25.6 Red vs Blue, Project and Real Incidents

By Ravindra Bagale Last updated: 27 September 2026

Chala mitrano, WPA2/WPA3, airodump, handshake, evil twin concept, swatahcha router harden – aata Purple Team loop. Red lab madhe OWN Wi-Fi cha weak passphrase rockyou ne dakhavto; Blue WPA3/SAE, lamb passphrase, WPS off, PMF/802.11w, guest VLAN, firmware update lavto. Tumhi Raja-Rani Traders style OWN shop Wi-Fi madhe build → hack → fix karun Purple report liha. Wireless awareness; fix + prove = career. Samjla ka? Dusryacha Wi-Fi – kadhi nahi.

Red Team vs Blue Team – wireless awareness

Red team (attacker) does	Blue team (defender) detects / stops
`airmon-ng` + `airodump-ng` to list OWN lab AP (BSSID/channel)	Inventory authorised APs; alert on unexpected SSIDs / evil-twin names
`aireplay-ng --deauth` on OWN client to capture WPA2 handshake	WPA3 where possible; Protected Management Frames (802.11w / PMF)
`aircrack-ng -w rockyou.txt` against weak PSK handshake	Long random passphrase (16+); never WEP/WPA-TKIP; prefer WPA3-SAE
WPS PIN / Pixie-Dust class attacks against routers that leave WPS on	WPS off on every shop/home router
Evil-twin SSID copy + captive fake login (concept)	User training: known SSIDs only; VPN; HTTPS; admin SSID naming hygiene
Default router admin / old firmware on SOHO gear	Change admin password; firmware update; guest network for visitors/IoT

Defender chi simple checklist: WPA3 or WPA2-AES → 16+ passphrase → WPS off → PMF → guest network → admin password + firmware → prove rockyou fails. Aircrack suite Kali var; bachav router settings Blue var. Interview madhe "I cracked Wi-Fi" peksha "I showed a weak PSK fails and a strong PSK does not, then hardened the shop AP" jast strong.

# OWN Wi-Fi / OWN lab AP only – never neighbour SSIDs
mkdir -p ~/labs/raja-rani-wifi
# Monitor mode (needs compatible USB adapter – already taught in 25.2):
#   sudo airmon-ng check kill
#   sudo airmon-ng start wlan0
# Capture YOUR AP only (replace channel + BSSID with YOUR router):
#   sudo airodump-ng -c <ch> --bssid <YOUR_BSSID> -w ~/labs/raja-rani-wifi/own wlan0mon
# Optional: deauth YOUR phone once to force handshake (OWN devices only):
#   sudo aireplay-ng --deauth 5 -a <YOUR_BSSID> wlan0mon
# Crack test – weak temporary PSK first (expect rockyou hit), then strong PSK (expect fail):
#   aircrack-ng -w /usr/share/wordlists/rockyou.txt ~/labs/raja-rani-wifi/own-01.cap
# Blue prove on router admin UI:
#   - WPA3 (or WPA2-AES), passphrase 16+ random, WPS disabled
#   - guest network for visitors/IoT, admin password changed, firmware updated
#   - PMF / 802.11w enabled if the UI offers it
#   sudo airmon-ng stop wlan0mon   # return adapter to normal when done

Ravindra Bagale's Tip

Students post a screenshot of their neighbours' SSID list on social media – that breaks scope. The second mistake: they set a temporary weak password and forget it, leaving the network open. Rule: OWN BSSID only → weak test → crack evidence → STRONG passphrase restore same day → WPS off checklist. The wireless chapter is really a router hygiene chapter. Don't worry, it comes with practice.

Lab

Monitor-mode adapter asel tar swatahchya Wi-Fi cha handshake capture kara (25.3 steps). Pehla temporary weak passphrase (lab only) – rockyou ne crack dista te note kara. Mag 16+ random passphrase lavun punha try – fail. Router var WPA3/WPA2-AES, WPS off, guest network, admin password, firmware – before/after 5 lines ~/labs/raja-rani-wifi/. Neighbour/airport SSID var nahi.

Project: Build it, hack it, fix it

Build: For fictional Raja-Rani Traders (shop Wi-Fi, Pune/Nashik style) on hardware you own:

Temporary lab passphrase that is deliberately weak (write it down – you will change it back)
Note current mode (WEP/WPA/WPA2/WPA3), WPS on/off, guest network status, firmware version
Ethics card: only this SSID/BSSID; no deauth of customer devices you do not control during shop hours if it would harm service – use a spare lab AP or off-hours window

Hack (lab awareness – OWN AP only):

airodump-ng filtered to your BSSID/channel; capture handshake (deauth only your test phone)
aircrack-ng + rockyou against the weak temporary key – show it cracks
Repeat after setting a long random key – show rockyou does not find it in a short lab run (stop the crack; do not burn hours)

Do not target cafe/airport/neighbour Wi-Fi, do not leave the shop on a weak key overnight, do not publish handshakes.

Fix:

Set WPA3 (or WPA2-AES if WPA3 unavailable); passphrase 16+ random characters
Turn WPS off; enable PMF/802.11w if offered
Guest network for visitors and IoT cameras; main LAN separate
Change router admin password; apply firmware update from vendor site
Document evil-twin user advice: known SSID only, VPN, HTTPS (Chapter 24)

Re-verify: Router UI screenshots/notes show WPA3/WPA2-AES + WPS off + guest + new admin + firmware; weak-key crack evidence kept only in lab folder; strong-key attempt fails. 1-page Purple report for owner Rani (with Raja): finding → risk → fix → evidence. Peer-review with Amir / Ravina. IT Act: only networks you own.

Real incident: KRACK – Key Reinstallation Attack (2017)

In 2017, researchers publicly disclosed KRACK (Key Reinstallation Attacks) against the WPA2 four-way handshake. By tricking a client into reinstalling an already-in-use key, an attacker in range could in some cases decrypt or manipulate traffic, depending on the platform and patches. Weakness: a protocol-implementation issue in the WPA2 handshake state machine, not merely "short passwords". What would have reduced it: vendor Wi-Fi stack patches on clients and APs, preferring updated WPA3 where available, and defence-in-depth (HTTPS/VPN) so a broken link layer still does not expose passwords. Lab lesson: even "WPA2 with a good password" needed patches after KRACK – Blue keeps firmware/OS Wi-Fi updates current. Source: krackattacks.com / academic disclosure and vendor advisories (2017); verify current summaries.

Real incident: VPNFilter malware on SOHO routers (2018)

In 2018, Cisco Talos and public reporting described VPNFilter, malware that compromised large numbers of consumer and small-office routers and NAS devices across many models. Infected devices could be used for traffic manipulation, credential theft, or destructive actions; guidance stressed rebooting, factory reset, firmware updates and replacing end-of-life gear. Weakness: internet-exposed or unpatched SOHO routers with weak management hygiene. What would have reduced it: timely firmware updates, changing default admin passwords, disabling remote administration from the internet, network segmentation, and retiring unsupported routers. Lab lesson: your shop Wi-Fi project is incomplete without router admin + firmware hygiene – handshake strength alone is not enough if the AP itself is owned. Source: Cisco Talos VPNFilter posts and FBI/public guidance (2018); verify current summaries.

Interview model (clean English): "I practise Aircrack-ng only against my own lab AP. I demonstrate that a weak WPA2 passphrase falls to rockyou while a long random key does not, then I harden the router with WPA3 or WPA2-AES, WPS off, PMF, guest Wi-Fi, a new admin password and current firmware."

Thodkyaat: wireless shika, pan WPA3 + lamb key + WPS off + firmware shika. Aata pudhe privilege escalation. Chala pudhe, mitrano!

Thodkyaat sangaycha tar

Wi-Fi security went WEP (broken) to WPA to WPA2 (strong with a good key) to WPA3 (best).
Monitor mode plus the Aircrack-ng suite captures traffic; a WPA2 handshake can be cracked offline against a wordlist.
WPA2 itself is not broken – weak passphrases are; a long random key defeats the attack.
Deauth causes disconnection; an evil twin impersonates a network to steal data – use known networks, VPN and HTTPS.
Secure your own Wi-Fi: WPA3/WPA2, long passphrase, WPS off, updated firmware, changed admin password, guest network, PMF.
Every technique here is legal only on a network you own.

Samjla ka? Wi-Fi todaycha nahi, vachvaycha – hach khara uddesh. Pudhchya chapter madhe privilege escalation – system madhe shirlyavar root kasa banto, ani te kase thambavaycha. Chala pudhe, mitrano!