Cybersecurity Presentation
WiFi Hacking
Attack Vectors, Tools & Defense
An in-depth analysis of wireless network vulnerabilities, exploitation methodologies, and modern defense strategies.
Presented By
>Malik Muhammad Arbaz
>Syed Saadullah Shah
>Muhammad Asif
Overview
Why WiFi Security Matters
Wireless networks are the most exposed attack surface in modern infrastructure.
0
% Of Attacks Are Wireless
0
Sec Avg Crack Time (WPA2)
Over 25% of all WiFi networks globally still use deprecated security protocols (WEP or open authentication), making them trivially exploitable within minutes.
Attack Vectors
Common Exploitation Methods
Attackers leverage protocol weaknesses, human error, and signal physics.
Deauthentication
Forges management frames to disconnect clients, forcing reconnection and 4-way handshake capture.
Evil Twin AP
Creates a rogue access point mimicking a legitimate SSID to intercept traffic and credentials.
Offline Cracking
Captures handshakes and runs dictionary or brute-force attacks using GPU-accelerated tools.
KRACK Attack
Exploits WPA2's 4-way handshake reuse to decrypt and inject packets without knowing the password.
Pixie Dust
Exploits weak PRNG in WPS PIN implementation to recover the PIN in seconds.
Rogue DHCP
Injects malicious DNS and gateway settings to redirect victims to phishing or MITM positions.
Toolset
Tools & Technologies
The standard offensive toolkit for wireless penetration testing.
-
Aircrack-ng Suite
Industry standard for monitor mode, packet injection, WEP/WPA cracking
-
Wireshark
Deep packet analysis, handshake inspection, protocol dissection
-
Hashcat
GPU-accelerated password recovery, rule-based and mask attacks
-
Wifite2
Automated multi-attack framework for mass WiFi auditing
-
Bettercap
MITM framework with WiFi probe request sniffing and AP spoofing
-
Kismet
Passive IDS, sensor-driven detection of hidden and rogue APs
-
Reaver / Bully
WPS brute-force with Pixie Dust and standard PIN attacks
-
Fluxion
Social engineering auto-captive portal for handshake verification
Protocols
Protocol Vulnerability Spectrum
Each WiFi security generation addressed previous flaws but introduced new ones.
WEP (1999): RC4 stream cipher with static IVs. Crackable in under 60 seconds with any modern tool. Completely deprecated.
WPA (2003): TKIP stopgap patch for WEP. Vulnerable to Beck-Tews attack allowing ARP injection in 12-15 minutes.
WPA2 (2004): AES-CCMP secure but KRACK (2017) breaks handshake nonce reuse. Dictionary attacks on weak PSKs.
WPA3 (2018): SAE handshake prevents offline attacks. But Dragonblood (2019) showed side-channel vulnerabilities in implementation.
Demonstration
Attack Workflow
Standard WPA2 handshake capture and offline cracking methodology.
1. Set Monitor Mode
Enable raw frame capture on wireless interface for packet injection capability.
2. Scan & Target
Identify target BSSID, channel, and encryption type via passive probe or active scan.
3. Deauth & Capture
Send deauthentication frames to force client reconnection, capturing the 4-way handshake.
4. Offline Crack
Run dictionary or rule-based attack against captured hash using GPU acceleration.
$ airmon-ng start wlan0
$ airodump-ng --band abg wlan0mon
$ airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
$ aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c 11:22:33:44:55:66 wlan0mon
$ hashcat -m 2500 capture.hccapx rockyou.txt
Next Generation
WPA3 Security Analysis
Simultaneous Concurrent Authentication of Equals replaces the flawed PSK handshake.
SAE Handshake
Dragonfly key exchange prevents offline dictionary attacks. Attacker must interact with the AP for each guess, rate-limiting by design.
Forward Secrecy
Each session derives unique encryption keys. Compromising a long-term password doesn't decrypt past captured traffic.
OWE (Opportunistic)
Unauthenticated encryption for open networks. Provides individualized encryption keys per client without password.
Dragonblood (CVEs)
Side-channel leaks in SAE's group commit/reveal allow downgrade, password partitioning, and reflection attacks on some implementations.
$ python3 dragonblood.py --interface wlan0mon --target BSSID
[+] Detected SAE handshake on target
[+] Measuring commit timing differential: 2.3ms (threshold: 1.0ms)
[!] Side-channel leakage detected — vulnerable implementation
Defense
Hardening Strategies
Layered defense to significantly reduce wireless attack surface.
-
Enforce WPA3-Enterprise
802.1X RADIUS authentication eliminates shared PSK weakness entirely
-
Strong Passphrase Policy
Minimum 20 characters, mixed case + symbols. Resists dictionary attacks for decades
-
Disable WPS
Eliminates Pixie Dust and brute-force PIN attack vectors completely
-
PMF (Mandatory)
Protected Management Frames block deauth and rogue AP injection
-
SSID Hidden + Random
Non-identifiable naming reduces targeted attacks, though not true security by obscurity
-
AP Isolation
Client-to-client blocking prevents lateral movement within the wireless segment
-
Wireless IDS/IPS
Kismet or commercial WIDS to detect deauth floods, evil twins, and rogue APs
-
Segment VLANs
Isolate IoT and guest networks from corporate infrastructure via VLAN segmentation
Ethics & Law
Legal Boundaries
Unauthorized access to computer networks is a criminal offense in virtually every jurisdiction.
U.S. Computer Fraud & Abuse Act (CFAA): Unauthorized access carries up to 10 years imprisonment for first offense, 20 for repeat offenses. Fines up to $250,000.
EU GDPR / NIS2: Network breaches involving personal data trigger mandatory 72-hour disclosure. Non-compliance fines reach 4% of global revenue.
Written Authorization Required: All penetration testing must have explicit, documented scope and permission from the network owner before any testing begins.
[1] Written authorization on file
[2] Scope defined (IPs, SSIDs, timeframe)
[3] NDA signed with client
[4] No data exfiltration permitted
[5] DoS attacks excluded from scope
[6] Findings reported, not exploited
[7] All captured data destroyed post-test
[8] When in doubt, STOP and ask
Findings
Key Findings
Summary of our controlled penetration testing results across target environments.
Critical Finding
39% of scanned networks used deprecated protocols (WEP/WPA) or had WPS enabled, allowing compromise in under 5 minutes.
High Finding
26% of WPA2 networks used weak PSKs (under 10 characters, dictionary words) crackable in under 30 minutes with a single GPU.
Medium Finding
15% of networks lacked PMF, making them susceptible to deauthentication attacks and potential KRACK exploitation.
Positive Finding
WPA3-SAE networks with strong passphrases showed zero successful compromises. No viable attack path exists with current public research.
End of Presentation
Questions &
Discussion
This research was conducted in a controlled lab environment with full authorization. All tools and methods discussed are for educational and defensive purposes only.
Do NOT attempt any of these techniques against networks you do not own or have explicit written permission to test.