WiFi Hacking Guide

WiFi hacking is testing wireless networks for weaknesses, most commonly by capturing the authentication handshake and cracking a weak password offline, or by tricking users onto a fake access point. WPA3 closed several old attacks, but weak passwords remain the constant vulnerability. Only ever test networks you own or are authorised to.

How WiFi security evolved

The classic WPA2 attack

The standard approach captures the four way handshake that happens when a device connects, then cracks the password offline against a wordlist. The network is never brute forced live; the crack happens on your own machine, which is what makes it practical.

1. Put the wireless card in monitor mode
2. Capture the handshake, optionally forcing a reconnection
3. Crack the captured handshake offline against a wordlist

The whole attack succeeds or fails on password strength. A long random passphrase does not crack; a dictionary word does, fast. Same principle as Kerberoasting, offline cracking of captured material.

Evil twin attacks

Instead of cracking, the attacker creates a fake access point mimicking a real one. Users connect and their traffic, or their credentials via a fake login page, is captured. This targets people, not encryption, which is why it still works even against strong passwords.

What WPA3 changed

WPA3 introduced protections that make offline handshake cracking far harder and add forward secrecy. It is not perfect, but it closes the most common WPA2 attack. The lingering weakness across all versions is human chosen passwords.

How to secure a network

• Use WPA3 where supported, WPA2 with a long random passphrase otherwise
• A passphrase long enough to resist offline cracking
• A separate guest network
• Disable WPS
• Monitor for rogue access points

Practise this

Build your own test network with cheap hardware and attack that, never anyone else's. Wireless is one part of the broader offensive skill set in the VAPT syllabus.