Skip to content
HackIndex logo

HackIndex

Detecting WPA2 Networks Without MFP

3 min read Mar 17, 2026

Management Frame Protection (802.11w / MFP) authenticates deauthentication and disassociation frames so they cannot be forged. On WPA2 networks without MFP, any attacker in range can send a spoofed deauthentication frame to any client and force it to disconnect. The client then reassociates and completes a new 4-way handshake which can be captured for offline cracking. Without MFP this attack works against every associated client regardless of signal strength or connection quality.

Check MFP Status with iw

The MFP capability is declared in the RSN information element of the beacon. Scan and check for the target AP:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -A 25 "AA:BB:CC:DD:EE:FF" | grep -E "SSID|RSN|MFP|Capabilities" 
SSID: TargetNetwork
RSN:	 * Version: 1
	 * Authentication suites: PSK
	 * Capabilities: 1-PTKSA-RC 1-GTKSA-RC

The absence of MFP-capable or MFP-required in the Capabilities line confirms MFP is not supported. This network is fully vulnerable to deauthentication-based handshake capture.

Possible MFP states and what they mean for the attack:

  • No MFP field — MFP not supported. Deauthentication attacks work against all clients unconditionally.
  • MFP-capable — AP supports MFP but does not require it. Clients that negotiate MFP are protected. Clients that do not negotiate MFP remain vulnerable. Most legacy devices fall into the unprotected category.
  • MFP-required — all clients must use MFP. Deauthentication attacks will not work. WPA3 networks always set this.

Scan Multiple APs Quickly

To check MFP status across all visible WPA2 PSK networks at once:

┌──(kali㉿kali)-[~]
└─$ iw dev wlan0 scan | grep -E "BSS |SSID:|MFP|PSK" 
BSS AA:BB:CC:DD:EE:FF
	SSID: TargetNetwork
		 * Authentication suites: PSK
BSS 11:22:33:44:55:66
	SSID: HomeNet
		 * Authentication suites: PSK
		 * Capabilities: MFP-capable
BSS 77:88:99:AA:BB:CC
	SSID: OfficeNet
		 * Authentication suites: PSK SAE
		 * Capabilities: MFP-required

From this output: TargetNetwork has no MFP at all — fully vulnerable. HomeNet has MFP-capable — partially vulnerable depending on client. OfficeNet has MFP-required — deauthentication will not work.

Confirm Clients Are Present

A deauthentication attack requires at least one associated client to produce a handshake. Confirm clients are connected before moving to exploitation:

┌──(kali㉿kali)-[~]
└─$ airodump-ng --bssid AA:BB:CC:DD:EE:FF --channel 6 wlan0mon 
 BSSID              STATION            PWR   Rate  Lost  Frames

 AA:BB:CC:DD:EE:FF  CC:DD:EE:FF:AA:BB  -55   54e-54e  0     84
 AA:BB:CC:DD:EE:FF  DD:EE:FF:AA:BB:CC  -72   11e-1e   2     21

Record the client MAC addresses. These are the targets for directed deauthentication during handshake capture. Clients with stronger signal (higher PWR closer to 0) are preferable targets as they are more likely to reassociate quickly.

Document the Finding

Record the BSSID, SSID, channel, MFP status, and connected client MACs. A WPA2 PSK network with no MFP and at least one associated client is immediately exploitable through deauthentication and handshake capture. If no clients are present, PMKID capture with hcxdumptool is the alternative that requires no client to be connected.

References