WPA3 Defender Notes
SAE, PMF, and transition mode — harden YOUR lab AP toward WPA3.
Visual · wireless_wpa3_notes
WPA3 defender literacy. $LAB_SSID hardening. Original Cyberlium.
WPA3 fixes PSK dragon math — defenders enable it where clients allow.
WPA3-Personal uses SAE (Dragonfly) resisting offline dictionary attacks on captured exchanges. Mandatory PMF (802.11w) protects management frames. Transition mode (WPA2+WPA3) eases migration but widens attack surface — document which mode $LAB_SSID uses. You plan upgrades on gear you own — not downgrade neighbor APs or test downgrade attacks on cafés. Next: Protocol Lab.
1. SAE vs PSK dragon
SAE makes offline guessing harder even if passphrases are weak — still use strong secrets. Enterprise WPA3 adds 192-bit security suite options for sensitive WLANs.
Defender checklist: firmware current, WPA3 enabled, transition minimized when client base allows.
Command guide
Try these commands — SAE vs PSK dragon
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
WPA3-SAE — https://www.wi-fi.org/discover-wi-fi/security PMF (802.11w) — https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install network-manager sudo apt install iw
macOS: Use airport / System Settings Prefer Linux lab VM for iw
Windows: Use netsh wlan (built-in) Use Kali VM / WSL with iw
═══ LINUX / macOS ═══
Command — copy this
nmcli -f SSID,SECURITY device wifi list 2>/dev/null | grep -iE 'wpa3|sae' | head -5 || echo 'Prefer WPA3 on YOUR lab AP if supported' iw phy 2>/dev/null | grep -i 'SAE\|PMF\|802.11w' | head -5 || true
Primary tools to practice this lesson: nmcli, iw. Reference sites: WPA3-SAE (https://www.wi-fi.org/discover-wi-fi/security); PMF (802.11w) (https://www.wi-fi.org/news-events/newsroom/wi-fi-alliance-introduces-wi-fi-certified-wpa3-security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. PMF required
PMF protects deauth/disassoc at management layer — relevant because deauth abuse is both attack and defense topic. Enable PMF on $LAB_SSID when hardware supports it.
Disabling PMF to 'make labs easier' on stranger nets is out of scope — on YOUR lab, follow brief.
3. Transition pitfalls
WPA2/WPA3 mixed mode keeps legacy clients happy but extends exposure — track client inventory like a blue team.
Ship: WPA3/PMF status for $LAB_SSID. Next: Protocol Lab.
4. What you ship: WPA3/PMF hardening note
Document WPA3 or transition on $LAB_SSID. Enable PMF if supported. No neighbor downgrade tests. chmod 600.
5. What you record before the next lesson
Date. $LAB_SSID WPA3/PMF status. File t15-m03-l03-wpa3-notes.txt chmod 600.
6. Wrong vs right: stranger SSIDs vs YOUR lab AP
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Force WPA2-only on public clones. Test dragonblood on café gear without authorization.
- Right: Plan WPA3/PMF on YOUR lab AP. Next: Protocol Lab.
Mission: WPA3 defender checklist for lab AP
1) Record WPA3/transition mode on $LAB_SSID. 2) Enable PMF if supported. 3) Note client compatibility tradeoff. Never test on stranger APs.
Stuck? Ask Cyberlium AI Mentor
Some clients need firmware before WPA3 — inventory before flipping modes.
APPLY: WPA3-Personal primarily replaces:
APPLY: True or False: PMF (802.11w) helps protect management frames.
APPLY: Transition mode WPA2+WPA3: