Learn Wireless Security from Scratch - 2025

Explore the fundamentals of 802.11 wireless technology, including Wi-Fi frequencies, channels, access points, SSIDs, infrastructure and ad hoc modes, and essential security concepts.

Select a compatible wi-fi adapter and enable monitor mode, then use airodump-ng to sniff beacons. Save data to a pcap and analyze with Wireshark.

Explore the 802.11 frame control structure, focusing on management frames and beacons, authentication and association, and how open and WPA/WPA2 networks secure wireless connections.

Capture wireless traffic with airmon-ng and airodump-ng, enable monitor mode, then analyze in Wireshark to study 802.11 management, beacon, authentication, and probe frames by channel.

Configure your wireless adapter to hide the ssid and learn how an attacker reveals the hidden ssid by capturing beacon and probe traffic with Wireshark.

Reveal a hidden ssid by crafting deauthentication frames to disconnect a client and trigger re-association, exposing the ssid in the process using monitor mode and a packet injection tool.

Learn to discover wireless networks through passive and active scanning, using monitor mode for passive sniffing and probe requests for active discovery, with countermeasures and war driving context.

Explore essential linux and windows commands to scan and enumerate 802.11 networks, manage interfaces, and set channel and power. Filter results with grep, recover saved wifi keys, and control auto-connect.

Investigate MAC filtering on wireless access points, its whitelist basis, and how attackers spoof MAC addresses to bypass the filter, demonstrated with Wireshark and fake authentication.

Learn how open and shared WLAN authentication operate, how WEP with RC4 and initialization vectors enables a challenge–response attack, and how attackers can extract key streams to decrypt traffic.

Explore practical wireless authentication by intercepting the handshake between an iPhone and a preconfigured access point with shared authentication, while monitoring mode sniffing packets.

Expose why wep encryption is insecure by detailing rc4 with a 24-bit initialize vector and per-packet changes that enable cracking within minutes.

Explore practical WEP attacks by turning on a wireless interface, capturing IV-rich traffic, and using a tool called Aircraft Engine to derive the key.

Examine cafe latte and chop chop attacks as alternatives to crack or decrypt WEP, including fake access points and ARP replay, and note the move toward WPA, WPA2, and WPA3.

Explore beacon flooding, a denial-of-service attack that floods the air with random beacons to confuse wireless clients scanning networks, and see MBK3 generate fake SSIDs while monitoring with Wireshark.

Explore denial of service attacks on wlan management frames that spoof authentication packets to disconnect clients, featuring demonstrations using monitor mode, and discuss mitigation via management frame protection in WPA/WPA2.

Explore how WPA and WPA2 use tkip encryption and a four-way handshake to derive pmk and ptk, with beacon frames revealing configuration; personal mode is vulnerable to dictionary attacks.

Explore how offline dictionary attacks reveal WPA passwords by analyzing the four-way handshake, using aircrack to generate the PMK and verify PTK against handshake data.

Explore practical techniques to obtain the WPA/WPA2 four-way handshake, use a dictionary attack with aircrack-ng, and analyze handshakes with Wireshark to crack wifi passwords.

Learn to speed WPA/WPA2 cracking using time-memory tradeoffs with pre calculated PMKs from a dictionary, employing Gen PMK and Carpati against a captured four-way handshake.

Leverage GPU power with hashcat to crack WPA/WPA2 faster than CPU-based methods; also use cloud services like AWS to harness GPU resources while respecting service terms.

Show how attackers use wifi phishing with multiple honeypot access points to capture a WPA/WPA2 handshake and crack passwords via dictionary attack.

Explore non-dictionary attacks on wpa/wpa2 by exploiting the wpx vulnerability, and learn to scan with wash and brute-force pins with reaver, noting practical feasibility.

Demonstrates a phishing-based wifi attack using a fake access point and login page to capture WPA/WPA2 passwords via handshake verification, highlighting social engineering over dictionary attacks.

Learn how WPA encrypted WLAN traffic remains unreadable without the key, and how Wireshark can decrypt it when you supply the correct password to reveal DNS and HTTP data.

Learn to build a simple wifi detector for authentication and disassociation frames by scripting with Skype and Python, enabling monitor mode, sniffing dot11 packets, and printing detected events.

Learn to detect fake access points by analyzing beacon frames and vendor details with airbase-ng and Wireshark, identifying differences in frame length and transmitted information.

Explore how unsecured wifi scanners can be attacked using two vulnerable components: a CGI web server and a vulnerable python script that displays networks, enabling malicious payloads via injected scripts.

Analyze how captive portals redirect to login pages on open networks, how credentials may be sniffed or hijacked via MAC spoofing, and the ethical use of tools with written permission.

Explore wlan enterprise security, eap schemes like peap and eap-md5, radius server interactions, and attacks from weak cert validation to dictionary cracking, with best practices for robust authentication.

Analyze WPA3 captured traffic in Wireshark, inspect the authentication details and tag parameters, and observe that WPA3 encrypts data with a distinct structure, preventing dictionary attacks on captured four-way handshakes.

Explore software defined radio architecture, including antenna choices, rf amplifiers, tuners, adc and sampling, and how sample rate, dynamic range, and resolution shape reception and transmission.

Select a suitable rtl-sdr receiver with an antenna, install the Zadig driver, and use SDR software to scan frequencies and listen to air traffic and air-ground communications.

Learn how to sniff and analyze aircraft traffic using ads-b signals at 1090 mhz, decoding flight data with dump1090 and visualizing it via virtual radar server.

Learn the fundamentals of cellular communication and GSM architecture, expose 2G encryption weaknesses, and explore how AirProbe and Wireshark sniff GSM traffic with LTE mitigation.

The wrap-up emphasizes exploring diverse wireless frequencies beyond basics, like Bluetooth and RFID, and recommends practical books and Offensive Security certifications to deepen skills.