Video summary

Pentesting de redes Wi-Fi (JakinCode)

Main summary

Key takeaways

Technology

Main theme

The speakers (Laura and Héctor from JakinCode) explain how Wi‑Fi penetration testing works in practice. They cover:

  • An overview of Wi‑Fi standards/protocols
  • Typical attack paths
  • Hands-on demos using common pentesting hardware and tools

Course outline / structure

  1. Intro to Wi‑Fi standards and protocols (802.11, then WPA/WPA2/WPA3 variants)
  2. Deeper protocol-by-protocol analysis
  3. Tools for manual vs automatic attacks
  4. Demos showing the workflow end-to-end

Wi‑Fi standards basics (802.11)

  • 802.11 is the underlying Wi‑Fi standard.
  • Standards differ by:
    • working frequency
    • channel width
    • multi-user vs single-user
    • maximum speed
  • Revisions can include letters (e.g., -n, -ac, -ax), affecting performance.

Wi‑Fi security protocols covered

WPA (treated as legacy / conceptually like WEP/“WEP/WE”)

  • Described as obsolete and vulnerable.
  • Key points:
    • uses RC4
    • static key (does not change)
    • connection unencrypted
  • Presented as broadly exploitable in the context of weak/legacy encryption.

WPA2 (focus: most common)

  • WPA2-PSK is described as the prevalent real-world case.
  • Mentions the 4-way handshake (called “forward handshake” in the subtitles) for authentication.
  • Attack strategies focus on obtaining and cracking the handshake / derived key.

WPA3 (focus: SAE / AES-based)

  • Described as the most modern standard and “already used at home” in some routers.
  • Key changes vs PSK:
    • moves to asymmetric / SAE (Simultaneous Authentication of Equals)
    • mutual authentication between AP and client
    • clients use public/private keys and rely on elliptic-curve-style authentication
  • Practical challenge:
    • backward compatibility: some WPA3 deployments also include PSK for older devices.
  • Exploit angle described:
    • use a rogue/fake AP (Evil Twin) to push clients to fall back to PSK
    • if the PSK is weak, the handshake can be cracked

WPA2 Enterprise (common in companies)

  • Defined as using a RADIUS server (authentication/authorization via a third server).
  • Example integration:
    • Active Directory + RADIUS (with CHAPv2 mentioned, often associated with Microsoft environments).
  • Attack workflow (high level):
    1. Identify an enterprise network (capture/observe frames and security settings)
    2. Wait for a handshake or other client traffic
    3. In some cases, MFP (management frame protection) can hinder attacks
    4. Use EAP Identity-related filtering to extract user identity
    5. Extract/replicate RADIUS certificate information to impersonate the server
    6. Attempt credential attacks:
      • brute force
      • password spraying
      • hash cracking (NTLM-derived hashes referenced after relay-style flows)

Tooling: Aircrack suite (manual workflow)

The speakers describe a manual workflow using multiple tools:

  • airmon-ng
    • switch interface into monitor mode for packet capture
  • airodump-ng
    • capture packets and save frames
    • extract vendor/manufacturer info when possible
  • IR/replay tool (“IR Replay” / replay traffic mentioned)
    • generate wireless traffic to help capture needed frames
  • aircrack-ng
    • crack WEP/WPA handshakes and obtain keys
  • airdecap-ng
    • decrypt captured packets once the key is known
  • additional visualization
    • “more visual” graphs produced from CSV capture outputs (via airodump data)

Automated / convenience attack tools (Wi‑Fi)

Three automation tools were highlighted:

  • Bettercap
  • WiFite
  • A “meta-exploit” style website/tool “like a meta-exploit, but for Wi‑Fi” (exact name not clearly captured)

Key claim: these tools reduce manual steps by performing recon → capture → cracking automatically.

Specific WPA2 / WPA attack techniques mentioned

Authentication attack (WPA2-PSK)

  • Force a connected client to disconnect/reconnect
  • Capture the reconnect handshake for cracking

Rogue AP / Evil Twin (WPA2)

  • Set up a malicious AP similar to the target
  • Use configuration cloning ideas:
    • match parameters beyond just SSID (e.g., BSSID/MAC checks mentioned)
  • Capture handshake and crack via dictionary / brute force
  • hashcat is mentioned as a cracking example

WPA3 backward-compatibility exploit

  • If the AP offers SAE + PSK, use a fake AP approach to steer the client toward PSK
  • Then crack (success depends on conditions such as correct handshake/key behavior)

Enterprise attacks: credential extraction & relay concepts

The video describes enterprise Wi‑Fi attacks involving:

  • Extracting EAP identity from early/unencrypted portions (before the TLS tunnel is established)
  • Pulling certificate details from captured traffic (before/without fully protected tunnel)
  • Recreating/implying the same certificate to reduce client suspicion

They also describe:

  • Obtaining NTLM-like hashes and cracking them (e.g., via hashcat)
  • Relay attack concept:
    • act as a “middle man” and relay authentication to the real RADIUS/AP without possessing the password
    • notes compatibility scenarios around MSCHAPv2 and relay-like behavior

Captive portals / Evil Portal concepts

They distinguish:

  • Captive portal
    • fake AP that triggers a web/credential prompt
    • can request credentials like Microsoft-style logins
  • Host-style portal (subtitle wording)
    • instead of a web form, forces the client to attempt SMB authentication
    • capture NTLMv2 challenge/response hashes and crack to recover domain credentials

They also describe:

  • Deauthentication/baiting via bonding history
    • devices advertise networks they’ve seen nearby (linked to “bonding” / remembered networks)
    • use captured nearby SSIDs to impersonate more likely networks
  • Example approach:
    • emulate a network nearby devices are likely to auto-join
    • capture “the HANS” (subtitle likely meaning challenge/handshake/credential data)

“Wireless IDS/IPS” discussion

  • Introduces the WIDS concept:
    • monitors wirelessly for rogue APs/network changes (e.g., detecting MAC address changes)
  • States that true prevention may be limited; instead, it may:
    • detect fakes
    • manipulate client connections
    • conceptually: “if the user authenticates to the fake, it prevents them from actually connecting”

Demos / practical equipment

Demo 1: Flipper Zero (with wireless module)

  • Clarifies that Flipper Zero may not emit Wi‑Fi natively unless expanded.
  • Uses a GPO expansion module to add Wi‑Fi capability (SPI32-based module mentioned).
  • Demonstrates “Evil Portal”/captive portal functionality:
    • serve custom HTML
    • select network name
    • users connect, enter credentials, and the entries appear on-device

Demo 2: WiFi Pineapple (manual exploitation)

  • Uses WiFi Pineapple (Hack5) to create an AP and attack manually from Kali.
  • Workflow shown:
    • list wireless interfaces
    • run airmon-ng / “check kill” to stop interfering processes
    • put interface into monitor mode
    • scan with airodump-ng to find AP/BSSID
    • perform an authentication disruption approach to capture the WPA2 handshake
    • crack WPA2-PSK using a dictionary/wordlist
      • example wordlist: top 1000
      • then finds a password shown on screen
  • Briefly mentions Pineapple collecting SSIDs/devices’ nearby/bonding history and using impersonation via an interface.

Key takeaways (as presented)

  • Wi‑Fi pentesting follows a structured pipeline: standards/protocol understanding → capture/recon → handshake/identity extraction → cracking/impersonation → decrypt/credential use

  • WPA2-PSK attacks often rely on capturing and cracking the handshake.

  • WPA3 is stronger via SAE mutual authentication, but backward compatibility (PSK) can reintroduce weakness.
  • Enterprise (WPA2-EAP/RADIUS) shifts the attack surface to:
    • EAP identity
    • TLS/cert details
    • RADIUS integration
    • relay/brute-force attempts
  • Hardware like Flipper Zero and WiFi Pineapple helps operationalize attacks and demos (including captive portals and handshake capture).

Main speakers / sources

  • Laura (JakinCode)
  • Héctor (JakinCode)
  • Company referenced: JakinCode
  • Hardware mentioned: Flipper Zero and WiFi Pineapple (Hack5)

Original video