Title: Wi-Fi Basics
Description: Learn what Wi-Fi attacks are and how they work before diving into tools.
URL: /v2.1/wifi/basics/
Version: v2.1
Section: Wi-Fi
Search index: /search-index.json

# Wi-Fi Basics

> Learn what Wi-Fi attacks are and how they work before diving into tools.

## On this page

- [What is a Wi-Fi attack?](#what-is-a-wi-fi-attack)
- [Common attacks explained](#common-attacks-explained)
- [Packet Capture](#packet-capture)
- [Deauthentication (Deauth)](#deauthentication-deauth)
- [Karma Attack](#karma-attack)
- [Evil Portal](#evil-portal)
- [Handshake Capture](#handshake-capture)
- [Before you start](#before-you-start)
- [Prerequisites](#prerequisites)
- [Legal and ethical rules](#legal-and-ethical-rules)
- [Typical workflow](#typical-workflow)
- [Next steps](#next-steps)

---

Wi-Fi attacks sound complex, but they’re built on a few simple ideas. This page explains what each attack does, why someone might use it, and what you need to know before trying the tools in GhostESP.
## What is a Wi-Fi attack?
A Wi-Fi attack is any action that disrupts, intercepts, or tricks Wi-Fi networks or devices. Most attacks fall into two categories:
- Passive: You listen and record without sending anything. Example: capturing packets to see what devices are on a network.
- Active: You send frames or signals to change how the network behaves. Example: sending deauth frames to kick devices off.
## Common attacks explained
### Packet Capture
What it does: Records all Wi-Fi traffic on a channel and saves it to a file (PCAP format).
Why: You can analyze the data later to see what devices are connecting, what SSIDs they’re looking for, or extract handshakes for password testing.
Legal note: Capturing traffic on networks you don’t own is illegal in most places. Only do this on your own network or with explicit permission.
Learn more: [Capturing packets](/v2.1/wifi/capture/)
### Deauthentication (Deauth)
What it does: Sends a fake “disconnect” message to a device, forcing it off the network.
Why: Tests network stability, forces devices to reconnect (so you can capture their handshake), or disrupts a specific device.
Legal note: Deauthing devices you don’t own is illegal. Only test on your own network.
Learn more: [Deauthentication attacks](/v2.1/wifi/deauth/)
### Karma Attack
What it does: Pretends to be a Wi-Fi network that a device is looking for, tricking the device into connecting.
Why: Intercept traffic from devices or test how they behave when connecting to fake networks.
Legal note: Tricking devices into connecting without consent is illegal in most jurisdictions.
Learn more: [Karma attacks](/v2.1/wifi/karma/)
### Evil Portal
What it does: Creates a fake Wi-Fi network with a login page that looks real (like a coffee shop Wi-Fi).
Why: Capture credentials, redirect users to a phishing site, or test how users respond to fake login pages.
Legal note: Impersonating a real network or capturing credentials without consent is illegal.
Learn more: [Evil portals](/v2.1/wifi/evil-portal/)
### Handshake Capture
What it does: Records the WPA/WPA2 authentication handshake between a device and router.
Why: Export the handshake to offline password cracking tools to test weak passwords.
Legal note: Cracking passwords on networks you don’t own is illegal.
Learn more: [Handshakes](/v2.1/wifi/handshakes/)
## Before you start
### Prerequisites
- A GhostESP device (flashed and working)
- An SD card (for saving captures)
- A network you own or have permission to test
- Basic understanding of Wi-Fi (SSIDs, channels, 2.4 GHz vs 5 GHz)
### Legal and ethical rules
- Only test networks you own or have written permission to test.
- Unauthorized access to networks or devices is illegal in most countries.
- Disrupting networks (deauth, jamming) without permission is illegal.
- Impersonating networks or capturing credentials is illegal.
- Check your local laws before testing.
### Typical workflow
- Scan the area to find networks and devices (see [Survey](/v2.1/wifi/survey/)).
- Choose an attack based on what you want to learn (see attack descriptions above).
- Capture or execute using the GhostESP menu or CLI.
- Analyze the results on your computer (e.g., open PCAP files in Wireshark).
## Next steps
Pick an attack that interests you and read the detailed guide:
- [Capturing packets](/v2.1/wifi/capture/) — Record Wi-Fi traffic
- [Handshakes](/v2.1/wifi/handshakes/) — Extract authentication data
- [Karma attacks](/v2.1/wifi/karma/) — Trick devices into connecting
- [Evil portals](/v2.1/wifi/evil-portal/) — Create fake login pages
- [Survey](/v2.1/wifi/survey/) — Scan for networks and devices