OSWP · Module 4

WiFi Encryption

Understand WEP, WPA, WPA2, and WPA3, identify which a network uses, and recognize the weaknesses (including WPA3 Dragonblood) that make each attackable.

~1.5 h 4 resources Last updated September 27, 2026

The encryption a network uses determines how you attack it. PEN-210 covers the evolution of Wi-Fi security and the flaws in each generation: WEP (broken RC4 with reused IVs, crackable in minutes), WPA/WPA2-Personal (a four-way handshake protecting a pre-shared key, attacked by capturing the handshake or PMKID and cracking offline), WPA2-Enterprise (per-user credentials via EAP, attacked with rogue APs), and WPA3 (SAE/Dragonfly, with its own Dragonblood weaknesses and transition-mode downgrades). Identifying the scheme in use is the first decision point of every engagement.

Detecting Encryption Schemes

Before attacking, confirm exactly what a network runs. airodump-ng and iw reveal whether a network is open, WEP, WPA/WPA2, or WPA3, the cipher and authentication suites, and whether management frame protection (MFP/802.11w) is enforced, which decides whether deauthentication-based attacks will work. Open networks and legacy WEP are immediate wins; MFP status shapes your approach to everything else.

WPA3 and SAE Weaknesses

WPA3 replaced the PSK handshake with SAE (Simultaneous Authentication of Equals), but the Dragonblood research exposed side-channel and downgrade weaknesses. The primary attack surface is SAE transition mode, where an AP supports both WPA3 and WPA2 for compatibility, allowing a downgrade to the crackable WPA2 handshake. Detection covers RSN IE inspection and testing for transition-mode downgrade, SAE denial of service, and EAP-pwd weaknesses.

Read

The core material for this module. Where a guide goes deeper than needed, the relevant sections are highlighted.

Mark Detecting Open Wireless Networks as done

Guide 3 min read
Detecting Open Wireless Networks
Focus on #Detect Open Wireless Networks with airodump-ng #Confirm with iw #Check for OWE Transition Mode
Mark Detecting WEP Networks as done

Guide 3 min read
Detecting WEP Networks
Focus on #Detect WEP Wireless Networks with airodump-ng #Confirm with iw #Check for Connected Clients
Mark Detecting WPA2 Networks Without MFP as done

Guide 3 min read
Detecting WPA2 Networks Without MFP
Focus on #WPA2 MFP Detection with iw #Scan Multiple APs Quickly #Confirm Clients Are Present
Mark WPA3 SAE Dragonblood Vulnerabilities as done

Guide 8 min read
WPA3 SAE Dragonblood Vulnerabilities
Focus on #WPA3 Dragonblood: SAE Weakness Classes #Detecting WPA3 Networks #RSN IE Inspection with iw #SAE Transition Mode: The Primary Attack Surface #Testing Transition Mode Downgrade #Testing for SAE DoS with dragondrain #EAP-pwd Testing with dragonslayer #Side-Channel Recovery with dragonforce