How to use the WPA-Enterprise Wi-Fi Attack Playbook agent skill

What is this skill and what does it make the agent do?

An agent skill is a folder with a SKILL.md file that the agent reads when a request matches the skill's description. This skill, from the Claude-Red collection, contains a wireless offensive methodology for 802.1X networks. Enterprise Wi-Fi authenticates users against a RADIUS server, usually backed by Active Directory, so there is no pre-shared key to guess. The skill directs attention to the supplicant's trust in the server certificate, the inner EAP method's crypto, and the way client certificates are issued.

• Identify the EAP method from beacons and the initial EAP-Request/Identity exchange (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST, and others listed in the skill).
• Run an evil-twin RADIUS attack with eaphammer to capture usernames and MSCHAPv2 challenge-response pairs.
• Crack captured MSCHAPv2 responses offline with asleap or hashcat.
• Cover EAP-TLS client certificate theft paths, supplicant validation bypass, and post-crack pivots into AD.
• Include defender mitigations and detection signals.

How do you install the offensive-wpa-enterprise skill?

Download the skill ZIP from this page and unzip it. The skill folder should contain SKILL.md. Put the folder in one of two places depending on how you work with your agent.

For a personal setup, unzip it into ~/.claude/skills/. For a single project, place it in that project's .claude/skills/ folder so it only loads there. If you use the Claude apps instead, upload the ZIP under Settings → Capabilities → Skills.

• Personal: ~/.claude/skills/
• Project only: .claude/skills/ inside the project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with natural requests?

You do not need a special command. The agent loads the skill when your request matches its description, which centres on WPA-Enterprise, 802.1X, EAP, evil-twin RADIUS attacks and corporate Wi-Fi engagements. Name the network type and the engagement context. Mention the target network type explicitly, because the skill is scoped to enterprise 802.1X and will not fit home or WPA2-PSK networks.

Good requests state the goal, the authorization and the constraint. For example, you can ask the agent to walk through identifying the EAP method on a network you are authorized to test, or to build a checklist for an evil-twin RADIUS test against a PEAP-MSCHAPv2 network.

• "We have written authorization to test CorpWiFi, which uses 802.1X. Walk me through identifying its EAP method."
• "Give me the engagement checklist for an evil-twin test against a PEAP-MSCHAPv2 network."
• "I captured an MSCHAPv2 challenge and response in an authorized test. What is the offline cracking workflow?"
• "Explain how supplicant server-validation misconfigurations enable evil-twin attacks so I can write the remediation section."

What do you need before you run any of it?

The skill is a methodology and command reference. It does not supply hardware, and the steps assume a working lab. The source lists the following requirements. Beginners without wireless hardware and a lab will find the steps hard to follow.

• A Linux host with the aircrack-ng suite, tshark/Wireshark, and a monitor-mode capable wireless adapter.
• eaphammer installed.
• asleap and hashcat, with wordlists such as rockyou.txt.
• netexec (nxc) and bloodhound-python for the post-crack AD steps.
• Optional: a paid rainbow-table service (crack.sh) referenced in the text.
• Written authorization for the target network.

What does an authorized evil-twin workflow look like?

The skill's cheatsheet follows a fixed order: identify the EAP method, run the evil twin, watch for MSCHAPv2 challenges, crack offline, validate credentials against the domain, then hand off to the AD chain. Each step names the tool and the command pattern. The commands below come from the skill's example for running eaphammer with credential capture.

When a client associates, eaphammer logs the username, challenge and response. The skill then shows two offline cracking options, asleap and hashcat mode 5500.

• Step 1: Identify the EAP method with tshark in monitor mode.
• Step 2: Run eaphammer as a rogue AP and RADIUS server.
• Step 3: Watch the console for User, Challenge and Response lines.
• Step 4: Crack offline with asleap or hashcat.
• Step 5: Validate recovered credentials with nxc.
• Step 6: Hand off to the AD attack chain.

How do you read the detection and defence sections?

The skill is not only for attackers. It explains why evil-twin attacks work: if a supplicant does not validate the RADIUS server's CA chain or its CN or SAN, a self-signed certificate can be accepted and MSCHAPv2 runs inside a tunnel to the attacker. The skill lists the defender fixes it names, such as requiring server certificate validation by policy, pinning the trusted CA and RADIUS server CN, and managing BYOD supplicant settings through enrollment.

The detection table lists signals such as rogue RADIUS ESSIDs flagged by a WIPS, rising MSCHAPv2 failures in RADIUS logs, and certificate mismatch events in Windows Event Viewer. Blue teams can use these to write detection rules and hardening tasks.

• Require server certificate validation and pin the trusted CA and RADIUS CN.
• Watch for AP impersonation by ESSID or BSSID.
• Monitor RADIUS logs for repeated authentication failures from one supplicant.
• Review Windows Wi-Fi certificate mismatch events.

What safety limits should you follow?

This skill runs no scripts, but it does use the network, and its commands capture other people's credentials when run against live users. Use it only on networks you own or have written authorization to test. The skill's own scope note says capturing credentials from others is illegal and causes real harm.

Keep the test inside the agreed scope. Do not use this skill on home networks or WPA2-PSK networks, since it targets 802.1X setups. Treat any captured credential as sensitive, store it according to your engagement rules, and report it rather than reuse it outside the test.

• Get written authorization that names the network and the time window.
• Do not run it against networks you do not own or cannot test.
• Do not use it on home or WPA2-PSK networks.
• Handle captured credentials and hashes under your engagement's data rules.