Guide · Agent skill
How to use the WPA3 SAE attack methodology agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The offensive-wpa3-sae skill is a text playbook that tells an AI agent how to assess WPA3-SAE Wi-Fi networks. It covers transition-mode downgrades, Dragonblood-class weaknesses, SAE authentication flooding and the rules that Wi-Fi 6E (6 GHz) places on WPA3. It is written for authorized wireless penetration testers and students who already know Wi-Fi tools. After this guide you will know how to install the skill, how to phrase requests so the agent uses it, and what you need in place before you test anything.
WPA3 / SAE Attack MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Confirm authorization. Get written permission for the exact network and scope before you install or run anything. The skill requires it.
- 2Download the ZIP. Download the offensive-wpa3-sae ZIP from our page and unzip it so that SKILL.md is inside the skill folder.
- 3Place the skill. Move the folder into ~/.claude/skills/ for personal use or into .claude/skills/ in a project. Alternatively, upload it in the Claude apps under Settings, Capabilities, Skills.
- 4Prepare the lab tools. Set up a Linux machine with a monitor-mode capable adapter, the Aircrack-ng suite, mdk4 and hostapd-mana or similar tools. Clone the Dragonblood scripts from GitHub.
- 5Make a natural request. Describe the target, your authorization and the goal, such as checking whether a network advertises WPA3-SAE or runs transition mode.
- 6Review each step. Read the agent's reasoning for each stage and confirm it matches the scope you were given before any transmission.
- 7Document findings. Ask for a written list of attacks that were ruled out and those that remain viable, with the observations behind each.
What the skill makes the agent do
WPA3 replaces the WPA2 4-way pre-shared key exchange with SAE (Simultaneous Authentication of Equals), so the simple offline cracking of a captured handshake is no longer the main path. The skill tells the agent to look for the places where WPA3 deployments still leak: transition-mode networks that also allow WPA2, implementations of the original SAE design with known side-channel issues (the Dragonblood CVEs), and SAE commit handling that can be overloaded.
The skill is a single file, SKILL.md, that gives the agent a workflow to follow. It starts by confirming the target advertises WPA3, checks for transition mode, fingerprints the access point where possible, and only then looks at side-channel or flooding approaches. It ends with a step to document which attacks remain viable.
- Checks whether the AP advertises WPA3-SAE and whether it runs transition mode (WPA2 and WPA3 together)
- Describes the transition-mode downgrade and the Dragonblood side-channel and downgrade issues
- Explains SAE authentication flooding as a denial-of-service risk
- Explains how Wi-Fi 6E rules (WPA3-only, PMF mandatory) limit several attacks
How to install the skill
Download the ZIP for offensive-wpa3-sae from our page and unzip it. The skill folder contains SKILL.md. Put the folder in one of two places: ~/.claude/skills/ to make it available to all your projects, or the .claude/skills/ folder inside a single project to limit it to that project.
If you use the Claude apps instead of a local setup, open Settings, go to Capabilities, and upload the skill under Skills. Once it is loaded, the agent can pick it up when a request matches its description.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into .claude/skills/ in the project folder
- Claude apps: Settings, then Capabilities, then Skills, then upload
How to trigger the skill with natural requests
The skill's description says it applies when the target advertises WPA3-SAE or WPA3-Personal/Enterprise, or when the target operates in 6 GHz. Your request should therefore name the wireless context and the goal, and state that you have authorization. You do not need special syntax.
Be specific about the network you own or are authorized to test. Name the SSID or BSSID, the channel if you know it, and whether you suspect transition mode. Ask the agent to follow the methodology step by step so you can review each result.
- Authorized WPA3 check: I have written permission to test the corporate network CorpWiFi. Check whether it advertises WPA3-SAE and whether it runs transition mode.
- Patch assessment: Our lab access point may run an older hostapd. Walk through the Dragonblood applicability checks for it.
- 6 GHz review: Our 6 GHz SSID should be WPA3-only with PMF. Which attacks from the methodology still apply?
What you need before you start
The skill assumes a Linux machine with a Wi-Fi adapter that supports monitor mode and packet injection. The source lists the Aircrack-ng suite (airodump-ng and airbase-ng), mdk4, and hostapd-mana or similar tooling for rogue access point work. The Dragonblood test scripts dragontime.py and dragondrain.py are referenced by the skill but not included, so you clone them from GitHub yourself.
Most importantly, you need written authorization for the target network. The skill's own guidance is that attacks on networks you do not own or have permission to test are illegal in most jurisdictions.
- Linux machine with a monitor-mode and packet-injection capable Wi-Fi adapter
- Aircrack-ng suite, mdk4, and hostapd-mana or similar tools
- Dragonblood scripts cloned from the dragonblood GitHub repository (not bundled)
- Written authorization for the target network
git clone https://github.com/vanhoefm/dragonbloodExample: reading a typical session
A typical session starts with passive checks. The agent uses airodump-ng on a monitor interface to read the encryption column for the target BSSID. If it shows both WPA2 and WPA3, the skill treats transition mode as the easiest path to examine. If it shows WPA3 only, the skill moves to fingerprinting and side-channel considerations.
The skill also explains how to check whether the access point advertises Hash-to-Element (H2E). It suggests a Wireshark display filter for this field. If H2E is present and required, the source says the Dragonblood-class attacks do not apply, and the agent should document that result rather than push further.
- Passive first: read the encryption mode from beacon data before sending anything
- Transition mode is flagged as the easiest path, so it gets the most review time
- H2E present and required means the Dragonblood-class attacks are not applicable per the skill
- The final step is a written list of the attacks that remain viable
wlan.rsnx.field.h2eSafety notes: scripts and network access
The skill file is text guidance with example commands. It contains no scripts of its own and it does not make network calls. The commands it shows, such as the airodump-ng, airbase-ng, mdk4 and Dragonblood script examples, are run by you or by the agent on your machine, against the network you point them at. The skill itself does not scan anything.
The SAE flooding section is a denial-of-service technique. The skill says to use it only with explicit authorization, because it can exhaust access point CPU and deny service to real users. Do not run flood commands on production or consumer networks without that authorization.
- No bundled scripts; the Dragonblood scripts must be obtained separately
- No network use by the skill file itself
- Flooding can deny service, so treat it as a last resort in an authorized test window
- Run tests in a lab or on networks you are permitted to disrupt
Tips for getting useful results
Ask for the reasoning behind each step, not only the commands. The skill's value is the decision logic: which path to take for transition mode, pure WPA3, and 6 GHz. Keep a log of the BSSID, channel, encryption mode and firmware details you observe, because the Dragonblood applicability check depends on them.
Use the skill alongside the rest of your assessment. The source points to offensive-wpa2-psk for capturing a WPA2 handshake after a transition-mode downgrade, and to evil-twin, EAP or RF approaches when pure WPA3 leaves no viable SAE path.
- Ask the agent to explain why each step applies to the network you describe
- Record observations as you go so the final report is traceable
- Pair this skill with the WPA2 PSK skill when transition mode is in play
- Read the skill's detection notes to understand what a monitoring system may flag
What people use it for
- Checking whether an authorized corporate WPA3 network runs transition mode that allows a WPA2 fallback
- Assessing whether older access points in a lab are in scope for Dragonblood-class issues
- Reviewing a 6 GHz Wi-Fi 6E deployment to confirm WPA3-only and PMF requirements are met
- Teaching students how the SAE commit exchange works and where its weaknesses have been reported
Frequently asked questions
How do I install the WPA3 SAE attack skill?
Download the ZIP from our page and unzip it. Place the folder in ~/.claude/skills/ for personal use or in .claude/skills/ inside a project. In the Claude apps, you can instead upload it under Settings, Capabilities, Skills.
What do I need to use offensive-wpa3-sae?
You need a Linux machine with a Wi-Fi adapter that supports monitor mode and packet injection, the Aircrack-ng suite, mdk4, and hostapd-mana or similar tools. The Dragonblood scripts must be cloned from GitHub because the skill does not include them. Written authorization for the target network is also required.
Is the WPA3 SAE attack skill free to use?
The skill is listed under the MIT licence. The licence governs the skill's code and files, and the tools it references are separate projects with their own terms.
Does this skill run scripts or access the network?
No. The skill file is text guidance with example commands. The source states it runs no scripts and uses no network, so any commands run on your own machine against a target you choose.
Why won't my agent trigger the WPA3 skill?
The skill applies when the target advertises WPA3-SAE or WPA3-Personal/Enterprise, or operates in 6 GHz. Name the wireless context and goal in your request. Also confirm the folder sits in the right skills location and contains SKILL.md.
How does this compare to a WPA2 cracking skill?
This skill covers WPA3 SAE specifically, including transition-mode downgrades and Dragonblood-class issues. The source points to a separate WPA2 PSK skill for capturing a handshake after a transition-mode downgrade, so the two are complementary rather than substitutes.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits authorized wireless penetration testers, security teams checking older access points for Dragonblood-class issues, and students learning how WPA3 SAE works. It is not suitable for anyone without written permission to test the network, or for people new to Wi-Fi tooling, because it assumes monitor-mode hardware and command-line experience. Choose a different resource if you need a guided tool with a user interface rather than a methodology document.
Download the skill