How I'd hack your WiFi4 parts

Recon: I find you without connecting

I never touch your network to start. I put one adapter into monitor mode, which just listens to the radio. From across the street I can see every network nearby, including hidden ones, the channel each runs on, and every device already connected to them.

Then I sort by how easy each one is. Weak or old encryption goes to the top of the list, and that network never knew it was being profiled.

Why it matters

You cannot stop a stranger from seeing that your network exists; radio is broadcast. What you control is being the easy target at the top of the list. That comes down to your encryption and passphrase, which Parts 3 and 4 settle.

The handshake: I grab your key exchange out of the air

When a device joins WiFi, it performs a four-way handshake, a short cryptographic exchange that proves it knows the password without ever sending the password. I want that exchange.

So I send a single deauth frame, a forged "disconnect" that looks like it came from your router. Every connected device drops for a fraction of a second and immediately reconnects. That reconnect replays the handshake, and my adapter captures the packets out of the air. You never notice.

Why it matters

The forged-deauth trick is the linchpin, and it is exactly what modern protections kill (see Defense). Once I have the captured handshake, the rest happens offline on my own machine, days later, nowhere near you.

Cracking: I guess the password offline

The password itself was never sent over the air, so I cannot "read" it. I have to guess it. I load the captured handshake into a cracker like Hashcat and throw a GPU and a giant wordlist at it, thousands of parallel guesses per moment, until one produces the same hash.

This is the whole game. A weak or common passphrase falls in seconds because it is already in the wordlist. A long random one is not in any wordlist, and brute force against strong WPA2 would take a modern machine on the order of thousands of years.

Why it matters

Everything before this only mattered because most passwords are guessable. Your passphrase is the single biggest lever you own. Length beats cleverness.

The evil twin: I become the network you trust

On open public WiFi there is no handshake to steal, so I do something simpler. Your phone constantly shouts the names of networks it has joined before, looking to reconnect. I clone one, "Starbucks WiFi", say, and broadcast it. Your device sees a trusted name and just connects. Now every request runs through my laptop first.

Why it matters

This one is pure convenience-exploitation, and the fixes are small habit changes below.