Wireless:
Exploitation
WEP/WPA cracking, evil twins, EAP harvest, rogue APs, WPS attacks
ARP Spoofing and Traffic Interception with Bettercap
Perform ARP spoofing attacks using Bettercap to intercept and manipulate network traffic, enabling MITM positioning on local wireless networks.
Captive Portal Credential Harvesting
Exploits captive portal mechanisms to harvest user credentials via rogue access points, DNS spoofing, and phishing pages mimicking legitimate login portals.
Capturing Plaintext Traffic on Open Networks
Demonstrates sniffing unencrypted 802.11 traffic on open Wi-Fi using passive capture tools to intercept credentials, sessions, and sensitive data in transit.
Cracking MSCHAPv2 with Asleap and Hashcat
Exploit MSCHAPv2 weaknesses by capturing challenge-response pairs, then crack NT hashes offline using Asleap or Hashcat to recover plaintext credentials.
EAPHammer Enterprise Wireless Attacks
Exploit WPA2-Enterprise networks using EAPHammer to perform evil twin attacks, capture RADIUS credentials, and conduct rogue AP-based lateral movement.
Evil Twin AP with hostapd-mana and Aireplay-ng
Creates a rogue AP cloning a legitimate SSID using hostapd-mana, forcing client deauthentication via Aireplay-ng to capture credentials or handshakes.
Harvesting EAP Credentials with hostapd-mana
Deploy a rogue AP using hostapd-mana to intercept EAP authentication handshakes, capturing enterprise wireless credentials via RADIUS downgrade and identity harvesting attacks.
KARMA Known-Network Attack with hostapd-mana
Demonstrates KARMA attacks using hostapd-mana to impersonate trusted SSIDs, capturing client connections by responding to 802.11 probe requests.
Cracking WPA Handshakes and PMKIDs
Capture WPA/WPA2 handshakes or PMKIDs, then perform offline dictionary and brute-force attacks using hashcat or aircrack-ng to recover PSKs.
What this phase covers
Exploitation uses confirmed weaknesses to gain access, recover credentials, or capture sensitive data. The techniques here range from passive traffic capture on open networks to active attacks that recover passphrases, harvest domain credentials, and intercept client traffic through rogue APs.
The attack path depends on what vulnerability discovery confirmed. For WPA2 PSK targets, start with handshake capture or check whether a PMKID was already captured by hcxdumptool during enumeration, then move to cracking. For WPS targets, try Pixie Dust first , it completes in seconds if the AP is vulnerable , before falling back to PIN brute-force. For enterprise networks, EAP credential harvesting with hostapd-mana is the primary attack, followed by MSCHAPv2 cracking. For captive portal networks, credential harvesting via a rogue portal is covered alongside the evil twin AP setup that drives clients to it.
Attack path quick reference
Open network → capture plaintext traffic immediately, no credentials needed.
WEP network → IV collection + aircrack-ng, accelerate with ARP replay if traffic is low.
WPA2 PSK, PMKID captured → crack directly with hashcat -m 22000, no deauth needed.
WPA2 PSK, no PMKID → deauth + handshake capture, then crack.
WPS unlocked, Ralink/Realtek → Pixie Dust first.
WPS unlocked, other chipset → PIN brute-force.
WPA Enterprise, PEAP, no cert validation → hostapd-mana rogue RADIUS → crack MSCHAPv2.
Joined network → ARP spoof + intercept with bettercap.
Flows into
Once access is gained, post-exploitation covers decrypting previously captured traffic with the recovered passphrase and mapping the internal network from the wireless foothold.