Many beginners want to know how they can hack their Wi-Fi. It’s fun, it’s easy to get started with and those small wins make the early part of your cybersecurity journey exciting. Testing Wi-Fi security is also an important part of a pentest, since many organizations keep old routers in place with weak security settings. As years go by, those settings get more and more obsolete, like WEP. Some features routers have enabled by default might be convenient, but are often unnecessary. That’s WPS, as you might know. It gets abused regularly to recover a plaintext password and sometimes you can get it in under a minute just because WPS was left on.
If hackers get onto the network, they can start exploring everything on it or just use your Wi-Fi for their own purposes. You don’t want that. That’s why you need to make sure it’s secure.
Today we’ll cover Wifit3, which can help you with this.
What is Wifit3
The tool was developed by the same author who created Wifite2.
Unlike its predecessor, it doesn’t need aircrack-ng, reaver or bully installed. Instead, it uses pure Python with the PyUSB and Textual libraries. Wifit3 works just as well on Linux, macOS and Windows. You’ll only need a USB dongle to work with it. The repository mentions all the supported devices.
It scans both 2.4 GHz and 5 GHz, can tell when a network is WPA3 or in mixed WPA2/WPA3 mode and keeps track of signal and encryption. It also tries to identify the router and pull extra details about it. Hidden network names sometimes get revealed by matching them to a known router address. If you plug in more than one supported Wi‑Fi adapter, you can listen on several at once and leave one free to send packets.
It shows beacons, data, injection and disconnect traffic so you can see what’s in the air while you work.
The tool can listen to Wi‑Fi traffic and send disconnect messages. Those messages kick phones off the network. When a phone joins again, it talks to the router to prove it knows the password. The tool records that conversation. The password is in there, but scrambled, so you can crack it later with hashcat.
Here’s how it looks. Above you can see it capturing handshakes with passwords after disconnecting a client. The tool also managed to capture a PMKID. PMKID is a short hash the router can send that’s tied to the Wi-Fi password. If you capture that hash, you can try passwords against it later on your own machine. You don’t need to kick anyone off the network or capture a full login handshake.
There’s also an Evil Twin mode for WPA3. It tricks phones into leaving the real Wi‑Fi and joining a fake one so the tool can steal a handshake. For WPS it can try the fast Pixie Dust attack, grab the password when someone presses the router’s WPS button and keep guessing the WPS PIN while pausing if the router starts locking out attempts.
That’s how the WPS attack looks. The tool sends an enrollee identity with a public key and gets the router credentials decrypted. The password is then saved to a text file.
WEP is attacked in Python with the usual replay tricks to recover the key.
Setting Up
Now let’s set it up on our machine. As always, we’re going to use Kali, but you can use anything you want.
kali > wget https://github.com/derv82/wifit3/releases/download/v0.3.2/wifit3-linux-x64 -q
kali > chmod 777 wifit3-linux-x64
kali > mv wifit3-linux-x64 wifit3
kali > sudo cp wifit3 /usr/local/bin
We’re all set. Plug in your USB dongle and start the tool.
kali > wifit3
After choosing the right, you can start testing your Wi-Fi. Use it only on your own Wi-Fi or the one you’re authorized to test.
Summary
There are so many vulnerable Wi-Fi networks you’ll come across during pentests. They’re often the quickest way into a network, which is why their security shouldn’t be overlooked. Wifit3 is a new tool that came out relatively recently. It’s easy to work with and can help you cover all the common wireless attacks.
If you’re interested in Wi-Fi security, our Wi-Fi Hacking training can help you gain the necessary experience.
The density of WiFi access points in modern cities has now reached a point where a large-scale surveillance system may be able to identify almost anyone who walks near a router, even if that person is not carrying a mobile phone. Researchers from the Karlsruhe Institute of Technology (KIT) have published a scientific paper describing this kind of system and the technology that makes it possible.
At the center of this surveillance method is a feature called beamforming, which first appeared with the WiFi 5 (802.11ac) standard in 2013–2014. The basic idea was introduced with WiFi 5, but it became much more refined and effective with WiFi 6 (802.11ax), where the technology matured into something more practical.
Beamforming
Beamforming, also called spatial filtering, is a signal processing technique used to send and receive wireless signals in specific directions rather than spreading them evenly in every direction. In simple marketing language, this is often described as a router that “does not broadcast equally everywhere anymore, but instead follows the user with a focused beam.” That description is not wrong, but it leaves out the technical depth behind the idea.
Beamforming
From an engineering point of view, beamforming works by combining several antennas into a group called an array. When the signals from these antennas are timed and lined up correctly, they boost each other in certain directions. In other directions, they cancel each other out. The result is a signal that is far more focused and efficient than older systems, which simply broadcast outward in every direction at once.
Beamforming gives both senders and receivers the ability to focus on signals coming from one direction while blocking out noise from others. Because of that, the technique is used not only in WiFi, but also in radar, sonar, seismology, wireless communications, radio astronomy, acoustics, and biomedical engineering.
Identifying People Through WiFi Signals
As radio waves move through space, they do not simply travel in a straight, clean line. They interact with the world around them in many different ways. They can pass through objects, reflect off surfaces, become absorbed, become polarized, bend around obstacles, scatter in different directions, or refract as they cross boundaries between materials. This means that when a WiFi system sends a signal and later receives it back, the final result contains information about everything the signal encountered along the way. By comparing the expected signal with the received one, it becomes possible to measure interference and use that information to correct transmission errors. But that same interference also reveals details about the environment itself.
For example, when a person enters the path of a WiFi signal, the signal changes. Human bodies affect radio waves in measurable ways. The signal may weaken, shift, scatter, or behave differently depending on movement, posture, and position. If researchers analyze these changes carefully, they can infer a surprising amount of information about the surrounding environment. They may detect whether people are present, what they are doing, and in some cases even who they are.
This whole research area has grown into a separate field known as WiFi Sensing.
Most WiFi Sensing research is presented as useful and harmless, and in many cases it really is. It can support smart-home features, occupancy detection and other practical applications. But the privacy concerns are obvious. When these methods are combined with activity recognition and the massive spread of WiFi hotspots, they can reveal highly sensitive information. One of the most troubling possibilities is that someone could be identified in the range of a hotspot and then tracked over time without ever knowing it.
Using Channel Information for Identification
There are several ways a person can be identified through WiFi. One important method relies on analysis of Channel State Information (CSI), which is sent at the physical layer of WiFi communication. CSI is detailed and useful for WiFi sensing. It gives a rich picture of how the wireless channel behaves. The problem is that CSI is not always easy to access. In many cases, it requires modified firmware and specialized hardware support, which limits how widely it can be used in practice.
Comparison of CSI-based identity recognition methods
The table above compares roughly 25 different systems, evaluating them across several key dimensions. The Paper column lists the name of each system, while the Identities column shows how many different people each system is capable of distinguishing between. The Accuracy column then reflects how reliably each system correctly identifies a person. On the technical side, the Pre-Processing column describes the signal processing techniques each system applies to clean and transform raw WiFi data before passing it to a machine learning model, and the Model Architecture column identifies what type of model is used. The Perspective column shows how subjects were positioned or moving during data collection, such as standing orthogonally, performing gestures, or typing keystrokes.
Beamforming entered the picture for a different reason. As mentioned earlier, it was introduced in WiFi 5 to improve throughput and make wireless communication more efficient. But beamforming also depends on environmental information that is similar to CSI. The difference is that this information is gathered on the transmitter side rather than the receiver side.
Comparison of BFI-based WiFi sensing methods
The key new dimensions here are the Inference column, showing the wide variety of tasks these systems tackle, from respiratory rate monitoring and crowd counting to sign language recognition.
In a typical beamforming setup, client devices send something called Beamforming Feedback Information (BFI) back to the access point. BFI is a condensed snapshot of current signal conditions. It tells the access point how the wireless channel looks so that it can adjust its transmission for better performance.
The key difference between CSI and BFI is that BFI is transmitted back to the access point without encryption. This makes it much easier to collect using standard, off-the-shelf hardware, without needing any special software modifications. That significantly lowers the bar for potential misuse. The privacy concern gets even more serious when you consider that the IEEE is already working on making WiFi sensing an official standard through the upcoming 802.11bf update and based on the current draft, without putting strong privacy protections in place.
Researchers at KIT showed that people can be identified using only BFI data, even when they are not carrying a smartphone or any other wireless device. The method does not depend on a person bringing along a tracked gadget. It works using ordinary WiFi devices already present in the environment and already communicating with one another.
Placement of TP-Link Archer BE800 access points, measurement locations, and participant walking routes in the WiFi-based identity recognition experiment
As radio waves move through space and interact with the human body, they create patterns that can be captured, analyzed, and compared. In that sense, the process starts to resemble imaging, almost as if the wireless system were building a rough picture of a scene without using a camera. The result is not a photograph in the normal sense, but the data can carry enough structure to support identity inference.
WiFi Routers as Silent Observers
“The technology turns every router into a potential surveillance device,” says Julian Todt, one of the study’s authors. “If you regularly walk past a café that has a WiFi network, you could be identified without your knowledge and later recognized by government agencies or commercial companies.”
That is a serious warning, and it captures the core concern very well. Intelligence services and cybercriminals already have many easier ways to monitor people, including compromising CCTV systems or intercepting video communications. But wireless networks are different. They create a nearly invisible surveillance layer that already exists in a huge number of places.
Unlike earlier approaches that depended on LiDAR sensors or on reflection-based systems using walls, furniture, and human bodies, this method works with standard WiFi equipment. By collecting BFI data, researchers can build representations of people from several different viewing angles. These representations are then used to distinguish one person from another, even when the number of people is large. Once the machine learning model has been trained, the identification process can happen in just a few seconds.
BFI vs CSI accuracy as the number of WiFi packets increases. BFI reaches near-perfect accuracy almost instantly, while CSI requires hundreds of packets to approach similar performance
Experimental Results
The study involved 197 participants. The researchers reported that they were able to identify individuals with nearly 100% accuracy, regardless of viewing angle or walking style. That is an impressive result, but it did not come easily. To reach that level of accuracy, the model needed a substantial amount of machine learning training. Each person in the training set performed around 20 walking passes before the model was trained.
BFI vs CSI accuracy across different walking styles. BFI maintains near-perfect accuracy regardless of how a person walks or what they carry, while CSI struggles significantly when walking styles change
During the research two TP-Link Archer BE800 routers were used. The experiment relied on channels 37 and 85. It also used two non-overlapping 160 MHz channels in the 6 GHz band available under WiFi 6E. The hardware included Intel AX210 WiFi network adapters.
Accuracy of five WiFi identification systems as the number of people grows. BFId (BFI) and LW-WiID maintain near-perfect accuracy even at 170 individuals, while competing systems degrade sharply with FreeSense dropping to near 15% at scale
The researchers stress that the technology is powerful, but also potentially dangerous. The risks are especially serious in authoritarian states, where systems like this could be used for large-scale population surveillance. In such settings, the ability to identify people without their phones, without cameras and without obvious visible monitoring would be a major privacy threat.
For that reason, the authors strongly recommend that privacy protections and security safeguards be built into the upcoming IEEE 802.11bf standard from the start, rather than added later as an afterthought.
WiFi 6 Routers as Motion Sensors
In fact, WiFi-based sensing has become so effective that some modern routers already include motion-detection features right out of the box, and manufacturers openly advertise them.
Xfinity
Features such as WiFi Motion Detection allow homeowners to monitor activity inside their homes through mobile apps, using nothing more than changes in WiFi signal patterns.
A feature designed for convenience in a home can also become part of a much broader surveillance system when deployed at scale.
Related WiFi and Bluetooth Scanning Tools
As an additional note, several tools already exist that monitor wireless activity in nearby environments. They don’t work exactly the same way as the techniques we covered earlier, but they’re still useful.
Pi.Alert scans devices connected to a WiFi network, detects unknown devices, and sends notifications when devices unexpectedly disconnect from the network. It is often used as a practical awareness tool for keeping track of what is present on a home or local network.
WireTapper discovers nearby wireless signals, including WiFi networks, Bluetooth devices, hidden cameras, vehicles, headphones, televisions, and cellular towers. It gives the user a broader view of the wireless environment around them, which can be useful for awareness and inspection.
Video
We also have an video on this topic with Master OTW and Yaniv Hoffman. In the video, OTW explains how hackers can use SDR, AI, and Wi-Fi signals to detect human movement through walls, how the technology works, and talk about practical ways to defend against it. Feel free to check it out.
Summary
As modern routers gain advanced sensing, they can also become tools for observing and identifying people through the way their bodies interact with wireless signals. The KIT research shows that this is a practical technology that can identify individuals with remarkable accuracy using ordinary WiFi hardware. Although WiFi sensing can be valuable for smart homes and automation, it also raises serious privacy concerns. Privacy protections will need to become just as important as performance improvements.
If you’re interested in Wi-Fi security, our Wi-Fi Hacking training can help you gain the necessary experience. This attack vector is often underestimated, and many organizations are vulnerable to it. It is definitely valuable in penetration testing.
Login
