This work describes available and used standards, protocols and mechanisms used to secure IEEE 802.11 wireless networks. In the next section are listed vulnerabilities and possible attacks against different types of security. The principles of individual attacks on authentication, WEP security and WPA/WPA2 personal mode are described and realized using various software especially linux program aircrack-ng. Password for WEP security is obtained by passive eavesdropping data, using ARP replay injection and by creating own frames. The last two methods are used to generate traffic on the network, which is captured and then used to derive the WEP password. By injecting ARP frames, password was found in the number 60 000 captured frames and about 180 000 frames of data was needed for passive method. Decryption of WEP frame was done by fragment and KoreK chopchop attacks. This decrypted frame could be used to create fake frames and obtain WEP password. Brute force attack is realized for security WPA (WPA2) personal mode (often due to lack of strong password) by comparing password (passphrase) from password list. Speed of comparing is about 200 passwords/s.

Nowadays every wireless radio-communication services encompass huge type of technology used for transfer video, voice or data. Wireless communication is the most expanded branch and many companies are using this technology because of low cost and simply management. The biggest advantage is easy connection to shared wireless medium and allows users of network to move around whole covered area. The most expanded types of wireless networks are called Wireless LAN (WLAN). With rising number of WLANs is rising chance to attack shared wireless medium by hacker and many sensitive information can be stolen or modified. To avoid this chance was created the first security protocol used in WLAN called WEP. Its goal was protect data transmitted trough WLAN as strong as were protected in wired networks. Unfortunately WEP was hiding a big weakness which can be used in a crack of WLAN in a minute with the aid of special software. Example of this kid of software can be Airsnort constructed to monitor shared medium and captured every packet transferred trough this medium. Based on statistical method Airsnort can obtain hidden password in a few minutes. The second type of this software can be Aircrack-ng, which can crack hidden password without any user connected to WLAN. Aircrack-ng uses active techniques to generate network load and can obtain password more effectively and faster. The result of both cases was successful and protection of WLAN was completely cracked. Later was created new security protocol called WPA, which had to fix the cryptography weakness of previous WEP. WPA was only temporary security protocol, during standard 802.11 was developing which had to offer highest security and integrity protection of transferred data trough WLAN. For this reasons was created new version of WPA called WPA2 which satisfy requirements of standard 802.11i. Both protocols WPA/WPA2 contain weakness, which can crash security of WLAN. This crack is based on authentication PSK. Attacker during authentication is using information from four-way handshake between user of WLAN and access point. Based on this information attacker can crack password with the aid of password list attack which took approximately 30 minutes. Based on previous result is important to chose strong password contains alphanumeric string or special strings with satisfy length.

Tools that automate processes are always sough after across the entire IT field. This project's aim was to build and evaluate a semi-automated reconnaissance tool based on a Raspberry Pi 4, for use in penetration testing and/or digital forensics. The software is written in Python 3 and utilizes Scapy, PyQt5 and the Aircrack-ng suite along with other pre-existing tools. The device is targeted against wireless networks and its main purpose is to capture what is known as the WPA handshake and thereby crack Wi-Fi passwords. Upon achieving this, the program shall then connect to the cracked network, start packet sniffing and perform a host discovery and scan for open ports. The final product underwent three tests and passed them all, except the step involving port scanning - most likely due to hardware and/or operating system faults, since other devices are able to perform these operations. The main functionalities of this device and software are to: identify and assess nearby network access points, perform deauthentication attacks, capture network traffic (including WPA handshakes), crack Wi-Fi passwords, connect to cracked networks and finally to perform host discovery and port scanning. All of these steps shall be executed automatically after selecting the target networks and pressing the start button. Based on the test results it can be stated that this device is well suited for practical use within cyber security and digital forensics. However, due to the Raspberry Pi's limited computing power users may be advised to outsource the cracking process to a more powerful machine, for the purpose of productivity and time efficiency.