Wi-Fi Basics

Wi-Fi attacks are built on a few simple ideas. Here’s what each one does, why someone might use it, and what to know before trying the tools in GhostESP.

What is a Wi-Fi attack?

A Wi-Fi attack is any action that disrupts, intercepts, or tricks Wi-Fi networks or devices. Most attacks fall into two categories:

• Passive: You listen and record without sending anything. Example: capturing packets to see what devices are on a network.
• Active: You send frames or signals to change how the network behaves. Example: sending deauth frames to kick devices off.

Common attacks explained

Packet capture

What it does: Records all Wi-Fi traffic on a channel and saves it to a file (PCAP format).

Why: You can analyze the data later to see what devices are connecting, what SSIDs they’re looking for, or extract handshakes for password testing.

Legal note: Capturing traffic on networks you don’t own is illegal in most places. Only do this on your own network or with explicit permission.

Learn more: Capturing packets

Deauthentication (deauth)

What it does: Sends a fake “disconnect” message to a device, forcing it off the network.

Why: Tests network stability, forces devices to reconnect (so you can capture their handshake), or disrupts a specific device.

Legal note: Deauthing devices you don’t own is illegal. Only test on your own network.

Learn more: Deauthentication attacks

Karma attack

What it does: Pretends to be a Wi-Fi network that a device is looking for, tricking the device into connecting.

Why: Intercept traffic from devices or test how they behave when connecting to fake networks.

Legal note: Tricking devices into connecting without consent is illegal in most jurisdictions.

Learn more: Karma attacks

Evil portal

What it does: Creates a fake Wi-Fi network with a login page that looks real (like a coffee shop Wi-Fi).

Why: Capture credentials, redirect users to a phishing site, or test how users respond to fake login pages.

Legal note: Impersonating a real network or capturing credentials without consent is illegal.

Learn more: Evil portals

Handshake capture

What it does: Records the WPA/WPA2 authentication handshake between a device and router.

Why: Export the handshake to offline password cracking tools to test weak passwords.

Legal note: Cracking passwords on networks you don’t own is illegal.

Learn more: Handshakes

Other attack modes

GhostESP also exposes additional management-frame attacks from Menu → Wi-Fi → Attacks (or the attack command):

• Handshake + Deauth (attack -hsd): Captures handshakes while deauthing to force a reconnect.
• Channel Switch (CSA) (attack -c): Sends channel switch announcement frames.
• EAPOL Logoff (attack -e): Sends logoff frames instead of deauth frames.
• Probe Request Flood (attack -p): Floods the air with probe requests.
• Bad Message (attack -b): Sends malformed management frames.
• Auth Flood (attack -a): Floods a target with authentication requests.
• SAE Flood (attack -s <password>): Floods WPA3 networks with authentication requests (ESP32-C5/C6).
• GTK Abuse (attack -g <ssid> <password>): Tests client isolation using the shared group key.

Before you start

Prerequisites

• A GhostESP device (flashed and working)
• An SD card (for saving captures)
• A network you own or have permission to test
• Basic understanding of Wi-Fi (SSIDs, channels, 2.4 GHz vs 5 GHz)

Legal and ethical rules

• Only test networks you own or have written permission to test.
• Unauthorized access to networks or devices is illegal in most countries.
• Disrupting networks (deauth, jamming) without permission is illegal.
• Impersonating networks or capturing credentials is illegal.
• Check your local laws before testing.

Typical workflow

1. Scan the area to find networks and devices (see Survey).
2. Choose an attack based on what you want to learn (see attack descriptions above).
3. Capture or execute using the GhostESP menu or CLI.
4. Analyze the results on your computer (e.g., open PCAP files in Wireshark).