# WiFi Encryption

> Understand WEP, WPA, WPA2, and WPA3, identify which a network uses, and recognize the weaknesses (including WPA3 Dragonblood) that make each attackable.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/wifi-encryption
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 1.5
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

The encryption a network uses determines how you attack it. PEN-210 covers the evolution of Wi-Fi security and the flaws in each generation: WEP (broken RC4 with reused IVs, crackable in minutes), WPA/WPA2-Personal (a four-way handshake protecting a pre-shared key, attacked by capturing the handshake or PMKID and cracking offline), WPA2-Enterprise (per-user credentials via EAP, attacked with rogue APs), and WPA3 (SAE/Dragonfly, with its own Dragonblood weaknesses and transition-mode downgrades). Identifying the scheme in use is the first decision point of every engagement.

## Detecting Encryption Schemes

Before attacking, confirm exactly what a network runs. airodump-ng and iw reveal whether a network is open, WEP, WPA/WPA2, or WPA3, the cipher and authentication suites, and whether management frame protection (MFP/802.11w) is enforced, which decides whether deauthentication-based attacks will work. Open networks and legacy WEP are immediate wins; MFP status shapes your approach to everything else.

## WPA3 and SAE Weaknesses

WPA3 replaced the PSK handshake with SAE (Simultaneous Authentication of Equals), but the Dragonblood research exposed side-channel and downgrade weaknesses. The primary attack surface is SAE transition mode, where an AP supports both WPA3 and WPA2 for compatibility, allowing a downgrade to the crackable WPA2 handshake. Detection covers RSN IE inspection and testing for transition-mode downgrade, SAE denial of service, and EAP-pwd weaknesses.

## Study material

- [Detecting Open Wireless Networks](https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-open-wireless-networks.md) (read, core)
- [Detecting WEP Networks](https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-wep-networks.md) (read, core)
- [Detecting WPA2 Networks Without MFP](https://hackindex.io/platforms/wireless/vulnerability-discovery/detecting-wpa2-without-mfp.md) (read, core)
- [WPA3 SAE Dragonblood Vulnerabilities](https://hackindex.io/platforms/wireless/vulnerability-discovery/wpa3-sae-dragonblood-vulnerabilities.md) (read, core)