Lesson 8 of 9

Wireless Security

Wireless networks introduce unique security challenges because radio signals cannot be physically contained and are accessible to anyone within range. You will learn how WEP, WPA, and WPA2 encryption work, why WEP is completely broken, and how to perform wireless attacks using Aircrack-ng. Understanding wireless vulnerabilities is essential for any network security professional.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "802.11 wireless security protocols" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Every attack and every defense happens over a network. Understanding how data actually travels between computers gives you the mental model to spot anomalies, intercept traffic, and understand why certain attacks work the way they do.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Wireless Security · Objective 1 of 4

VIDEO

Loading video…

Set up a test wireless network

Configure a WPA2-Personal wireless network using a home router or a wireless access point in your lab. Set a simple password from a common wordlist such as 'password123' so the cracking step will succeed in a reasonable time. Ensure no real devices are connected to this test network during the exercise, and never perform this exercise against a network you do not own. Note the SSID and BSSID (MAC address) of the access point, as you will need them to target the capture correctly.

Put your adapter in monitor mode

Run 'sudo airmon-ng check kill' to stop processes that may interfere with monitor mode, then run 'sudo airmon-ng start wlan0' to enable monitor mode on your wireless adapter. The adapter will be renamed to wlan0mon to indicate it is in monitor mode. Verify monitor mode is active by running 'iwconfig wlan0mon' and confirming the Mode field shows Monitor. Not all wireless adapters support monitor mode — if the command fails, you need a compatible adapter such as the Alfa AWUS036ACH, which is widely used in security labs.

Scan for networks

Run 'sudo airodump-ng wlan0mon' to scan for all nearby wireless networks. The output shows each network's BSSID, channel, encryption type, and SSID. Identify your test network in the list and note its BSSID and channel number — you will need both for the targeted capture in the next step. Press Ctrl+C to stop the scan once you have the information you need. A common mistake is running the capture on the wrong channel, which results in missing the handshake packets.

Capture the handshake

Run 'sudo airodump-ng -c <channel> --bssid <BSSID> -w capture wlan0mon' to start a targeted capture on your test network. To force a handshake without waiting for a client to naturally connect, open a second terminal and run 'sudo aireplay-ng --deauth 5 -a <BSSID> wlan0mon' to send deauthentication frames that disconnect the client and force a reconnect. When the handshake is captured, airodump-ng will display 'WPA handshake: <BSSID>' in the top-right corner of the output. The capture is saved to files named capture-01.cap which you will use in the next step.

Crack the handshake

Run 'sudo aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap' to attempt to crack the captured handshake using the rockyou wordlist. Aircrack-ng will test each password in the wordlist against the handshake until it finds a match or exhausts the list. The speed of cracking depends on your CPU — a modern laptop can test roughly 1,000–5,000 keys per second with aircrack-ng alone. If the password is in rockyou.txt, you will see 'KEY FOUND!' in the output, demonstrating why WPA2 with a weak or common password provides little real security.

Previous: Network Hardening Next Lesson