OffSec Wireless Professional cheat sheet

802.11 PHY generations and bands: 802.11b/g 2.4 GHz (DSSS/ERP-OFDM), 802.11a 5 GHz OFDM, 802.11n (HT) 2.4/5 GHz with MIMO, 802.11ac (VHT) 5 GHz only, 802.11ax (HE) 2.4/5/6 GHz.

Channel width: 20 MHz legacy; 802.11n bonds 40 MHz; 802.11ac supports 80 and 160 MHz; wider channels reduce the number of non-overlapping channels available.

2.4 GHz non-overlapping channels are 1, 6, and 11 (each 22 MHz wide with 5 MHz spacing); 5 GHz UNII-1/UNII-3 channels are effectively non-overlapping at 20 MHz.

BSS = one AP plus associated stations identified by BSSID (AP MAC); ESS = multiple BSSs sharing one SSID joined by a distribution system; IBSS (ad-hoc) has no AP.

Management frames (beacon, probe request/response, authentication, association, deauthentication) are unprotected by default under the original 802.11 standard.

802.11i defines RSN: WPA2 uses CCMP/AES with 4-way handshake; WPA used TKIP with RC4. WPA3 adds SAE (dragonfly) and PMF (802.11w) for management-frame protection.

Security modes: open, WEP (RC4 + 24-bit IV), WPA-PSK, WPA2-PSK/Enterprise (802.1X/EAP), WPA3-SAE; Enterprise offloads authentication to a RADIUS server.

Beacon frames advertise SSID, supported rates, RSN/WPA information elements, and channel; hidden SSIDs omit the SSID field in beacons but still leak it in probe responses and association frames.

Monitor mode captures all 802.11 frames on a channel without associating; managed mode only receives frames addressed to the station.

Airmon-ng start creates a monitor interface (e.g., wlan0mon); airmon-ng check kill stops NetworkManager/wpa_supplicant that can reset monitor mode.

Airodump-ng -w --bssid -c writes cap files; the WPA handshake is confirmed by 'WPA handshake: ' in the header.

Airodump-ng columns: BSSID, PWR, Beacons, #Data, CH, MB, ENC, CIPHER, AUTH, ESSID; high #Data with low beacons indicates active traffic.

Kismet is a passive detector using multiple sources; it logs .kismet (pcapng-compatible) files and can detect rogue APs, hidden SSIDs, and client probing.

Wireshark display filters: wlan.fc.type_subtype == 0x08 (beacon), == 0x04 (probe request), == 0x0b (auth), == 0x0c (deauth), eapol for the 4-way handshake.

Capture conversion: airdecap-ng decrypts WEP/WPA captures when the key is known; aircrack-ng reads cap/pcap and tests passphrases against the captured handshake.

Channel hopping in airodump-ng is disabled with -c ; fixing the channel improves handshake and PMKID capture reliability.

WEP: 24-bit IV space causes IV reuse; FMS/PTW attacks recover the key from enough unique IVs (PTW needs roughly 20k-40k packets).

WPA/WPA2-PSK: the 4-way handshake (ANonce, SNonce, MIC, GTK) yields material for offline dictionary attack via aircrack-ng or hashcat mode 22000 (hcxdumptool/hcxtools).

PMKID attack: hcxdumptool captures the PMKID from the first EAPOL message without a full handshake; hashcat mode 22000 cracks it offline.

WPS PIN: 8-digit PIN validated in two halves (first 4, last 4), reducing brute-force to about 11,000 attempts; tools include reaver and bully.

WPS PBC and PIN methods; WPS lockout after failed attempts is common on modern APs, so reaver --no-nacks and MAC changes may be needed.

WPA3-SAE resists offline dictionary attacks; downgrade/transition-mode attacks target mixed WPA2/WPA3 APs that still permit WPA2 clients.

KRACK (2017) targets the 4-way handshake key reinstallation; it requires a client-side patched supplicant and does not recover the PSK.

WEP key lengths: 40-bit (5 ASCII/10 hex) and 104-bit (13 ASCII/26 hex); the effective key is shorter than the advertised strength due to the 24-bit IV.

Deauthentication frames (subtype 0x0c) are unauthenticated management frames; aireplay-ng --deauth -a -c forces reconnection and handshake capture.

Aireplay-ng -0 with a broadcast client (-c FF:FF:FF:FF:FF:FF) deauths all clients; targeted deauth is less noisy and more reliable.

802.11w (PMF) protects deauth/disassoc frames; WPA3 mandates PMF, making classic deauth ineffective against PMF-capable clients.

Evil twin: a rogue AP clones the target SSID/BSSID and channel; clients associate, and a captive portal or fake RADIUS captures credentials.

Rogue AP detection compares authorized BSSIDs against observed beacons; Kismet and WIDS flag unknown BSSIDs and duplicate SSIDs on unexpected channels.

Hostapd and airbase-ng create soft APs; dnsmasq provides DHCP/DNS for the rogue network, and iptables NAT forwards client traffic.

KARMA attack responds to client probe requests with a matching SSID, luring clients that remember the network; MANA improves on KARMA with beacon responses.

Deauth + reassociation forces the 4-way handshake; capture must be on the same channel as the target AP, and the client must reconnect.

Monitor mode and packet injection depend on chipset and driver; common injection-capable chipsets: Atheros AR9271, Ralink RT3070/RT3572, Realtek RTL8812AU/RTL8814AU, and Intel not generally.

Atheros AR9271 (ath9k_htc) supports 2.4 GHz monitor/injection; RTL8812AU supports 2.4/5 GHz with out-of-tree drivers (e.g., aircrack-ng/rtl8812au).

Check injection with aireplay-ng --test ; check monitor support with iw list or iwconfig.

mac80211 is the Linux kernel 802.11 stack; cfg80211 is the configuration layer, and drivers register with cfg80211 and implement mac80211 ops.

nl80211 is the netlink interface used by iw, hostapd, and wpa_supplicant to configure interfaces; iw replaces the deprecated wireless-tools.

iw dev set monitor none and ip link set up enable monitor mode; iw phy info lists supported interface modes.

Interface naming: phy0 is the hardware, wlan0 the netdev; one phy can host multiple virtual interfaces (AP + monitor) if the driver supports combinations.

Driver modules: ath9k_htc, rt2800usb, rtl88xxau; lsusb/lspci identify hardware, dmesg and lsmod confirm the loaded driver.