KRACK (CVE-2017-13077..082) and FragAttacks (CVE-2020-24586..588 + 26139-26147) — key reinstallation, fragmentation, and aggregation attacks against WPA2 supplicants. Covers Vanhoef's test scripts, viability against modern patched stacks (mostly mitigated post-2021), residual unpatched embedded devices and IoT vendors, and the practical limitations of these attacks in modern engagements.
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/12/2026
What it changes
Passed 20 of 22 test cases with the skill, and 14 of 22 without it.
Without skill64%
With skill91%
Checks it passed that the model alone missed
Names test-fragattacks.py as the test execution script
Maps CVE-2020-24588 specifically to A-MSDU subframe spoofing
Identifies deauthentication-driven roams to unauthorized APs as a WIPS trigger
and 4 more in the full report
6 fixed14 passed either way2 still failing0 broke
Pass-rate lift
+27 pp
Tokens
+22%
Agent turns
0%
Response time
-15%
Model gemini-3.6-flashMeasured 8/12/2026v120 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 6
Prompt
What Python script entry point in Vanhoef's repository executes the automated test suite covering all 12 FragAttacks protocol test cases?
What was checked, without and with the skill
Checked
Without skill
With skill
Names test-fragattacks.py as the test execution script
Missed
Passed
case-16 · gemini-3.6-flash · 8/12/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md109 linessingle file
KRACK & FragAttacks
Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
When These Apply
Family
Target
Patch Status
KRACK
WPA2 supplicants in 4-way handshake / GTK / FT / TDLS
Major OSes patched 2017–2018
FragAttacks
Frame fragmentation/aggregation across WPA2/3
Most stacks patched 2021–2022
Probability of success today is high only against:
Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated.
KRACK — Key Reinstallation
The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable.
# Vanhoef's official test scripts
git clone https://github.com/vanhoefm/krackattacks-scripts
cd krackattacks-scripts/krackattack
sudo ./krack-test-client.py --interface wlan0
# Tests the supplicant on a connected client
Output identifies which CVE variants the client is vulnerable to.
Practical Outcomes
When successful:
Decryption of WPA2-encrypted frames between client and AP
TKIP downgrade enables packet injection
Recovery of session keys for the duration of the affected key cycle