WiFi hacking with wifit3: the successor to Wifite2

A wireless network is the one door into your company that someone can rattle from the car park. No cable, no reception desk, no badge. Anyone within range can see the traffic and try to get in. That is why we test wireless networks during a WiFi pentest, and why it is worth understanding how an attack like this works.

In 2022 we published a detailed guide to Wifite2 on pentests.nl, a tool that automates most of that testing. It now has a successor that fundamentally changes the approach: wifit3. No more aircrack-ng, no fiddling with kernel drivers, and it runs just as well on Windows and macOS as it does on Linux. Attacks have been added that Wifite2 never had, including one that pushes WPA3 networks back to WPA2.

In this article you will read how to use wifit3, but above all what happens under the bonnet. Because once you understand why an attack works, you also know what to do about it.

Before you start. Everything in this article is meant for your own network, or for a network you have written permission to test. Attacking a wireless network that is not yours is a criminal offence. There is more about that at the bottom.

What do you need?

To follow along there is one thing you really do need: a USB WiFi adapter with a supported chipset. The built-in WiFi card in your laptop will not work. wifit3 is stricter about this than Wifite2, because wifit3 talks to the chip directly and carries a specific driver on board for it.

A few common choices:

If you want to test 5 GHz as well, and these days you do, pick a dual-band card. The full list of supported chipsets is on the wifit3 page and in the project documentation.

A second adapter is not a requirement, but it does help. wifit3 can work with several cards at once: one keeps listening while the other injects. That saves time and you miss less.

If you are working in a virtual machine, pass the adapter through to the VM rather than to the host system. In VirtualBox you add the device to the USB Filters beforehand. In VMware you connect it through VM, Removable Devices, and set the USB controller to USB 3.0 or higher in the settings, otherwise the adapter will not reach its full speed. If you skip this, your host system claims the adapter the moment you plug it in.

Installing wifit3

The quickest route is a ready-made binary from the releases page. You do not need a Python environment for it:

# Linux, draait zonder sudo
chmod +x wifit3-linux-x64
./wifit3-linux-x64

On Windows you run the .exe file. On macOS you first have to remove the quarantine flag:

xattr -d com.apple.quarantine wifit3-macos-universal2
chmod +x wifit3-macos-universal2
./wifit3-macos-universal2

Prefer to work from the source? The project uses uv:

git clone https://github.com/derv82/wifit3.git
cd wifit3
uv sync
uv run wifit3

On first launch wifit3 sorts out the hardware itself. On Linux it asks once for permission to write udev rules, on Windows it installs the WinUSB driver through UAC, and on macOS you only click Allow. So there is no need to get your hands dirty with airmon-ng, as there was with Wifite2.

Step 1: mapping the networks

Once it has started you pick your adapter and click START. wifit3 puts the card into monitor mode and begins hopping across the channels in both the 2.4 and the 5 GHz band. If you have several cards, it divides the bands between them.

What you get is a live overview of everything within range. For each network you see the name (ESSID), the channel, the signal strength, the encryption and the number of clients attached to it. wifit3 goes further than simply listing: it recognises the make and model of the access point from the WPS beacons, and shows whether a network is running WPA3 or sitting in transition mode.

That last point matters more than it seems, and we will come back to it later.

A nice touch is VAP decloaking. Many routers broadcast several networks from the same chip, for example a main network and a guest network. Those BSSIDs sit right next to each other. If the guest network is hidden, wifit3 can still show it by linking it to the visible neighbour on the same device. Hiding a network name is therefore not security.

Step 2: picking a target

You select your own network and wifit3 opens the focus view. There you see only that one access point, with the clients attached to it and a dashboard of the packet flows: beacons, data, injections and deauthentications.

From here you choose an attack. And that is exactly where it gets interesting, because every attack makes use of a different design flaw.

How does cracking WPA2 actually work?

This is the part that often gets skipped, even though it is the heart of the matter. You are not cracking “the WiFi”. You are cracking a password, offline, on your own computer.

The four-way handshake

When a device connects to a WPA2 network that uses a single shared password, as almost every home network and many office networks do, the access point and the client send four messages back and forth. In that exchange they prove to each other that they both know the password, without ever sending that password over the air. They use it as an ingredient in a calculation, and compare the results.

That is a clever design, but it has a consequence: anyone who captures those four messages has enough material to start guessing at home. You try a password, run the same calculation, and see whether the result matches. No match? Next password. With a GPU that happens millions of times per second.

So you need two things: a client that connects, and patience. The first you can usually force. With a deauthentication frame you knock a connected device off for a moment, unless the network uses Protected Management Frames (more on that below). The device barely notices, because it reconnects automatically, and that reconnection is exactly what hands you the handshake.

wifit3 exports the capture as .pcap and as .hc22000, the format Hashcat expects. It also checks straight away whether the capture is complete enough to crack, so you do not find out back at your desk that you have half a handshake.

PMKID: faster and a good deal quieter

In 2018 a method was added that skips the client. Many access points put a piece of key material, the PMKID, into the first message of the handshake. You can simply request that message by making a connection attempt yourself.

The difference is large. You do not need a connected client, you do not have to throw anyone off the network, and you are finished in seconds instead of waiting for someone to come along. For a pentest it is also tidier, because you disturb nobody. What you do afterwards is identical: guess offline against the captured material.

Not every access point hands out a PMKID. wifit3 tries both the active variant, where it associates itself, and passive listening.

WPS: the back door that skips the password

This is where it gets awkward. However strong your password is, an attacker simply walks around it if WPS is on and vulnerable.

WPS is meant to make connecting easy: press a button, or type in an eight-digit PIN. That PIN is the problem. Because of a design mistake it is checked in two halves, which means there are not 100 million combinations to try but roughly eleven thousand. That is a matter of hours.

But it can go faster still:

• PixieDust, described in 2014 by researcher Dominique Bongard, makes use of weak randomness in many access points. The numbers the device uses during the WPS exchange turn out to be predictable. That lets you work out the PIN offline, often within seconds, without thousands of attempts. wifit3 supports two variants of this.
• PushButton, officially called Push Button Configuration (PBC) in the WPS standard, waits for someone to physically press the WPS button. The access point then accepts a device that registers through WPS for two minutes. If you are within range during those two minutes and register, the access point sends you the WPA password. No cracking is involved.

The result is the same in every case: you end up with the real password for the network. A key of 63 random characters does nothing against that. This is why “turn WPS off” is always the first piece of advice.

The newest attack: EvilTwin WPA3 downgrade

This is the attack that wifit3 has and Wifite2 does not, and it deserves an explanation.

WPA3 solved the biggest problem with WPA2. By using a different protocol for the key exchange, SAE, there is nothing left in a captured handshake to guess at offline. In theory, then, cracking is over the moment you switch WPA3 on.

In practice, almost every WPA3 network sits in transition mode. The access point accepts WPA3 and WPA2 at the same time, so that older devices can still connect. And that is where the opening is.

The attack works like this. wifit3 clones the access point and broadcasts the same network name, but with only WPA2 in it. It then pushes the clients off the real network. It does that not only with deauthentication, but also with legitimate protocol features that are harder to block: a Channel Switch Announcement, which tells the device that the network is moving to a different channel, and BSS Transition Management, which politely refers the device to another access point.

The device tries to reconnect and sees the clone. Many devices fall back to WPA2 at that point and connect to the clone. The handshake that results is an ordinary WPA2 handshake, and you can crack that offline.

So you are not getting around the encryption in WPA3. You are making sure WPA3 is never used at all.

Step 3: cracking the handshake

A captured handshake is not a password yet. It is evidence you can guess against. You do that with Hashcat, preferably on a machine with a decent GPU:

hashcat -m 22000 vangst.hc22000 /usr/share/wordlists/rockyou.txt

If the password is in your word list, it falls out within minutes. If it is not, you can apply rules that generate variations, or move on to brute-forcing a specific pattern.

If the cracking does not work, the password was not in your word list and was not found with the rules you tried. A different word list or different rules may still succeed, so it is not uncrackable. In a pentest report, “handshake captured, not cracked within the agreed time” is a perfectly good finding.

How do you protect your network against this?

Everything above adds up to a short list of measures. In this order.

Turn WPS off. This is the most important one. PixieDust cracks a vulnerable access point in seconds, and at that point the length of your password no longer matters. Check it in the admin interface of your router, and do not forget the guest networks.

Use a long, random WPA2 key. No dictionary word, no company name with a year stuck on the end. A passphrase of four or more random words, or twenty random characters, cannot be cracked in any reasonable time, even with a fast GPU. Once someone has captured your handshake, only a strong password still helps.

Switch WPA3 on with Protected Management Frames. PMF signs management frames, which means stray deauthentication frames get ignored. That makes forcing a new handshake much harder.

Disable transition mode as soon as you can. This is almost always forgotten. Devices that use WPA3 are better protected by it, but as long as your access point also offers WPA2, an attacker can try to push them back. Work out which devices cannot handle WPA3 yet, put those on their own network, and set the rest to WPA3 only.

Separate your networks. Guests, smart devices and business systems do not belong on the same network. If someone does manage to get in, that separation determines how far they get.

Watch the airwaves. Deauthentication frames, and an access point that suddenly appears twice on a different channel, are not part of normal traffic. A wireless intrusion detection system picks this up.

If you want to see the two tools side by side, the full comparison is on the Wifite2 and wifit3 pages in our glossary.

In closing

WiFi security has improved considerably over ten years, but the weakest link is rarely the encryption itself. It is a forgotten WPS button, a password that someone thought was “easy to remember”, or a transition mode that is switched on because there was once a single old printer on the network.

If you want to know what there is to be had within range of your own building, a WiFi pentest maps it out. We run exactly these attacks, in consultation and within an agreed scope, and deliver a report with what was found and how to fix it.

One final warning. Attacking a wireless network that is not yours, or that you have no permission to test, is a criminal offence. Deauthentication and EvilTwin attacks also actively break the connections of bystanders who have nothing to do with your test, including neighbours and passers-by. Only test your own network, or put permission in writing before you begin.