Wireless › Module 3 › Lesson 2
WPA and WPA2
TKIP to CCMP — 4-way handshake and PSK hygiene on YOUR lab AP literacy.
Visual · wireless_wpa_wpa2
WPA/WPA2 literacy. 4-way handshake concept. $LAB_SSID only. Original Cyberlium.
Opening
WPA2 is not 'unbreakable' — it is 'don't use WEP' plus good PSK and PMF where you can.
WPA upgraded TKIP; WPA2 standardized AES-CCMP. Personal mode derives PMK from PSK and runs a 4-way handshake to install PTK/GTK. Weak passphrases fall offline after capture — defender lesson is long unique PSKs and WPA3 migration, not attacking dorm handshakes. You learn handshake roles as protocol literacy on $LAB_SSID captures you are authorized to take later — not weaponized crack recipes on strangers. Next: WPA3 Defender Notes.
1. 4-way handshake roles (literacy)
AP and STA exchange four EAPOL frames to prove PSK knowledge and derive session keys. Captures may contain handshake frames — analysis belongs on YOUR lab with written RoE.
Defenders monitor EAPOL anomalies; attackers need authorized lab captures — Module 6 covers handshake literacy filtered to $LAB_SSID.
Command guide
Try these commands — 4-way handshake roles (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
WPA2 — https://www.wi-fi.org/discover-wi-fi/security 4-way handshake — https://www.wi-fi.org/knowledge-center/glossary
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install tcpdump
macOS: Use airport / System Settings
Windows: Use netsh wlan (built-in) Use Wireshark or install via WSL
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,SECURITY device wifi list 2>/dev/null | grep -i wpa | head -10 sudo tcpdump -i any -c 3 'wlan type mgt subtype beacon' 2>/dev/null || echo 'Observe beacons on YOUR radio only'
Primary tools to practice this lesson: nmcli, tcpdump. Reference sites: WPA2 (https://www.wi-fi.org/discover-wi-fi/security); 4-way handshake (https://www.wi-fi.org/knowledge-center/glossary). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. TKIP vs CCMP
WPA allowed TKIP as transitional cipher; WPA2 prefers CCMP (AES). Disable TKIP on owned APs when possible.
Document $LAB_SSID uses CCMP/AES — not TKIP or mixed modes unless lab brief requires legacy sim.
3. PSK hygiene
Dictionary PSKs fail offline guessing. Enterprise moves risk to identity; personal labs still need long random PSK on $LAB_SSID.
Ship: PSK policy sentence for YOUR lab. Next: WPA3 Defender Notes.
4. What you ship: WPA2 literacy + lab PSK policy
Name 4-way handshake purpose. $LAB_SSID uses CCMP + strong PSK. No stranger handshake attacks. chmod 600.
5. What you record before the next lesson
Date. 4-way literacy notes. $LAB_SSID cipher/PSK policy. File t15-m03-l02-wpa-wpa2.txt chmod 600.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run crack tutorials on café handshakes. Use 'password123' on lab AP because it is easy.
Right
Explain handshake at literacy level. Harden $LAB_SSID PSK policy. Next: WPA3 Defender Notes.
Mission: WPA2 literacy without weaponized cracks
1) Summarize 4-way handshake purpose. 2) Write lab PSK requirements for $LAB_SSID. 3) Disable TKIP on YOUR AP if present. Never crack neighbor handshakes.
Stuck? Ask Cyberlium AI Mentor
PMF (802.11w) matters for WPA2 hardening — Module 9 goes deeper.
Knowledge Check
APPLY: WPA2-Personal session keys come from:
Multiple choice
Knowledge Check
APPLY: True or False: Short dictionary PSKs on $LAB_SSID are fine because it is 'just a lab.'
True or False
Knowledge Check
APPLY: Preferred WPA2 cipher today:
Multiple choice