Wireless — Learning Path

Start Here — Foundations — no experience assumed

Recon a same-network target with Wireshark and Nmap, crack SSH with Hydra, then flip to the defender's view. 7 steps, every command explained.

MAC spoofing, DNS tunnelling, and other captive portal evasion techniques.

Capture 4-way handshake and crack with hashcat GPU-accelerated wordlists.

IV collection and statistical WEP key recovery with aircrack-ng.

hostapd-wpe captive portal, SSL strip, and credential capture via rogue AP.

Monitor mode, packet capture, deauth attacks, and WPA2 handshake cracking.

WPA2/WPA3, evil twin, deauth attacks, captive portal bypass, and WPS attacks.

Reaver and Bully WPS PIN brute force against vulnerable routers.

Dragonblood side-channel attacks and WPA3 transition mode weaknesses.

BLE scanning, GATT attribute enumeration, and Bluetooth relay attacks.