

[!TIP] Offense and defense are taught together Every attack module pairs the exploit with its detection and mitigation — deauth floods with 802.11w/management-frame protection, rogue APs with WIDS, weak PSKs with policy — so the skills transfer directly to defending the same networks.

Learning Path

The 14 modules are sequenced into four progressive phases. Complete each phase before advancing; later attack and enterprise modules assume the fundamentals and a capture-capable lab from earlier phases.

Phase 1  Fundamentals ....... Wireless Networks · Encryption & Authentication · Adapters
Phase 2  Recon & Bypass ..... Security Measures & Bypass · Reconnaissance & Traffic Analysis
Phase 3  Attacks ............ DoS · MITM/Rogue APs · WEP · Chop-Chop · Caffe Latte
                              WPA/WPA2 · Cowpatty · Advanced WPA-TKIP/WPA3
Phase 4  Enterprise ......... Enterprise WPA (EAP/RADIUS) · Hardening · Reporting

flowchart LR
    A[Phase 1<br/>Fundamentals] --> B[Phase 2<br/>Recon & Bypass]
    B --> C[Phase 3<br/>Attacks]
    C --> D[Phase 4<br/>Enterprise & Reporting]

[!IMPORTANT] Prerequisite chaining The attack phases assume a capture-capable lab from Phase 1 and the discovery skills from Phase 2. Attempting a WPA/WPA2 handshake crack or an evil-twin attack without a monitor-mode, injection-capable adapter and clean reconnaissance will fail in ways that are hard to diagnose — complete each phase before advancing.

Prerequisites

[!TIP] No wireless background needed Phase 1 assumes no prior 802.11 knowledge. If you already run wireless assessments, you can skim the fundamentals and start at Reconnaissance & Bypass.

Software Requirements

All tooling runs on Kali Linux, which ships most of these packages preinstalled; the rest are a single apt install away. The core of wireless testing is the aircrack-ng suite, complemented by capture, cracking, and rogue-AP utilities.

[!WARNING] Injection and RF transmission are regulated Monitor mode, packet injection, and running your own access point transmit on licensed spectrum. Use a lawful regulatory domain (iw reg set), keep power low, and transmit only in an isolated lab — do not radiate onto neighbouring networks.

Hardware Requirements

A dedicated, injection-capable wireless adapter is the single most important piece of kit for this course — the onboard Wi-Fi on most laptops cannot enter monitor mode or inject packets reliably.

[!IMPORTANT] Chipset — not brand — decides injection Atheros (AR9271) and Ralink (RT3070/RT5372) chipsets are the safe choices. Confirm the card enters RFMON with sudo airmon-ng start wlan0 and passes sudo aireplay-ng --test wlan0mon before starting the attack modules. Note the TL-WN722N caveat: only the v1 revision carries the injection-capable Atheros chipset.

Virtualization Requirements

Kali can run bare-metal or virtualized. The one hard requirement in a VM is exposing the USB Wi-Fi adapter to the guest — the hypervisor's virtual NIC cannot enter monitor mode.

[!TIP] Prefer bare-metal for timing-sensitive attacks USB passthrough works for most capture and cracking labs, but injection-timing attacks (Chop-Chop, fragmentation, active WEP) are more reliable on bare-metal Kali. If an injection test intermittently fails in a VM, retry on bare-metal before debugging the attack.

Lab Environment

A reference topology used across the attack modules:

                 ┌────────────────────────────┐
                 │   Kali Linux (attacker)    │
                 │  injection-capable adapter │
                 │   wlan0 → wlan0mon (RFMON)  │
                 └───────────────┬──────────��─┘
                                 │  802.11 (monitor / injection)
          ┌──────────────────────┼──────────────────────┐
          │                      │                       │
   ┌────────────┐        ┌───────────────┐       ┌────────────────┐
   │ Target AP  │        │  Enterprise   │       │  Rogue / Evil  │
   │ WEP·WPA·   │        │  AP + RADIUS  │       │  Twin AP       │
   │ WPA2 PSK   │        │ (hostapd +    │       │ (hostapd +     │
   │            │        │  FreeRADIUS)  │       │  dnsmasq)      │
   └──────┬─────┘        └───────┬───────┘       └───────┬────────┘
          │                      │                       │
   ┌────────────┐         ┌────────────┐          ┌────────────┐
   │  Client    │         │  802.1X    │          │  Victim    │
   │  STA       │         │  supplicant│          │  client    │
   └────────────┘         └──���─────────┘          └────────────┘

[!NOTE] Isolate the RF lab Deauthentication, beacon floods, and rogue APs disrupt any real device in range and leak beyond your walls. Test on your own hardware in an isolated/low-power RF environment — never on a shared or production SSID.

Course Modules

The 14 teaching modules are grouped into four progressive phases. Each links to the module's own Readme hub, which in turn links out to its single-topic notes. Follow them in order — see the Learning Path for how the phases build on one another.

Phase 1 — Fundamentals

Phase 2 — Reconnaissance & Bypass

Phase 3 — Attacks

[!WARNING] The attack modules assume a lab you own and control. Run deauthentication, jamming, and rogue-AP attacks only against your own equipment in an isolated RF environment — never against third-party networks.

Phase 4 — Enterprise & Reporting

Learning Outcomes

On completion, a student can:

Certification Mapping

This course's content aligns with the objectives of the major wireless-security certifications. It is exam-relevant preparation, not a guarantee of passing.

[!TIP] Best-fit exam The hands-on attack depth here maps most directly to OSWP — reconnaissance, WEP/WPA/WPA2 cracking, WPS, and rogue-AP attacks are covered end to end. The encryption, EAP/RADIUS, and WIDS material additionally supports CWSP revision.

References

• IEEE 802.11 Wireless LAN Standard — https://standards.ieee.org/ieee/802.11/7028/
• Wi-Fi Alliance — WPA3 Specification — https://www.wi-fi.org/discover-wi-fi/security
• aircrack-ng Documentation — https://www.aircrack-ng.org/documentation.html
• hashcat Wiki — https://hashcat.net/wiki/
• Kismet Documentation — https://www.kismetwireless.net/docs/
• Wireshark 802.11 Wiki — https://wiki.wireshark.org/Wi-Fi
• KRACK Attacks (Key Reinstallation Attacks) — https://www.krackattacks.com/
• Dragonblood — WPA3 Vulnerabilities — https://wpa3.mathyvanhoef.com/
• Wi-Fi Alliance Security Whitepapers — https://www.wi-fi.org/security

Related Courses

Sibling courses in this vault that pair well with wireless penetration testing:

• Certified Ethical Hacking and Penetration Testing — the broader offensive methodology this course specializes.
• Network Sniffing — packet capture and traffic analysis beyond 802.11.
• Password Cracking — hashcat/John workflows applied to WPA/WPA2 hashes.
• Social Engineering — the human layer behind evil-twin and captive-portal attacks.

See also the vault hub Wireless Security & WiFi Penetration Testing and the full curriculum catalog.

Contribution

Contributions that improve accuracy, add labs, or deepen module notes are welcome.

[!WARNING] All techniques are documented for authorized testing and education only. Test only against equipment and networks you own or have explicit written permission to assess.