# Exploitation > WEP/WPA cracking, evil twins, EAP harvest, rogue APs, WPS attacks - **URL:** https://hackindex.io/platforms/wireless/exploitation - **Platform:** [Wireless](https://hackindex.io/platforms/wireless.md) - **Published:** 2026-03-17 - **Updated:** 2026-03-29 ## What this phase covers Exploitation uses confirmed weaknesses to gain access, recover credentials, or capture sensitive data. The techniques here range from passive traffic capture on open networks to active attacks that recover passphrases, harvest domain credentials, and intercept client traffic through rogue APs. The attack path depends on what vulnerability discovery confirmed. For WPA2 PSK targets, start with [handshake capture](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture) or check whether a PMKID was already captured by hcxdumptool during enumeration, then move to [cracking](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking). For WPS targets, try [Pixie Dust first](https://hackindex.io/platforms/wireless/exploitation/wps-pixie-dust-attack-with-reaver-and-pixiewps) , it completes in seconds if the AP is vulnerable , before falling back to [PIN brute-force](https://hackindex.io/platforms/wireless/exploitation/wps-pin-brute-force). For enterprise networks, [EAP credential harvesting](https://hackindex.io/platforms/wireless/exploitation/harvesting-eap-credentials-hostapd-mana) with hostapd-mana is the primary attack, followed by [MSCHAPv2 cracking](https://hackindex.io/platforms/wireless/exploitation/cracking-mschapv2-with-asleap-and-hashcat). For captive portal networks, [credential harvesting via a rogue portal](https://hackindex.io/platforms/wireless/exploitation/captive-portal-credential-harvesting) is covered alongside the [evil twin AP setup](https://hackindex.io/platforms/wireless/exploitation/evil-twin-ap-with-hostapd-mana-and-aireplay-ng) that drives clients to it. ## Attack path quick reference **Open network** → [capture plaintext traffic](https://hackindex.io/platforms/wireless/exploitation/capturing-plaintext-traffic-open-networks) immediately, no credentials needed. **WEP network** → [IV collection + aircrack-ng](https://hackindex.io/platforms/wireless/exploitation/wep-cracking-with-aircrack-ng), accelerate with ARP replay if traffic is low. **WPA2 PSK, PMKID captured** → [crack directly with hashcat -m 22000](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking), no deauth needed. **WPA2 PSK, no PMKID** → [deauth + handshake capture](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture), then [crack](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking). **WPS unlocked, Ralink/Realtek** → [Pixie Dust first](https://hackindex.io/platforms/wireless/exploitation/wps-pixie-dust-attack-with-reaver-and-pixiewps). **WPS unlocked, other chipset** → [PIN brute-force](https://hackindex.io/platforms/wireless/exploitation/wps-pin-brute-force). **WPA Enterprise, PEAP, no cert validation** → [hostapd-mana rogue RADIUS](https://hackindex.io/platforms/wireless/exploitation/harvesting-eap-credentials-hostapd-mana) → [crack MSCHAPv2](https://hackindex.io/platforms/wireless/exploitation/cracking-mschapv2-with-asleap-and-hashcat). **Joined network** → [ARP spoof + intercept with bettercap](https://hackindex.io/platforms/wireless/exploitation/arp-spoofing-traffic-interception-bettercap). ## Flows into Once access is gained, [post-exploitation](https://hackindex.io/platforms/wireless/post-exploitation) covers decrypting previously captured traffic with the recovered passphrase and mapping the internal network from the wireless foothold. ## Guides - [ARP Spoofing and Traffic Interception with Bettercap](https://hackindex.io/platforms/wireless/exploitation/arp-spoofing-traffic-interception-bettercap.md): Perform ARP spoofing attacks using Bettercap to intercept and manipulate network traffic, enabling MITM positioning on local wireless networks. - [Captive Portal Credential Harvesting](https://hackindex.io/platforms/wireless/exploitation/captive-portal-credential-harvesting.md): Exploits captive portal mechanisms to harvest user credentials via rogue access points, DNS spoofing, and phishing pages mimicking legitimate login portals. - [Capturing Plaintext Traffic on Open Networks](https://hackindex.io/platforms/wireless/exploitation/capturing-plaintext-traffic-open-networks.md): Demonstrates sniffing unencrypted 802.11 traffic on open Wi-Fi using passive capture tools to intercept credentials, sessions, and sensitive data in transit. - [Cracking MSCHAPv2 with Asleap and Hashcat](https://hackindex.io/platforms/wireless/exploitation/cracking-mschapv2-with-asleap-and-hashcat.md): Exploit MSCHAPv2 weaknesses by capturing challenge-response pairs, then crack NT hashes offline using Asleap or Hashcat to recover plaintext credentials. - [EAPHammer Enterprise Wireless Attacks](https://hackindex.io/platforms/wireless/exploitation/eaphammer-enterprise-attacks.md): Exploit WPA2-Enterprise networks using EAPHammer to perform evil twin attacks, capture RADIUS credentials, and conduct rogue AP-based lateral movement. - [Evil Twin AP with hostapd-mana and Aireplay-ng](https://hackindex.io/platforms/wireless/exploitation/evil-twin-ap-with-hostapd-mana-and-aireplay-ng.md): Creates a rogue AP cloning a legitimate SSID using hostapd-mana, forcing client deauthentication via Aireplay-ng to capture credentials or handshakes. - [Harvesting EAP Credentials with hostapd-mana](https://hackindex.io/platforms/wireless/exploitation/harvesting-eap-credentials-hostapd-mana.md): Deploy a rogue AP using hostapd-mana to intercept EAP authentication handshakes, capturing enterprise wireless credentials via RADIUS downgrade and identity harvesting attacks. - [KARMA Known-Network Attack with hostapd-mana](https://hackindex.io/platforms/wireless/exploitation/karma-known-network-attack.md): Demonstrates KARMA attacks using hostapd-mana to impersonate trusted SSIDs, capturing client connections by responding to 802.11 probe requests. - [WEP Cracking with Aircrack-ng](https://hackindex.io/platforms/wireless/exploitation/wep-cracking-with-aircrack-ng.md) - [Wireless Attacks with Bettercap](https://hackindex.io/platforms/wireless/exploitation/wireless-attacks-with-bettercap.md) - [Cracking WPA Handshakes and PMKIDs](https://hackindex.io/platforms/wireless/exploitation/wpa-cracking.md): Capture WPA/WPA2 handshakes or PMKIDs, then perform offline dictionary and brute-force attacks using hashcat or aircrack-ng to recover PSKs. - [Capturing the WPA 4-Way Handshake](https://hackindex.io/platforms/wireless/exploitation/wpa-handshake-capture.md) - [WPS Interference and Beacon Flooding with mdk3](https://hackindex.io/platforms/wireless/exploitation/wps-interference-with-mdk3.md) - [WPS PIN Brute-Force with Reaver](https://hackindex.io/platforms/wireless/exploitation/wps-pin-brute-force.md) - [WPS Pixie Dust Attack with Reaver and Pixiewps](https://hackindex.io/platforms/wireless/exploitation/wps-pixie-dust-attack-with-reaver-and-pixiewps.md)