Wireless network audits verify that access points use strong security standards and secure password structures. This brief covers WPA2 capture workflows.
1. Monitor Mode Configuration
To inspect wireless traffic, the network card must be configured to Monitor Mode. This allows the card to listen to all packets, not just those addressed to the host.
airmon-ng start wlan02. Sniffing Wireless Channels
Locate target networks by listing nearby SSID names, MAC addresses, and channel parameters using the airodump utility:
airodump-ng wlan0mon3. Capturing Handshakes
Once you locate your lab target’s channel, capture the 4-way WPA2 login handshake when devices authenticate:
airodump-ng -c 6 --bssid 00:11:22:33:44:55 -w handshake wlan0mon4. Deauthentication Packets
Auditors can send short deauthentication frames to simulate brief client drops, forcing them to reconnect and renegotiate the handshake immediately.
aireplay-ng -0 5 -a 00:11:22:33:44:55 -c AA:BB:CC:DD:EE:FF wlan0monDefensive Action: Upgrade to WPA3 protocols which protect against handshake dictionary attacks using Simultaneous Authentication of Equals (SAE).