Master WiFi Penetration Testing: 14‑Module Roadmap to 802.11 Security

1. Repository Overview

The GitHub repository Wireless-Security-and-WiFi-Penetration-Testing is maintained by the ArmourInfoSec team and uses an Obsidian knowledge‑base format. Each of the 14 modules is a folder containing a README navigation file and multiple topic notes, each with ready‑to‑copy command snippets and lab instructions. The repo is released under the CC BY 4.0 license and targets readers with a basic networking security background, offering a roughly 30‑hour, four‑week self‑study path.

The curriculum is built around Kali Linux and centers on the aircrack‑ng suite, complemented by hashcat, hcxdumptool, reaver, kismet, bettercap, hostapd, and other tools to cover the full penetration‑testing workflow from reconnaissance to exploitation.

2. Four‑Stage Learning Path

Stage 1: Fundamentals – Three modules introduce wireless networking basics (802.11 standards, frame types, frequency bands, and channels), encryption and authentication protocols (WEP, WPA/TKIP, WPA2/CCMP, WPA3, and the four‑handshake process), and wireless adapter configuration (external NIC selection, monitor mode, packet injection). The content assumes no prior 802.11 knowledge.

Stage 2: Reconnaissance and Bypass – Covers hidden SSID discovery, MAC‑filter bypass, AP identification, and the use of airodump‑ng, Kismet, and Bettercap for wireless scouting and traffic analysis. Wireshark and tcpdump are employed to dissect 802.11 frame structures.

Stage 3: Attack Techniques – The core stage details all mainstream wireless attacks: denial‑of‑service (deauthentication flood, RF interference, CSMA/CA jamming, beacon flooding), man‑in‑the‑middle and evil‑twin attacks (airbase‑ng/hostapd configuration, malicious portal creation, credential harvesting), WEP cracking (IV collection, ARP replay, fragmentation, keystream reuse, Chop‑Chop, packet replay, Coffee‑Latte attack), WPA/WPA2 cracking (WPS Pixie‑Dust, Reaver/Bully brute‑force, handshake capture, dictionary attacks, PMKID capture with Cowpatty and rainbow tables), and enterprise‑grade attacks (Beck‑Tews, Michael reset, KRACK, Dragonblood).

Stage 4: Enterprise Wi‑Fi Security and Reporting – Teaches assessment of WPA/EAP‑RADIUS deployments, building a FreeRADIUS test environment, understanding wireless IDS (WIDS) operation, and producing professional penetration‑testing reports.

3. Core Toolchain Details

aircrack‑ng suite – The central toolkit, including airodump‑ng (passive capture), aireplay‑ng (packet injection/replay), and airbase‑ng (malicious AP creation). It underpins WEP and WPA/WPA2 cracking.

hashcat – GPU‑accelerated password cracking for WPA/WPA2 handshakes and PMKID hashes, enabling high‑speed dictionary and brute‑force attacks.

hcxdumptool and hcxtools – Specialized for PMKID capture; they simplify the process compared with traditional four‑handshake capture, requiring only a single probe request.

reaver and bully – Used for WPS PIN brute‑force; the Pixie‑Dust technique quickly exploits WPS weaknesses.

kismet – A powerful wireless IDS that can passively discover hidden networks and detect malicious APs.

hostapd, dnsmasq, wifipumpkin3, wifiphisher – Combined to build evil‑twin environments, perform DNS hijacking, and host malicious captive portals.

4. Hardware Requirements

Injection capability is the critical metric. The guide recommends NICs with Atheros AR9271 or Ralink RT3070/RT5372 chipsets because they natively support monitor mode and packet injection. It warns that only the v1 version of the TP‑Link WN722N contains the required Atheros chip; later revisions do not.

Experimental setup consists of three parts: a Kali Linux attack host (physical machine or VM with USB passthrough for the external NIC), a test wireless router supporting WEP/WPA/WPA2 (e.g., TP‑Link EAP110), and at least one client device (phone or laptop) to generate handshake traffic.

Physical machine preferred – While VM + USB passthrough works for most labs, timing‑sensitive injection attacks (e.g., Chop‑Chop, fragmentation) can be unstable on virtualized hardware; a bare‑metal host offers more reliable results.

5. Certification Alignment

The material aligns closely with major wireless security certifications. OSWP (Offensive Security Wireless Professional) matches best, covering reconnaissance, WEP/WPA/WPA2 cracking, WPS, malicious APs, and PMKID attacks. CWSP (Certified Wireless Security Professional) has moderate overlap, focusing on 802.11 mechanisms, EAP/RADIUS, WIDS, and malicious AP detection, but emphasizes vendor‑neutral design. CEH (Certified Ethical Hacker) also aligns well, as its wireless hacking syllabus includes discovery, deauthentication, WEP/WPA cracking, evil‑twin, and MITM techniques.

6. Safety Warning

All listed wireless attack techniques—deauthentication, jamming, malicious AP creation, handshake capture, and password cracking—are illegal when used on networks without explicit written authorization. Practitioners should conduct experiments in isolated RF labs, use low‑power transmissions to avoid unintended interference, and limit practice to authorized CTF platforms or security competitions.