Stats
Actions
Tags
From cybersec-toolkit
Explains KRACK and FragAttacks against WPA2 supplicants, covering Vanhoef's test scripts and practical viability against legacy embedded/IoT devices.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:offensive-krack-fragattacksThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
Two attack families against WPA2 client implementations. Both well-disclosed (KRACK 2017, FragAttacks 2021) and largely patched on modern OSes — but the embedded/IoT long tail keeps them in scope for many engagements.
| Family | Target | Patch Status |
|---|---|---|
| KRACK | WPA2 supplicants in 4-way handshake / GTK / FT / TDLS | Major OSes patched 2017–2018 |
| FragAttacks | Frame fragmentation/aggregation across WPA2/3 | Most stacks patched 2021–2022 |
Probability of success today is high only against:
Modern Win11 / iOS 16+ / Android 13+ / hostapd-2.10 are mitigated.
The 4-way handshake's M3 retransmission causes the supplicant to reinstall the same PTK with reset nonce/replay counters. Frames encrypted under the reused keystream become decryptable.
# Vanhoef's official test scripts
git clone https://github.com/vanhoefm/krackattacks-scripts
cd krackattacks-scripts/krackattack
sudo ./krack-test-client.py --interface wlan0
# Tests the supplicant on a connected client
Output identifies which CVE variants the client is vulnerable to.
When successful:
Not a PSK recovery — you don't get the wireless password from KRACK.
FragAttacks abuse 802.11 fragmentation and aggregation to inject frames that mix encrypted and plaintext fragments, or to splice attacker-controlled fragments into legitimate frames.
git clone https://github.com/vanhoefm/fragattacks
cd fragattacks
sudo ./test-fragattacks.py wlan0 --interface wlan0
# Suite of ~12 tests covering each variant
| CVE | Mechanism |
|---|---|
| CVE-2020-24588 | A-MSDU spoofing — inject crafted A-MSDU subframes |
| CVE-2020-24587 | Mixed-key fragment cache poisoning |
| CVE-2020-24586 | Decoupled fragment cache → reuse |
| CVE-2020-26139 | Forwarding plaintext frames before authentication |
| CVE-2020-26140 | Accepting plaintext frames in protected network |
# Rogue AP that drives the test
sudo hostapd-mana /tmp/krack_test_ap.conf
# Force client to associate (deauth from real AP, or social-engineer)
sudo aireplay-ng --deauth 5 -a <real-BSSID> -c <client-MAC> wlan0mon
# Run test once associated
sudo ./krack-test-client.py --interface wlan0
For each vulnerable CVE:
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitWireless/802.11 attack methodology for red team engagements and security assessments. Covers handshake capture, PMKID, WPA3 downgrade, EAP attacks, evil twin, KRACK, and more.
Conducts authorized WiFi penetration tests assessing weak encryption, captive portals, evil twin attacks, WPA2/WPA3 handshakes, rogue APs, client attacks, authentication, segmentation, and WIDS effectiveness.
Conducts authorized wireless network penetration tests assessing WiFi security including encryption weaknesses, captive portal bypass, evil twin attacks, WPA2/WPA3 handshake capture, rogue AP detection, and client-side attacks.