WEP (Wired Equivalent Privacy) Simulator
Understand why the 24-bit Initialization Vector (IV) makes WEP highly insecure.
1. Sniffing and Packet Injection
WEP uses the RC4 stream cipher. Because the IV is only 24 bits long, the same IV is reused frequently on busy networks. Attackers inject ARP packets to force the router to send new packets, rapidly collecting duplicate IVs.
Network Traffic Visualizer
2. Decryption & Key Recovery
Once enough IVs are collected (generally 20,000 - 50,000 packets for a 64-bit WEP key), the correlation between the key bytes and the IVs allows the secret key to be derived instantly.
WPA2 Deauth & Handshake Dictionary Attack
Simulate sending deauthentication packets to capture the 4-way handshake, then perform a dictionary attack.
1. Send Deauth & Capture Handshake
WPA2 management frames are unencrypted by default. Attackers can forge a "deauth" packet from the router to the client, forcing them off the network. When they reconnect automatically, the attacker sniffs the 4-way handshake.
Attack Animation
2. Dictionary Attack on Captured Handshake
The 4-way handshake includes hashes derived from the Wi-Fi passphrase. Since WPA2 relies on a shared secret (WPA2-PSK), attackers run dictionary attacks offline without interacting with the network.
Rogue Access Point & Evil Twin Attack
Understand how client devices auto-connect to cloned Wi-Fi access points with stronger signals.
1. Create Cloned AP (Evil Twin)
An Evil Twin is a rogue AP configured with the same SSID (network name) as a legitimate network. Because clients naturally roam and connect to the strongest signal, the attacker can force connection hijacking by boosting transmission power.
Active Signal & Roaming Analysis
2. Captive Portal Credential Harvesting
Once connected to the Evil Twin, the attacker displays a fake captive portal page requesting credentials (e.g. "Firmware Update Required" or "WPA Re-authentication").
Bluetooth Vulnerabilities (Bluesnarfing & Bluejacking)
Understand RF discovery threats, unsolicited message spam, and unauthorized data theft.
1. Target Bluetooth Settings
Bluetooth devices are secure when discovery is disabled. If a device is in "Discoverable" mode, attackers within range (approx. 10 meters) can map the device's hardware address (BD_ADDR).
2. Execute Bluetooth Exploit
Select an exploit to deploy against the discovered target:
Bluetooth Terminal Logs
Wi-Fi & RF Security Mitigation Hub
Test your knowledge and configure settings to protect wireless networks from these attacks.
Router & Device Hardening Configuration
Toggle security options on the simulated systems and see how the defense status changes.
Network Security Shield
VULNERABLE
Your network has critical vulnerabilities that allow easy cracking.
Security+ Wireless Key Takeaways
Bluejacking is sending unsolicited messages to Bluetooth-enabled devices (annoying but harmless). Bluesnarfing is the unauthorized access of information (contacts, emails, text messages) from a wireless device over a Bluetooth connection.
Bluebugging goes beyond stealing files (snarfing); it allows an attacker to take complete control of the device, make phone calls, send messages, and listen in on conversations.
Client devices save Wi-Fi profiles and automatically reconnect to matching SSIDs. They select the access point with the highest RSSI (received signal strength indicator). Evil twins use high-gain antennas to override legitimate APs.
RFID (Radio Frequency Identification) covers broad tracking, sometimes over long distances. NFC (Near Field Communication) is a subset of RFID limited to close proximity (under 10cm), commonly used for contactless payments. Both are vulnerable to skimming unless shielded.