Wiki / Wireless / Aether

Aether

Wireless v1.25.1 — Five-phase wireless pentest orchestrator — WPA/WPA2/WPA3 handshake capture, WPA-Enterprise credential harvesting, Dragonblood, and KRACK testing.
14
Dependencies
11
Phases
73
Catalogue Findings
AETHER
Finding Prefix

How It Works

⚠️ Authorized Testing Only

This tool interacts with live systems and must only be used for testing that has been explicitly authorized by the asset owner. Unauthorized use of this tool to probe, scan, exploit, or otherwise interact with systems you do not have written permission to test is illegal under computer fraud and abuse laws (CFAA, CMA, and international equivalents). pr0t31n does not condone or recommend any unauthorized use. Always obtain a signed Rules of Engagement (RoE) or Statement of Work (SoW) before beginning any assessment.

Aether is a multi-phase wireless penetration testing orchestrator that automates the complete lifecycle of Wi-Fi security assessments. It targets WEP, WPA, WPA2, WPA3, and WPA-Enterprise networks through a structured sequence of attack phases, each leveraging purpose-built wireless security tools.

The assessment begins with legacy protocol attacks (Phase 0: WEP IV capture and key cracking via the aircrack-ng suite), then progresses through modern WPA/WPA2 attacks including clientless PMKID capture with hashcat cracking (Phase 1a) and traditional handshake capture with WPS testing via wifite2 (Phase 1b). Phase 2 targets WPA-Enterprise environments by deploying a rogue access point with EAPHammer to harvest credentials, cracking captured hashes with asleap.

Advanced phases target WPA3-specific vulnerabilities: Phase 3 tests SAE (Simultaneous Authentication of Equals) cryptographic weaknesses using dragonslayer, Phase 4 evaluates SAE resource exhaustion via dragondrain, and Phase 5 tests for WPA2 KRACK (Key Reinstallation Attack) vulnerabilities using krackattacks-scripts. Each phase emits structured findings with SSID, BSSID, and wireless-specific metadata to the universal findings schema.

Aether operates under Crucible management when the CRUCIBLE_MANAGED environment variable is set, emitting __SPECTRE_LOG__, __SPECTRE_STATUS__, __SPECTRE_FINDING__, and __SPECTRE_PROMPT__ protocol tokens for real-time progress tracking. It supports checkpoint/resume for long-running wireless captures and writes all output to the universal pr0t31n directory structure.

Phase Pipeline

  1. Phase 0 — Runs a dedicated airodump-ng scan with parallel WPS detection (wash). For every AP broadcasting the target SSID(s): - captures full metadata (encryption, cipher, auth, signal, beacons) - identifies every connected client station - scores each AP (signal + client count) - selects the best target Writes access_points.json to output_dir. Returns (best_ap, all_enriched_aps).
  2. Phase 2 — WPA-Enterprise Attack
  3. Phase 3 — WPA3 SAE Testing
  4. Phase 4 — WPA3 Resource Exhaustion
  5. Phase 5 — KRACK Testing
  6. Phase 6 — Rogue AP / Evil Twin
  7. Phase 7 — Client-Side / Management Frame Attacks
  8. Phase 8 — EAP Downgrade Attack
  9. Phase 9 — SAE Transition Mode Downgrade
  10. Phase 10 — Post-Connection Attacks
  11. Phase 11 — Legacy / Niche Attacks

Security

Requires root/sudo for monitor mode and packet injection. CLI tool with no web interface. WiFi adapter must support monitor mode and injection.

Features

Enterprise Attacks

Rogue AP & Credential Harvest
Phase 2: Deploys a rogue access point mimicking the target WPA-Enterprise network using EAPHammer, harvesting RADIUS credentials and cracking captured hashes with asleap.

Integration

Crucible/Spectre Management
Full integration with Crucible v2 via __SPECTRE_* protocol tokens for real-time log streaming, status updates, finding emission, and interactive prompts.

Key Reinstallation

KRACK Attack Testing
Phase 5: Tests WPA2 implementations for Key Reinstallation Attack (KRACK) vulnerabilities where nonce reuse in the four-way handshake can compromise encryption, using krackattacks-scripts.

Output

Universal Findings Schema
Emits findings in the pr0t31n universal schema (v1.1) with wireless-specific fields including SSID, BSSID, and wireless_data for proper cataloguing.

Reliability

Checkpoint & Resume
Persists phase completion state to checkpoint.json, allowing interrupted assessments to resume from the last completed phase.

WEP Attacks

WEP IV Capture & Crack
Phase 0: Captures WEP initialization vectors using airodump-ng and cracks the WEP key with aircrack-ng, targeting legacy wireless networks still using deprecated encryption.

WPA/WPA2 Attacks

PMKID Clientless Capture
Phase 1a: Captures PMKID hashes from access points without requiring a connected client, using hcxdumptool for capture and hashcat for offline cracking.
Handshake Capture & WPS
Phase 1b: Captures WPA/WPA2/WPA3 four-way handshakes and tests WPS PIN vulnerabilities using wifite2 as the orchestration layer.

WPA3 Attacks

SAE Cryptographic Testing
Phase 3: Tests WPA3 SAE (Dragonfly) handshake for cryptographic vulnerabilities including side-channel attacks and invalid curve attacks using dragonslayer.
SAE Resource Exhaustion
Phase 4: Evaluates WPA3 access points for susceptibility to SAE commit message flooding that can cause denial of service, using dragondrain.

Use Cases

Comprehensive Wireless Security Assessment

Run a full multi-phase assessment against all wireless networks in scope, testing WEP through WPA3 protocols and WPA-Enterprise configurations to identify cryptographic weaknesses, configuration flaws, and protocol-level vulnerabilities.

WPA3 Readiness Validation

Focus on Phases 3-4 to validate that WPA3 deployments are properly implemented and resilient against known SAE vulnerabilities including dragonblood-class attacks.

Enterprise Wireless Credential Harvesting

Deploy Phase 2 rogue AP testing to validate that WPA-Enterprise environments are resistant to evil twin attacks and that clients properly validate RADIUS server certificates.

Legacy Protocol Identification

Run Phase 0 to identify and demonstrate the risk of any remaining WEP networks, providing concrete evidence for upgrade recommendations.

KRACK Patch Verification

Execute Phase 5 against WPA2 infrastructure to verify that all access points and clients have been patched against Key Reinstallation Attacks.

CLI Reference

Command Examples

Full Assessment

sudo python3 aether.py --settings settings.json

Run all WiFi attack phases with a settings file.

PMKID Only

sudo python3 aether.py --phase pmkid --interface wlan1 --project wifi_test

Run only the clientless PMKID capture and cracking phase.

WPA-Enterprise Rogue AP

sudo python3 aether.py --phase enterprise --interface wlan1 --project corp_wifi

Run the WPA-Enterprise credential harvesting phase.

Third-Party Tool Invocations

Commands and flags used when this tool invokes third-party dependencies during operation.

aircrack-ng
WEP IV capture (airodump-ng), deauthentication (aireplay-ng), key cracking (aircrack-ng), and interface management (airmon-ng)
airmon-ng start wlan0
airodump-ng --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture wlan0mon
aircrack-ng capture-01.cap
hcxdumptool
Clientless PMKID hash capture from WPA/WPA2 access points without requiring a connected client
hcxdumptool -i wlan0mon -o capture.pcapng --filterlist_ap=targets.txt --filtermode=2
hashcat
GPU-accelerated offline cracking of captured PMKID hashes and WPA handshakes
hashcat -m 22000 capture.hc22000 wordlist.txt
hashcat -m 22000 capture.hc22000 -a 3 ?d?d?d?d?d?d?d?d
wifite2
Automated WPA/WPA2/WPA3 handshake capture and WPS PIN attack orchestration
wifite --kill -i wlan0mon
wifite -e TargetSSID --no-wps
EAPHammer
WPA-Enterprise rogue access point deployment for credential harvesting via evil twin attacks
eaphammer --bssid AA:BB:CC:DD:EE:FF --essid CorpWifi --channel 6 --interface wlan0 --auth wpa-eap --creds
asleap
Cracking captured MS-CHAPv2 challenge/response hashes from WPA-Enterprise authentication
asleap -C challenge -R response -W wordlist.txt
dragonslayer
Testing WPA3 SAE (Dragonfly) handshake implementations for cryptographic vulnerabilities
dragonslayer --target AA:BB:CC:DD:EE:FF --interface wlan0
dragondrain
Testing WPA3 access points for SAE commit message resource exhaustion vulnerabilities
dragondrain --target AA:BB:CC:DD:EE:FF --interface wlan0
krackattacks-scripts
Testing WPA2 implementations for Key Reinstallation Attack (KRACK) vulnerabilities
python3 krack_all_zero_tk.py wlan0

Finding Nomenclature

Aether findings use the AE- prefix in their catalogue IDs (e.g., AE-001, AE-002). Each finding includes wireless-specific metadata:

  • ssid — the target network's SSID
  • bssid — the target access point's MAC address
  • wireless_data — a dictionary containing protocol details (encryption type, channel, signal strength, authentication method)

Risk levels follow the standard CRITICAL/HIGH/MEDIUM/LOW/INFO scale. Successful key recovery or credential capture is typically rated CRITICAL, configuration weaknesses as HIGH or MEDIUM, and informational observations as INFO. Findings reference the specific attack phase and external tool that produced them.

Action Items

Aether generates action items for captured material needing offline cracking — e.g., "Crack captured PMKID hash with hashcat -m 22000", "Crack WPA handshake with custom wordlist", "Test captured RADIUS credentials against internal services".

Output Files

FileFormatDescription
meta.json JSON Tool identity and engagement metadata
findings.json JSON Universal findings array v1.1
findings.csv CSV CSV mirror of findings
summary.json JSON Aggregated statistics
scan.log TXT Human-readable timestamped log
scan.log.json JSONL Machine-readable JSON log events
errors.log TXT ERROR-level entries only
findings_catalogue.json JSON Findings catalogue

Invocation Methods

MethodUsage
CLI — Direct cd /opt/pr0t31n/Aether && python3 aether.py [OPTIONS]

Run directly with command-line arguments.
CLI — Settings File cd /opt/pr0t31n/Aether && python3 aether.py --config config.json

Configure via config.json (JSON), then run.
Crucible-Managed

Launched and managed by Crucible (port 5100). Crucible handles start/stop/pause, log streaming, findings aggregation, and status tracking.

Integration

Depends On

Used By

Third-Party Dependencies & Credits

Tool / LibraryDeveloperTypeLink
aircrack-ng suite Thomas d'Otreppe (Mister_X) system https://github.com/aircrack-ng/aircrack-ng
wifite2 kimocoder / derv82 system https://github.com/kimocoder/wifite2
EAPHammer Gabriel Ryan (s0lst1c3) system https://github.com/s0lst1c3/eaphammer
dragonslayer Mathy Vanhoef system https://github.com/vanhoefm/dragonslayer
dragondrain Mathy Vanhoef system https://github.com/vanhoefm/dragondrain-and-time
krackattacks-scripts Mathy Vanhoef system https://github.com/vanhoefm/krackattacks-scripts
bettercap Simone Margaritelli (evilsocket) system https://github.com/bettercap/bettercap
Responder Laurent Gaffie (lgandx) system https://github.com/lgandx/Responder
hashcat Jens Steube (atom) system https://github.com/hashcat/hashcat
hcxpcapngtool / hcxtools ZerBea system https://github.com/ZerBea/hcxtools
hostapd-mana SensePost / Dominic White (singe) system https://github.com/sensepost/hostapd-mana
asleap Joshua Wright system https://github.com/joswr1ght/asleap
nmap Gordon Lyon (Fyodor) system https://github.com/nmap/nmap
tshark / Wireshark Gerald Combs / Wireshark Foundation system https://github.com/wireshark/wireshark

Metadata

NameAether
CategoryWireless
Version1.25.1
Install Path/opt/pr0t31n/Aether
Main Fileaether.py
GitHubhttps://github.com/pr0t31n/Aether.git