WPA3
By mohsin quresh
THIS PRACTICAL GUIDE EXAMINES WPA3 FROM A HANDS-ON PERSPECTIVE: IT EXPLAINS CORE FEATURES
(SAE/DRAGONFLY, MFP, OWE), LISTS LAB HARDWARE/SOFTWARE, AND WALKS THROUGH ATTACK SIMULATIONS
DOWNGRADE, ROGUE APS, DEAUTH, AND HANDSHAKE CAPTURE WHILE STRESSING ETHICAL, CONTROLLED
TESTING. IT ENDS WITH MITIGATIONS: PATCHING, STRONG PASSPHRASES, DISABLING FALLBACKS, AND
PREFERRING 802.1X.
@MOHSINQURESHOFFICIAL MOHSINMTJ@[Link] MOHSIN-QURESH
h
s
re
u
q
THIS PRACTICAL
in
s
GUIDE EXAMINES
h
o
WPA3 FROM A
M
HANDS-ON
PERSPECTIVE
WHOMAI?
h
s
re
I AM MOHSIN QURESH, A CYBERSECURITY
PROFESSIONAL WITH EXTENSIVE
u
EXPERIENCE IN SECURITY RESEARCH,
q
PENETRATION TESTING, AND THREAT
ANALYSIS. I ACTIVELY CONTRIBUTE AS A
in
DEF CON GURGAON CHAPTER REVIEW
s
BOARD MEMBER. I AM ALSO A SECURITY
h
SME AT HACK THE BOX (HTB) AND A
o
CHAPTER ADVISOR FOR 0X0PIRATES AT
M
JAMIA HAMDARD. MY WORK FOCUSES ON
BRIDGING PRACTICAL CYBERSECURITY
RESEARCH WITH HANDS-ON TRAINING,
HELPING STUDENTS AND PROFESSIONALS
BUILD STRONG DEFENSIVE AND
OFFENSIVE SECURITY SKILLS.
OVERVIEW
h
WPA3 was launched as the next step in Wi-Fi security,
s
aiming to fix the known flaws in WPA2 and protect
re
users with stronger encryption and better privacy. But
in cybersecurity, no protocol is ever fully
u
“unbreakable.” This practical guide dives into how
q
WPA3 behaves under real-world testing not to
in
criticize, but to understand its strengths and where it
can still be exploited. Through practical attacks like
s
forced downgrades, handshake captures, and rogue
h
access points, we explore how secure WPA3 really is
o
when put to the test. This content is designed to help
M
students and ethical hackers learn, simulate, and
analyze WPA3 weaknesses in a controlled lab
environment and ultimately build better defenses.
INTRODUCTION
h
Wi-Fi is everywhere. From classrooms to coffee shops,
s
our devices are constantly connecting through
re
invisible airwaves and that makes wireless security a
critical part of modern cybersecurity learning. Over
u
the years, we’ve seen WEP fall, WPA get bypassed,
q
and even WPA2 once trusted become vulnerable to
attacks like KRACK.
in
s
That’s where WPA3 comes in. It was introduced to
h
close the gaps, especially with stronger encryption,
o
protection in public networks, and a new handshake
M
called SAE (Simultaneous Authentication of Equals).
On paper, it sounds like a solid improvement but how
does it hold up in real-world scenarios?
This content isn’t about theory. It’s meant for hands-
on learning. Whether you’re a student, an ethical
hacker, or just someone curious about Wi-Fi security,
the goal is to explore WPA3 by actually testing it.
You’ll learn how attackers can still find cracks in the
system and how defenders can patch them. We’ll
break down tools, setups, and step-by-step attack
simulations all done ethically, in lab-safe
environments to help you truly understand WPA3
from a practical point of view.
Understanding
WPA3 –Theoretical
h
s
Foundations
re
u
WPA3 (Wi-Fi Protected Access 3) is the latest
q
security protocol designed to protect wireless
networks. It was introduced to solve the real-world
in
security problems seen in WPA2 especially those
s
exposed in attacks like KRACK (Key Reinstallation
h
Attack). Let’s break down the key components that
make WPA3 different and stronger.
o
M
1. SIMULTANEOUS AUTHENTICATION OF EQUALS (SAE)
SAE replaces the old 4-way handshake from
WPA2.
It’s also known as the “Dragonfly Handshake.”
Unlike WPA2, SAE ensures that even if someone
records your handshake, they can’t crack it easily
offline.
Unlike WPA2, SAE ensures that even if someone
records your handshake, they can’t crack it easily
offline.
This provides resistance to offline dictionary and
brute-force attacks.
Think of SAE as a smarter way for devices to shake
hands without whispering the password too loud.
2. Forward Secrecy
This is a critical improvement.
It ensures that even if someone gets hold of your
h
Wi-Fi password later, they can’t decrypt past
s
data they’ve already captured.
re
Each session uses a unique encryption key that
u
isn’t reused.
q
So even if an attacker breaks in tomorrow, your data
from yesterday is still safe.
in
3. Management Frame Protection (MFP)
s
In older Wi-Fi protocols, attackers could send
h
deauthentication or disassociation packets
o
(common in Evil Twin or deauth attacks).
M
With WPA3, MFP makes those management
frames signed and verifiable.
This prevents spoofing attacks where users get
forcefully disconnected or tricked into joining
rogue networks.
No more “Wi-Fi kicked me off randomly” it might have
been an attacker before, but MFP helps block that.
4. Enhanced Open (OWE)
Public Wi-Fi (like in cafes or airports) has always
been risky.
h
WPA3 includes Opportunistic Wireless Encryption
s
for open networks called OWE.
re
It encrypts your traffic even if the network has no
u
password.
q
While you won’t have authentication, your data is
at least encrypted, making snooping much harder.
in
Now when you connect to a café Wi-Fi, your traffic
s
isn’t exposed in plain text anymore.
h
o
M
h
s
re
u
q
in
s
h
Lab Setup & Practical
o
M
Tools for WPA3 Testing
This section will help students or beginner pentesters
h
build their own controlled lab environment to safely
s
simulate and analyze WPA3 attacks. We’re not
re
breaking laws here just learning how attackers think,
so we can defend better.
u
q
[Link] Requirements
in
WI-FI ADAPTER THAT SUPPORTS MONITOR MODE + INJECTION
s
Recommended:
h
o
Alfa AWUS036ACH
M
TP-Link Archer T4U v3 (AC1300)
TP-Link Archer T3U AC1300 Wi-Fi adapter.
Laptop or Raspberry Pi (Kali Linux Preferred)
Must support 802.11ac (for WPA3) and Linux
compatibility.
h
s
re
u
q
in
s
h
o
M
Access Point / Router with WPA3 Support
Example: TP-Link Archer AX10 / AX20, D-link R12
or any dual-band router with WPA3 Personal.
D-link R12 Eagle Pro Ai Smart WiFi Internet Router
h
s
re
u
2. Software Tools for Testing WPA3
q
in
Tool Use Case
s
h
Capture packets, monitor traffic,
Aircrack-ng
o
perform handshake capture
M
Create custom access points (can
Hostapd
simulate rogue APs)
Packet injection stress tests
mdk4
MFP/broadcast frame resilience
h
s
re
u
q
in
s
h
SETTING UP THE LAB
o
M
(QUICK STEPS)
Step 1: Configure Your Router
Enable WPA3-Personal mode
h
Set the passphrase
s
Disable mixed mode (if available), so only WPA3 is
re
tested
u
q
in
s
h
o
M
Step 2: Boot Kali Linux
h
s
re
u
You need to update your Linux machine.
q
in
s
h
o
Now let’s install all the required tools in Kali. Some
M
tools like Aircrack-ng is already pre-installed in Kali
Linux by default. However, some tools need to be
installed manually. These include hostapd and mdk4.
h
s
re
u
q
in
s
h
Let’s get started
o
M
with the practical.
PRACTICAL DOWNGRADE ATTACK ON
WPA3 WI-FI USING MDK4, HOSTAPD,
AND AIRCRACK-NG
h
s
DISCLAIMER
re
This attack was performed strictly within an
u
isolated lab environment on my own test network
q
using authorized devices. The purpose of this
demonstration is purely educational and research-
in
based.
s
All tools and techniques used in this practical were
h
intended to:
o
M
Understand the security weaknesses in WPA3
transition mode
Explore how misconfigured clients or access
points can fall back to insecure protocols
Highlight the importance of proper WPA3
configurations and avoiding downgrade risks
At no point was any unauthorized or unethical activity
carried out on external networks or devices.
⚠️ Note: Unauthorized access or testing on networks
you do not own or have permission to audit is illegal and
unethical. Always conduct penetration testing in a
safe, controlled, and legal environment.
TOOLS USED IN DOWNGRADE ATTACK
SCENARIO
h
s
Tool Purpose
re
u
Capturing and cracking the WPA2
Aircrack-ng
q
handshake
in
Creating a fake WPA2 Access
Hostapd
Point (Rogue AP)
s
h
Forcing client disconnection
mdk4
o
(Deauthentication attack)
M
Downgrade Attack Workflow
The attacker targets a WPA3-secured Wi-Fi network.
First, the connected client is forcibly disconnected by
sendingdeauthentication frames using tools like
mdk4. Immediately after, the attacker sets up a rogue
WPA2 access point (AP) using the same SSID as the
original WPA3 network, broadcasted via hostapd.
Since WPA3 devices in transition mode may fall back
to WPA2, the client unknowingly reconnects to the
fake WPA2 AP. Once connected, the attacker uses
aircrack-ng or similar
tools to capture the WPA2 4-way handshake. Finally,
the handshake is brute-forced using a wordlist to try
and recover the Wi-Fi password.
h
s
re
u
q
in
s
h
o
M
Recommended: 2 Wi-Fi adapters
Why Two Cards?
Card 1
Monitor Mode (mdk4 + airodump-ng)
Why It Help
For sniffing packets, deauthing clients, capturing
handshakes
Card 2
AP Mode (hostapd WPA2 Rogue AP)
h
Why It Help
s
To broadcast the fake WPA2 Access Point
re
u
q
in
s
h
o
M
Enable Monitor Mode on Wi-Fi Adapters
sudo airmon-ng start <wifi-card-name>
1st done
2nd done
NOW LET’S FIND OUR TARGET WIFI
USING AIRODUMP-NG
h
s
re
u
q
in
Launch Deauthentication Attack Using mdk4:
s
First, create a target file and edit it to include the AP's
h
BSSID (MAC address). This file will be used by mdk4
o
to specify the access point to target.
M
Option Breakdown
wlan0: Wi-Fi interface in monitor mode
d: Deauthentication attack mode
-b [Link]: Target BSSID list file
-c 6: Channel of target AP
-s 100: Speed (100 packets/sec)
For the target client, I used my cellphone and
attached its screenshot as evidence.
h
s
re
u
q
in
s
h
o
M
As you can see, the device automatically disconnects
from Wi-Fi, and when I try to reconnect, it shows a
'connection failed'
Now let's create a fake WPA2 access point, i.e.,
perform a WPA2 rogue AP attack using hostapd. First,
h
create a config file named rogue_ap.conf at the path
s
/etc/hostapd/ using the command
re
sudo nano /etc/hostapd/rogue_ap.conf
u
q
in
s
h
o
M
After configuration, run hostapd with the config file
Purpose: Broadcast a WPA2 AP with the same SSID
as the WPA3 AP.
h
s
re
u
q
in
s
As you can see, both access points are running the
h
first is the real AP and the second is the fake one. The
o
client connects to the fake AP because mdk4 is
M
continuously sending deauthentication packets to the
real AP. As a result, the only available option for the
client is to connect to the rogue AP.
Now let's find the BSSID of the rogue AP. The question
is, why are we doing this? The actual plan is to capture
the handshake. When the client tries to connect to the
fake AP, it asks for the password again. If the client
enters the correct password, we are ready to capture
the handshake using airodump-ng.
h
s
re
u
q
As you can see, the rogue AP is running with WPA2,
and we have identified its BSSID. Now, let's proceed to
in
capture the handshake.
s
airodump-ng --channel 7 --bssid FA:KE:AP:MA:CA:DD
h
--write capture wlan0
o
M
Option Breakdown
--channel 7: Lock to channel 7 (same as rogue AP)
-bssid: Target BSSID (MAC) of the fake AP
--write capture: Save the captured handshake to a
file named [Link]
wlan0: Your Wi-Fi interface (in monitor mode)
Now wait for the client to connect to the rogue AP and
capture the handshake
Bingo! We got it the WPA handshake has been
captured.
h
s
re
u
As you can see, the capture file exists in this directory.
q
in
s
h
Now let's crack the handshake. If the password is
o
weak, it can be easily cracked. For the wordlist, I’m
using CrackStation, which contains real human-like
M
passwords mostly names, numbers, phone numbers,
and other common patterns. It’s one of the best
wordlists for this purpose.
h
s
re
u
q
in
s
h
o
M
Bingo! We finally found the key — it's 'facebook'
h
s
re
u
q
in
Now the main point
s
h
is how can we stay
o
M
secure against this
type of attack?
h
s
re
u
Educate Users q
in
Teach users not to reconnect blindly to networks
s
with the same name.
h
Encourage verifying if their device is using WPA3
o
before entering passwords.
M
Use Strong, Non-Human Passwords
Even if someone captures the WPA2 handshake,
they still need to crack the password.
A strong, complex password can block that step
entirely.
h
s
re
u
q
in
If you are interested in conducting research on any cybersecurity topics whether it
involves custom code, custom tools, or open-source solutions you are welcome to
s
reach out to me directly, and I will be glad to assist.
h
o
I would greatly appreciate your feedback, as it will help me create more practical and
accessible playbooks and handbooks in the future.
M
0x0pirates 0x0pirates DCG 91124
Global Cybersecurity Collective Jamia Hamdard Chapter DEF CON Gurugram
M
o
h
s
in
q
u
re
s
h