Guide · Agent skill
How to use the KRACK & FragAttacks Wi-Fi testing agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
This guide explains the offensive-krack-fragattacks skill, a playbook that gives an AI agent a structured way to check whether Wi-Fi client devices are exposed to two published attack families against WPA2: KRACK (key reinstallation) and FragAttacks (fragmentation and aggregation flaws). It is written for readers who have never used an agent skill before. By the end you will know how to install the skill, how to ask for it in plain language, what the agent needs from you before it starts, and how to write up results.
KRACK & FragAttacks Wi-Fi TestingSnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download and unzip. Download the skill ZIP from this page and unzip it so that SKILL.md sits in a skills folder.
- 2Place the folder. Put it in ~/.claude/skills/ for personal use, or in .claude/skills/ inside a project. In the Claude apps, upload it under Settings, Capabilities, Skills.
- 3Prepare the lab. Set up a Linux machine with a monitor and injection capable Wi-Fi adapter, sudo access, aireplay-ng, and hostapd-mana.
- 4Clone the test repositories. Clone Vanhoef's krackattacks-scripts and fragattacks repositories from GitHub.
- 5Confirm written authorization. Get written permission covering each target device before any test runs.
- 6Ask the agent for an assessment. Describe the device type, the scope, and the goal in plain language, and let the agent run the test suite.
- 7Report each CVE. Record each vulnerable variant separately with its CVE, the firmware version, and the remediation.
What does the KRACK & FragAttacks skill make the agent do?
A skill is a folder containing a SKILL.md file of instructions that an agent loads when a task matches its description. This one covers two attack families against WPA2 client implementations. KRACK (CVE-2017-13077 to 082) targets the key reinstallation weakness in the 4-way handshake. FragAttacks (CVE-2020-24586 to 588 and 26139 to 26147) covers fragmentation and aggregation flaws.
The skill tells the agent which devices are likely still exposed and which are probably mitigated. Embedded OEM devices, old Android phones, industrial or SCADA Wi-Fi clients, and cheap IoT gear are the cases it flags as most likely vulnerable. Modern patched operating systems are described as mitigated. The agent also walks through the test scripts, the CVE variants to check, and a reporting format for remediation.
Install the skill from the ZIP file
Download the skill as a ZIP file from this page and unzip it. You can install it in one of two places. For a personal setup, unzip it into ~/.claude/skills/. For a single project, unzip it into the project's .claude/skills/ folder. Either way, the folder should contain SKILL.md.
If you use the Claude apps instead, open Settings, go to Capabilities, then Skills, and upload the skill there.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Apps: Settings → Capabilities → Skills, then upload
Set up the test environment
The skill assumes a Linux machine with a Wi-Fi adapter that supports monitor and injection mode. You also need root or sudo privileges, the aircrack-ng suite (for aireplay-ng), and hostapd-mana for the rogue access point setup. You must also clone Vanhoef's two repositories from GitHub.
Do not start any test until you have written authorization covering the specific target devices.
- Linux machine with a monitor and injection capable Wi-Fi adapter
- Root or sudo access
- aircrack-ng suite (aireplay-ng)
- hostapd-mana for rogue AP setup
- Vanhoef's krackattacks-scripts and fragattacks repositories
- Written authorization for each target device
git clone https://github.com/vanhoefm/krackattacks-scripts
git clone https://github.com/vanhoefm/fragattacksHow do you trigger the skill with a natural request?
You do not need special syntax. Describe the task in plain language, and include the device type, the scope, and that you have authorization. The agent matches the request to the skill's description, which mentions legacy supplicants, embedded clients, and vendors with poor patch cadence.
Good requests name the target and the goal. Weak requests like 'hack my neighbour's Wi-Fi' will not be treated as authorized assessment work, and the skill steers the agent toward authorized penetration testing.
- Assess whether this embedded camera client is vulnerable to KRACK. I have written authorization for the device.
- Check our point-of-sale terminals for FragAttacks variants. Report each CVE separately.
- Help me plan a legacy Android phone test for the KRACK and FragAttacks CVEs, including what evidence to record.
Run the test scripts and read the output
The skill points to Vanhoef's official test scripts. For KRACK, the krack-test-client.py script tests a supplicant on a connected client. For FragAttacks, test-fragattacks.py runs a suite of about 12 tests, one per variant. The KRACK output identifies which CVE variants the client is vulnerable to.
The targeting workflow runs as follows: identify the in-scope client by MAC, OS, and vendor; estimate patch likelihood; run the test suite from a controlled AP setup; then report each vulnerable variant against its CVE. The source example drives the client through a rogue AP and forces association with a deauthentication frame from aireplay-ng before running the test.
- Identify the client (MAC, OS, vendor) and confirm it is in scope
- Estimate patch likelihood based on OS and device type
- Run the test suite from the controlled AP setup
- Record results for each CVE separately
git clone https://github.com/vanhoefm/fragattacks
cd fragattacks
sudo ./test-fragattacks.py wlan0 --interface wlan0
cd krackattacks-scripts/krackattack
sudo ./krack-test-client.py --interface wlan0Understand the practical limits and safety notes
The skill is explicit that these attacks are mostly mitigated on modern systems, so a negative result on a current device is expected. KRACK does not recover the wireless password (PSK). Its practical outcomes include decrypting WPA2 frames between client and AP, and recovering session keys for the affected key cycle. FragAttacks outcomes include injecting frames the client treats as legitimate and reading decrypted fragments from cached state.
Safety matters. The skill runs scripts and uses the network. Deauthentication frames can disrupt real users, and the source notes that WIPS may flag deauth-driven roams to an attacker AP. Test scripts produce distinctive frame patterns, and modern WIPS recognizes Vanhoef's tooling. Schedule tests with the asset owner, and stop if the device or network is affected.
- Only test devices you own or have written permission to test
- Deauthentication can disrupt real users; coordinate with the owner
- Scripts generate detectable frame patterns; WIPS may alert
- Mitigation is a short note: WPA3 and PMF block most of these
Write up findings for remediation
For each vulnerable CVE, record the client model and firmware version, the variant tested, and the result: vulnerable, patched, or partial. Describe the practical impact in the engagement context, such as decryption only or viable injection. Then give remediation: the vendor's patch information and the mitigation. The skill's note is that WPA3 with PMF blocks most of these attacks.
Keep the report specific. A vague statement that a device 'may be vulnerable' is less useful to the vendor than a firmware version, a CVE number, and a tested result.
- Client model and firmware version
- Variant tested and result (vulnerable, patched, partial)
- Practical impact in this engagement
- Remediation: vendor patch and WPA3 with PMF
What people use it for
- Testing an embedded OEM camera or sensor that rarely receives firmware updates.
- Auditing point-of-sale terminals for FragAttacks variants during an authorized engagement.
- Checking industrial or SCADA Wi-Fi clients whose patch cadence is slow.
- Teaching students how WPA2 client-side vulnerabilities were discovered and tested in a lab.
Frequently asked questions
How do I install the KRACK and FragAttacks agent skill?
Download the skill ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into .claude/skills/ in a project. In the Claude apps, you can instead upload it under Settings, Capabilities, Skills.
Is the offensive-krack-fragattacks skill free?
The source lists the licence as MIT. Check the licence file in the repository for the terms that apply to your use.
What do I need to run the KRACK and FragAttacks tests?
You need a Linux machine, a Wi-Fi adapter that supports monitor and injection mode, root or sudo privileges, aireplay-ng from the aircrack-ng suite, hostapd-mana, and Vanhoef's two GitHub repositories. You also need written authorization for the target devices.
Will KRACK let me find the Wi-Fi password?
No. The skill states that KRACK is not a PSK recovery attack. It can allow decryption of frames between a client and the access point, but it does not reveal the wireless password.
Are modern phones and laptops vulnerable to KRACK and FragAttacks?
The skill describes most modern patched operating systems as mitigated, so a negative result on a current device is expected. It identifies older Android phones, embedded OEM devices, and IoT gear as the most likely to remain exposed.
What is the alternative to testing for these attacks?
The skill's remediation note is to use WPA3 with PMF, which blocks most of these attacks. For devices you cannot upgrade, check the vendor's patch information and the CISA advisories the skill references.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits penetration testers with written authorization who assess embedded, legacy, or IoT Wi-Fi clients, and security teams auditing devices with poor patch cadence. It is not suited to testing networks or devices you do not own, or to securing a home router, because its focus is attack testing and mitigation gets only a short note. On a modern, patched device, expect the attacks to be largely mitigated.
Download the skill