# operator console — Kali (R0ll1ngThund3r). Begin the engagement below.
Engagement objective met.
You went from "the WiFi uses WPA3, we're fine" to root on an internal file server — without ever attacking WPA3 itself. You attacked the transition-mode door WPA3 was left propped open beside.
The kill chain you just ran
- Transition mode spotted — the AP advertised
SAE WPA2, so a WPA2 path existed. - Forced downgrade — a WPA2-only rogue clone plus a deauth pushed the client off WPA3 and onto WPA2.
- Captured handshake — the WPA2 four-way handshake, the exact artifact SAE would have denied you.
- Offline crack — a weak PSK fell to a wordlist in seconds, no further contact with the network.
- Compromise — the cracked key put you on the LAN, and one unpatched service gave you root.
Why it worked
WPA3-SAE itself held — you never cracked it, because you can't crack it offline. The failure was transition mode: keeping WPA2 enabled for legacy devices handed the attacker a fully crackable handshake, and a weak passphrase did the rest.
How WPA3, done right, stops this
- WPA3-only mode (disable transition) — a WPA3-only client ignores the rogue WPA2 AP, and the attack dies at step 2.
- A strong, random PSK — even a captured WPA2 handshake is useless if the password isn't in any wordlist.
- 802.1X / EAP-TLS (WPA-Enterprise) — certificate-based auth means there is no shared PSK to crack at all.
- Mandatory PMF — protected management frames make the deauth step far harder to land.
Document the path, the cracked credential (handled securely), and the host you reached — then clean up and write it for the report.