WiFi Penetration Testing (Ethical Hacking) From Scratch

Explore Wi-Fi penetration testing from fundamentals to practical exploits, learning Wi-Fi security challenges, defense mechanisms, and how to protect wireless networks with proper authentication like WPA and EAP.

Explore ethical Wi-Fi penetration testing fundamentals, learning by doing to understand security weaknesses, legal considerations, and practical demonstrations on wireless systems and monitor mode.

Explore wireless communication systems, from fixed and mobile to terrestrial and satellite links, and how unlicensed Wi-Fi and cellular networks shape coverage and data flow.

Explore why wireless thrives despite lower data rates, highlighting mobility and convenience, and show wifi's data-application origins, unlicensed bands, and security considerations.

Discover wifi basics, including what wifi is, 802.11 standards, and the wifi alliance, and see how wireless LAN connects a wide range of devices across homes and travel.

Trace the Wi‑Fi history from 1985 FCC unlicensed ISM bands to 802.11 and the Wi‑Fi Alliance, showing how amendments and laptops fueled global adoption.

Explore wifi architecture, including base service set and extended service set, ad hoc and infrastructure modes, access points and stations, SSIDs, and basic security and association concepts.

Explain how wifi clients scan 2.4 and 5 GHz to detect beacon signals from access points, and how authentication, association, and ARP map IPs to MACs during changes between points.

Explore how wifi clients scan 2.4 gigahertz and 5 gigahertz, read beacon signals, select access points, and manage authentication, association, and IP and MAC address mappings for seamless connectivity.

Explore how Wi‑Fi amendments since 1999 introduced higher data rates across 2.4 GHz and 5 GHz bands, using OFDM and MIMO, with backward compatibility and adaptive data rates.

Explore how 802.11 amendments evolved from 8 to 11 and beyond, weighing cost and timing, with innovations like 40/80/160 mhz channels, mimo, and dual-band operation in 2.4 and 5 ghz.

Explore how promiscuous and monitor modes expand wifi frame visibility for tools like Wireshark, and why physical and MAC layer filtering still limit what you can see.

Define information security and focus on Wi-Fi network security by guarding against eavesdropping, ensuring confidentiality, and data integrity through proper authentication and protection against vulnerabilities.

Explore how digital signals are protected by cryptographic primitives like pseudo random generators, block and stream ciphers, keys, and cryptographic hashes that ensure integrity and secure transmission.

Understand how shared secret cryptography uses the same key for encryption and decryption, and how public key cryptography uses related public and private keys in Wi-Fi contexts like WPA.

Assess the challenges of securing wireless networks, including the broadcast medium, mobility, battery constraints, WPA, cryptographic and social engineering considerations.

Trace the historical development of Wi-Fi security, from open authentication and shared key authentication to WPA, and explore how mobility and MAC address filtering shaped early vulnerabilities.

Explore MAC address filtering and its spoofing risk, then examine WEP weaknesses, including short keys and vulnerable initialization vectors used with a stream cipher.

Analyze WEP weaknesses: weak key usage, short 24-bit IVs, and shared keys causing IV collisions. Learn how lack of replay protection enables passive and active attacks to recover keys.

The lecture surveys early wifi security patches, describing three workarounds—hidden SSID, MAC address filtering, and browser hijacking—and explains how they attempted to mitigate weaknesses in WEP prior to WPA standards.

Learn why WEP failed, how WPA with TKIP improves key usage via per packet key mixing and Michael integrity, and adds replay protection for legacy hardware.

Explore how 802.1X enhances Wi‑Fi security by separating the authenticator from the identity server, using EAP and RADIUS for end-to-end authentication and access control.

Explore how WPA evolved into WPA2 with AES-128 and CCMP for confidentiality and data integrity. Learn how block ciphers become stream ciphers via counter mode and CBC Mac ensures integrity.

Comparison of personal and enterprise wifi security reveals how WPA/WPA2 improves over WPP, TKIP and AES usage, 802.1X authentication, and the role of EAP in mutual authentication.

Explore Wi-Fi protected setup (WPX) methods for network joining, including push-button and eight-digit pin, and examine a flaw that enables brute-forcing first four digits, undermining security and recommending disabling WPX.

Identify essential equipment for wifi penetration testing, including USB wifi adapters, hardware, virtualization requirements, and optional cloud processing. Learn how monitor mode, promiscuous mode, and chipset drivers enable effective attacks.

Identify wifi penetration testing gear, including a laptop, a monitor-mode capable wifi card with a suitable chipset and driver for frame injection, plus antennas to extend range under unlicensed-band rules.

Prepare hardware and software for wireless penetration testing by using usb wifi adapters and virtual machines with Kaleo Linux, enabling monitor mode and tools like aircrack-ng.

Explore Kali Linux wireless tools to configure a wireless card and retrieve information on nearby access points, including channels, frequencies, and MAC addresses, using root access in a Kali VM.

Explore the iw suite for linux, including iw and iwlist, to view wifi interface capabilities, scan for access points, and inspect beacon intervals, supported rates, and cipher details.

Turn on monitor mode on a wifi card and use Wireshark to inspect frames from surrounding access points, comparing monitor mode with managed mode and viewing captured traffic.

Turn on monitor mode to capture Wi-Fi traffic with Wireshark, compare managed and monitor modes, and inspect frames, headers, and content from surrounding access points.

Discover how to filter Wireshark for frames from an access point using OBSS ID or MAC address, and pair Aradigm data with Wireshark to analyze beacons, data rates, and encryption.

Test wifi injection by enabling monitor mode on a channel, using aireplay to inject frames toward an access point on channel 11, confirming successful packet injection for penetration testing.

Set up two wireless interfaces in monitor mode to test frame injection, with one acting as an access point and the other injecting frames using aireplay-ng and airserv-ng.

Learn passive attacks to recover the access point key, then active frame injection, with permission, using airodump-ng and aircrack-ng with ptw attacks and iv considerations.

Explore passive attacks on WEP networks that recover keys from IVs using PTW and older methods, and compare active frame injections (replay, chop-chop, fragmentation) with airreplay-ng.

Demonstrates using Wireshark to decrypt WPA/WEP frames by entering the recovered key, filtering data frames, and inspecting decrypted SMB file transfers for sensitive content.

This lecture demonstrates an active WPB attack on a relatively idle Wi-Fi network, injecting frames via every play attack, authenticating, and capturing ARP broadcasts to recover the WPB key.

Demonstrates a fragmentation attack as an active wifi intrusion, using monitor mode, packet forge, and keystream to craft and inject frames and traffic.

Perform a post mortem of a successful WEP fragmentation attack, using Wireshark to inspect cap captures, extract keystream fragments, decrypt frames with the key, and forge a replayed op request.

Examine attacks on isolated WPA clients, notably the cafe latte attack that uses a fake access point with the same SSID to trigger gratuitous ARP and obtain the WPA key.

Demonstrate the cafe latte attack to recover the wpa key by using aireplay-ng and airbase-ng with a fake test-1 access point, even when the real access point is offline.

The lecture demonstrates a cafe latte WEP attack and the hurty (C Frech) attack against a fake access point, capturing WEP encrypted frames and ARP requests/responses.

Explore how ethical hacking uses Reaver and the pixie dust attack to evaluate the WPS pin vulnerability on Wi‑Fi networks, including monitor mode setup, data capture, and practical countermeasures.

Explore practical wifi penetration testing using Reeva, improving success with a directional antenna, handling AP rate limiting, resuming attacks, changing channels, and speeding up pin attempts.

Compare Wash and Reaver for WPS usage, and address monitor mode challenges, AP countermeasures, and antenna gains to improve signal.

Demonstrates launching a GPU-enabled AWS EC2 instance from the marketplace, installing hashcat, and updating NVIDIA drivers using root privileges to verify GPU readiness.

Explore how WPA and WPA2-PSK derive keys from a passphrase using PMK and PTK, and learn how the four-way handshake enables brute-force attacks and secure encryption.

Learn how to capture a four-way handshake, derive the PMK and PTK from a candidate passphrase and the SSID, and verify guesses through handshake data and MIC comparisons.

Demonstrates a dictionary attack on WPA and WPA2-PSK by capturing a four-way handshake, using a wordlist for brute-forcing the passphrase and validating with Wireshark.

Discover how to use Wireshark to analyze a WPA/WPA2-PSK four-way handshake, filter EAPOL frames, and derive the key from a passphrase captured in a WPA handshake.

Explore how wordlists crack wpa and wpa2-psk passphrases and why the passphrase must appear in the list, comparing small Kali Linux lists with rockyou's large dataset.

learn how to identify a test network on channel 11, observe the ssid, and use a deauth attack to force a client to reassociate and capture the wpa/wpa2 handshake.

Explore weaknesses in wpa and wpa2-psk by targeting isolated clients with fake access points to capture four-way handshake messages for dictionary-style attacks.

Demonstrate capturing a WPA and WPA2 handshake from an isolated client by setting up a fake access point to trigger a four-way handshake, speeding up dictionary attacks with hashcat.

Demonstrate how changing the WPA passphrase on the access point motivates hashcat brute-force cracking of captured handshakes, with channel 11 filtering and GPU-accelerated dictionary attack speeding the process.

Learn how Hashcat accelerates brute-force and password recovery on GPUs to crack WPA/WPA2 passphrases, with cross-platform setup, wordlists, rules, and cloud demos.

Demonstrate using hashcat for dictionary attacks against WPA and WPA2-PSK, check your GPU details with the DirectX diagnostic tool, and update Nvidia drivers before running hashcat on Windows.

This lecture demonstrates obtaining hashcat for Windows, converting cap files to hashcat's hccapx format, and selecting WPA and WPA2 attack options like 2500/500 for practical password cracking.

Install the Nvidia drivers and related software on an EC2 instance, update and reboot, then run hashcat benchmarks to verify GPU performance for WPA and WPA2 cracking using dictionary files.

Continue exploring hashcash on a GPU-enabled virtual machine, generate h.c. x files from cap files using h.c. k-pax, and use hashcat utilities to boost password cracking power.

Demonstrate hashcash against a dictionary to recover a passphrase, showing how adding words accelerates the search and how rules generate derivative passphrases from the word list.

Explore fluxion and rogue access points to simulate legitimate wifi networks, use honeypots to capture passphrases, and understand social engineering and man-in-the-middle concepts.

Watch a step-by-step Fluxion demo that walks through installing Fluxion, resolving dependencies, starting the tool, selecting a wireless channel, and capturing handshakes for verification.

Fluxion demonstrates its fake access point and captive portal to trick a user into revealing the wifi passphrase, which Fluxion captures and verifies against the handshake.

This lecture demonstrates how Fluxion tricks a user into entering a wifi passphrase at a fake access point, capturing the password without a dictionary attack.

Explain the purpose of wifi penetration testing for home and small-office networks, and how open, WEP, and WPA/WPA2 can be breached, highlighting enterprise WPA2 with a radius server and Fluxion.

Summarize wifi security schemes, noting WEP weaknesses, the strengths of WPA and WPA2 with PSK or enterprise modes, and how cracking via frames and dictionary attacks is addressed.