Post cover image

October 23, 2026

Wi-Fi Fundamentals and Reconnaissance — TryHackMe Walkthrough

Task 1

By Ag3ntOrang3

6 min read

None

Task 1

Deploy the machine and read through the introduction, then continue to the next task when you are ready.

Answer: No answer needed

Task 2

What is the term for the MAC address that uniquely identifies a single access point?

BSSID

What term describes the human-readable name of a wireless network?

ESSID

None

Task 3

Which type of 802.11 frame does an access point broadcast periodically to advertise its presence?

beacon

None

Which management frame does a client send to actively search for a network by name?

probe request

None

Task 4

After running sudo airmon-ng start wlan0, what is the name of the monitor-mode interface that is created?

wlan0mon

user@ip-10-144-129-9:~$ sudo airmon-ng check kill

Killing these processes:
    PID Name
    493 dhclient
    646 wpa_supplicant
user@ip-10-144-129-9:~$ sudo airmon-ng start wlan0
PHY Interface Driver  Chipset
phy2 wlan0  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
  (mac80211 monitor mode vif enabled for [phy2]wlan0 on [phy2]wlan0mon)
  (mac80211 station mode vif disabled for [phy2]wlan0)
phy3 wlan1  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy4 wlan2  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy5 wlan3  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy6 wlan4  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy7 wlan5  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy62 wlan60  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy63 wlan61  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy64 wlan62  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211
phy65 wlan63  mac80211_hwsim Software simulator of 802.11 radio(s) for mac80211

user@ip-10-144-129-9:~$ sudo iw dev
phy#65
 Interface wlan63
  ifindex 70
  wdev 0x4100000001
  addr 02:00:00:00:3f:00
  type managed
  txpower 20.00 dBm
phy#64
 Interface wlan62
  ifindex 69
  wdev 0x4000000001
  addr 02:00:00:00:3e:00
  type managed
  txpower 20.00 dBm
phy#63
 Interface wlan61
  ifindex 68
  wdev 0x3f00000001
  addr 02:00:00:00:3d:00
  type managed
  txpower 20.00 dBm
phy#62
 Interface wlan60
  ifindex 67
  wdev 0x3e00000001
  addr 02:00:00:00:3c:00
  type managed
  txpower 20.00 dBm
phy#7
 Interface wlan5
  ifindex 12
  wdev 0x700000001
  addr 02:00:00:00:05:00
  type managed
  txpower 20.00 dBm
phy#6
 Interface wlan4
  ifindex 11
  wdev 0x600000001
  addr 02:00:00:00:04:00
  type managed
  txpower 20.00 dBm
phy#5
 Interface wlan3
  ifindex 10
  wdev 0x500000001
  addr 02:00:00:00:03:00
  type managed
  txpower 20.00 dBm
phy#4
 Interface wlan2
  ifindex 9
  wdev 0x400000001
  addr 02:00:00:00:02:00
  type managed
  txpower 20.00 dBm
phy#3
 Interface wlan1
  ifindex 8
  wdev 0x300000001
  addr 02:00:00:00:01:00
  type managed
  txpower 20.00 dBm
phy#2
 Interface wlan0mon
  ifindex 76
  wdev 0x200000002
  addr 02:00:00:00:00:00
  type monitor
  channel 1 (2412 MHz), width: 20 MHz (no HT), center1: 2412 MHz
  txpower 20.00 dBm

Task 5

What value appears in the AUTH column for an enterprise (802.1X) network?

MGT

What channel are the enterprise networks operating on?

44

How many access points are broadcasting the ESSID CorpNet?

2

user@ip-10-144-129-9:~$ sudo airodump-ng --band bg wlan0mon
CH  8 ][ Elapsed: 1 min ][ 2026-10-23 04:43 ][ WPA handshake: F0:9F:C2:71:22:
 BSSID              PWR  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH ESS
 F0:9F:C2:71:22:17  -25       98      104    3  44   54e  WPA2 CCMP   MGT  Cor
 F0:9F:CB:3F:BC:27  -25       98        0    0  44   54   WPA2 CCMP   MGT  Cor
 F0:9F:C2:71:AF:2F  -25       98      590    0  44   54   WPA3 CCMP   OWE  Fre
 F0:9F:C2:71:22:16  -25       98       37    0  44   54e  WPA2 CCMP   MGT  Bra
 F0:9F:C2:7A:33:28  -25       98       47    1  44   54e  WPA2 CCMP   MGT  Bra
 F0:9F:C2:71:22:1A  -25       98        0    0  44   54e  WPA2 CCMP   MGT  Cor
 F0:9F:C2:71:22:15  -25       98        4    0  44   54e  WPA2 CCMP   MGT  Cor
 88:15:44:78:8A:F3  -28       38        0    0   6   54   WPA2 CCMP   PSK  MiF
 F0:9F:C2:71:22:12  -28       38       12    1   6   54   WPA2 CCMP   PSK  Hom
 F0:9F:C2:71:22:10  -28       38       20    2   6   54   OPN              Gue
 88:15:44:BC:FA:C1  -28       41        0    0  11   54   WPA2 CCMP   PSK  WIF
 F0:9F:C2:1A:CA:25  -28       41       20    0  11   54e  WPA3 CCMP   SAE  IT-
 F0:9F:C2:6A:88:26  -28       41        0    0  11   54   OPN              <le
 F0:9F:C2:11:0A:24  -28       41        0    0  11   54e  WPA3 CCMP   SAE  Mgm
 88:15:44:BF:99:A2  -28       38        0    0   9   54   WPA2 CCMP   PSK  vod
 88:15:44:AA:3A:10  -28       65        0    0   3   54   WPA2 CCMP   PSK  MOV
 F0:9F:C2:71:22:11  -28       65     2327   35   3   54   WEP  WEP         Hom
Quitting...
user@ip-10-144-129-9:~$ sudo airodump-ng --band a -c 44 wlan0mon

CH 44 ][ Elapsed: 1 min ][ 2026-10-23 04:44 ][ fixed channel wlan0mon: 8
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH
 88:15:44:AA:3A:10  -28   0       10        0    0   3   54   WPA2 CCMP   PSK
 88:15:44:BF:99:A2  -28   0       12        0    0   9   54   WPA2 CCMP   PSK
 F0:9F:C2:71:22:11  -28   0       10      382    0   3   54   WEP  WEP
 F0:9F:C2:71:22:13  -28   0       15        0    0   8   54   WPA2 CCMP   PSK
 88:15:44:78:8A:F3  -28   0       14        0    0   6   54   WPA2 CCMP   PSK
 F0:9F:C2:71:22:12  -28   0       14        8    0   6   54   WPA2 CCMP   PSK
 F0:9F:C2:71:22:10  -28   0       14       12    0   6   54   OPN
 88:15:44:BC:FA:C1  -28   0       15        0    0  11   54   WPA2 CCMP   PSK
 F0:9F:C2:1A:CA:25  -28   0       15        0    0  11   54e  WPA3 CCMP   SAE
 F0:9F:C2:6A:88:26  -28   0       15        0    0  11   54   OPN
 F0:9F:C2:11:0A:24  -28   0       15        0    0  11   54e  WPA3 CCMP   SAE
 F0:9F:C2:71:22:17  -25   0      426      855   18  44   54e  WPA2 CCMP   MGT
 F0:9F:CB:3F:BC:27  -25   0      426        9    0  44   54   WPA2 CCMP   MGT
 F0:9F:C2:71:AF:2F  -25   0      426     1770   40  44   54   WPA3 CCMP   OWE
 F0:9F:C2:71:22:16  -25   0      426      129    0  44   54e  WPA2 CCMP   MGT
 F0:9F:C2:7A:33:28  -25   0      426      175    0  44   54e  WPA2 CCMP   MGT
 F0:9F:C2:71:22:1A  -25 100      426        0    0  44   54e  WPA2 CCMP   MGT
user@ip-10-144-129-9:~$ sudo airodump-ng -c 44 --bssid F0:9F:C2:71:22:15 -w corpnet-capture wlan0mon
04:43:37  Created capture file "corpnet-capture-01.cap".

CH 44 ][ Elapsed: 1 min ][ 2026-10-23 04:44 ] fixed channel wlan0mon: 13
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH
 F0:9F:C2:71:22:15  -25   0      648      246    5  44   54e  WPA2 CCMP   MGT
 BSSID              STATION            PWR    Rate    Lost   Frames  Notes  Pr
 F0:9F:C2:71:22:15  64:32:A8:BA:6C:41  -26   54e- 6e     0        6
 F0:9F:C2:71:22:15  64:32:A8:07:6C:40  -26   54e-54e     0      236
Quitting...

Task 6

What is the SSID of the hidden network you uncovered?

Staff-Net

Which channel does the hidden network operate on?

11

In airodump-ng, a hidden network's ESSID field shows a blank name and a length in the form <length: N>. What is N here?

9

Which wpa_supplicant option makes the client probe for a network by name rather than wait for its beacons?

scan_ssid

Join the network you uncovered and read the panel on its gateway. What flag does it return?

THM{0e6521916c3adf08e5b6830f6675351e4eebec92}

user@ip-10-144-129-9:~$ sudo iw dev wlan0mon set channel 11

user@ip-10-144-129-9:~$ sudo mdk4 wlan0mon p -t F0:9F:C2:6A:88:26 -f /home/user/wordlists/ssid-names.txt
Waiting for a beacon frame from target to get its SSID length.
SSID length is 9
Trying SSID: Employees
Packets sent:      1 - Speed:    1 packets/sec
Probe Response from target AP with SSID Staff-Net
Job's done, have a nice day :)

user@ip-10-144-129-9:~$ nano staff.conf
network={
    ssid="Staff-Net"
    scan_ssid=1
    key_mgmt=NONE
}

user@ip-10-144-129-9:~$ sudo wpa_supplicant -B -i wlan1 -c staff.conf
Successfully initialized wpa_supplicant

user@ip-10-144-129-9:~$ sudo iw dev wlan1 link
Connected to f0:9f:c2:6a:88:26 (on wlan1)
 SSID: Staff-Net
 freq: 2462
 RX: 256494 bytes (5751 packets)
 TX: 3410 bytes (103 packets)
 signal: -30 dBm
 tx bitrate: 54.0 MBit/s
 bss flags: short-slot-time
 dtim period: 2
 beacon int: 100

user@ip-10-144-129-9:~$ sudo dhclient -v wlan1
Internet Systems Consortium DHCP Client 4.4.3-P1
Copyright 2004-2022 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Listening on LPF/wlan1/02:00:00:00:01:00
Sending on   LPF/wlan1/02:00:00:00:01:00
Sending on   Socket/fallback
DHCPDISCOVER on wlan1 to 255.255.255.255 port 67 interval 8
DHCPOFFER of 192.168.16.23 from 192.168.16.1
DHCPREQUEST for 192.168.16.23 on wlan1 to 255.255.255.255 port 67
DHCPACK of 192.168.16.23 from 192.168.16.1
bound to 192.168.16.23 -- renewal in 42666 seconds.

user@ip-10-144-129-9:~$ curl -s -c cookies.txt -d "Username=admin&Password=admin&Submit=Submit" http://192.168.16.1/login.php -o /dev/null

user@ip-10-144-129-9:~$ curl -s -b cookies.txt http://192.168.16.1/index.php
<!DOCTYPE html>
<html>
<head>
    <title>WiFi Router Configuration</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
<script src="script.js"></script>
<div class="content">
Welcome admin<br><br>Flag: <button onclick="copyFlagToClipboard('THM{0e6521916c3adf08e5b6830f6675351e4eebec92}')">THM{0e6521916c3adf08e5b6830f6675351e4eebec92}</button><br><br>

Task 7

Which airodump-ng flag writes the captured data to files?

-w

None 
user@ip-10-144-129-9:~$ sudo airodump-ng --bssid F0:9F:C2:71:22:12 -c 6 -w home2g wlan0mon
05:01:04  Created capture file "home2g-01.cap".

CH  6 ][ Elapsed: 1 min ][ 2026-10-23 05:02
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH
 F0:9F:C2:71:22:12  -28   0      691      435    3   6   54   WPA2 CCMP   PSK
 BSSID              STATION            PWR    Rate    Lost   Frames  Notes  Pr
 F0:9F:C2:71:22:12  28:6C:07:6F:F9:44  -29   54 - 1      0        8
 F0:9F:C2:71:22:12  28:6C:07:6F:F9:43  -29   54 -54      0      426
Quitting...
user@ip-10-144-129-9:~$ sudo airodump-ng --output-format csv --bssid F0:9F:C2:71:22:12 -c 6 -w home2g wlan0mon
 CH  6 ][ Elapsed: 54 s ][ 2026-10-23 05:02
 BSSID              PWR RXQ  Beacons    #Data, #/s  CH   MB   ENC CIPHER  AUTH
 F0:9F:C2:71:22:12  -28   0      569      334    4   6   54   WPA2 CCMP   PSK
 BSSID              STATION            PWR    Rate    Lost   Frames  Notes  Pr
 F0:9F:C2:71:22:12  28:6C:07:6F:F9:44  -29   54 - 1      0        3
 F0:9F:C2:71:22:12  28:6C:07:6F:F9:43  -29   54 -54      0      332
Quitting...

Task 8

You're ready to move on. Click Complete to finish.

Answer: No answer needed