WPA3
Bruteforcing WPA3
In WPA3 networks, it is still possible to brute force until the password is found. To do this, we can use “wacker”.
Setting up Wacker
Make the script executable
Now make wpa supplicant binary executable
Tab 1: Target Discovery
Identify the WPA3 network details.
Target SSID:
SweetB-WPA3BSSID:
02:00:00:00:02:00(Note: Use the specific MAC shown in your scan)Channel:
36Encryption: Look for WPA3 CCMP SAE.
Tab 2: The Wacker Attack
Wacker is a specialized tool that automates the SAE authentication loop to test passwords.
Navigate to Tool:
cd /home/rogue1/opt/wacker/Command:
Flag Breakdown:
--wordlist: Path to your dictionary file.--interface: Use a managed interface (e.g.,wlan1), NOT a monitor mode interface, as Wacker interacts with thewpa_supplicantstack.--freq: The frequency in MHz (e.g., Channel 36 =5180).
Success: When the password is found, it will output:
Found the password: 'password1'.
WPA3 downgrade attack
If a network with WPA3 SAE has a client configured for WPA2/WPA3, we can perform a downgrade against the client, forcing it to connect to our RogueAP with WPA2, obtaining the handshake to crack it later, as in the case of Wi-Fi offices. In this case, we can see that the AP uses SAE and PSK, so maybe the clients accept PSK too. We can get this information in the airodump-ng “.csv” file.
First, do the reconnaissance and observe the channel of our target Network.
Now, capture the packets and write them to a file.
We will get a CSV file. And if we look closely, we can see that our target Network does support WPA2 PSK as well
We can also check if the AP has MFP(802.11w) with Wireshark:
Open the captured pcap file with Wireshark and look for management frame protection.
In this case, 802.11w is disabled, so we can deauth:
Now, we can create our config file for our rogue AP.
hostapd-sae.conf
We need to change the channel to some other channel for our rogue AP otherwise it does not work
This is a Hostapd configuration file used to set up a fake access point (AP) for penetration testing purposes. Here’s a breakdown of each line:
interface=wlan1→ Specifies that wlan1 is the wireless network interface to be used for hosting the fake AP.driver=nl80211→ Uses the nl80211 driver, which is common for modern Linux-based wireless devices.hw_mode=g→ Sets the 802.11g standard, which operates on the 2.4 GHz band and supports speeds up to 54 Mbps.channel=6→ Specifies Channel 11 for the AP.ssid=wifi-IT→ This is the SSID (Wi-Fi network name) that the AP will broadcast.mana_wpaout=hostapd-management.hccapx→ Captures WPA handshakes and saves them in the HCCAPX format, which is used for offline password cracking with Hashcat.wpa=2→ Configures WPA2 encryption (stronger than WPA1).wpa_key_mgmt=WPA-PSK→ Uses Pre-Shared Key (PSK) authentication.wpa_pairwise=TKIP CCMP→ Supports both TKIP (legacy) and CCMP (AES-based, stronger encryption).wpa_passphrase=12345678→ Sets the Wi-Fi password to12345678.
What This Configuration Does
✅ Creates a fake Wi-Fi network named "wifi-IT" on channel 6.
✅ Uses WPA2-PSK encryption with the password "12345678".
✅ Captures WPA handshakes in HCCAPX format for cracking later.
✅ Uses wlan1 interface with nl80211 driver.
And you will be able to capture the handshake.
Copy the hash from the terminal to a new file
Crack outside the VM or with a new version of hashcat.
2nd Method - Using EAPhammer
Eaphammer can also be used to start rogue AP.
Now start monitoring the original AP by fixating on the channel.
In another tab, do the deauth attack against the original AP
Once the client connects to our rogue AP, we get our handshake.
Copy the captured handshake to the current directory
Now we can use Aircrack to crack the password
For cracking with hashcat we need to convert this file.
Export the 22000 hash mode from the pcap
Now, crack outside the VM or with a new version of hashcat.
Tip: Deleting the Hashcat potfile
Last updated