WiFiChallengeLab-docker

Docker version of WiFiChallenge Lab with reworked challenges and improved stability. A Debian virtual machine with virtualized networks and clients to practice WiFi attacks against OPN, WPA2, WPA3 and Enterprise networks.

• Features
• CTFd Lab
• Changelog
• Deployment
• Usage
• Customization
• Open Source References
• Support this project
• Collaborators
• License

• Runs entirely on Docker, removing the nested VMs of v1.0: the lab and its networks are virtualized with mac80211_hwsim, making it lighter and more stable.
• Targets the full range of modern WiFi security: OPN, WPA2, WPA3 and Enterprise (MGT) networks.
• Realistic attack scenarios, including WPA3 bruteforce and downgrade, multiple Enterprise (MGT) APs, real captive-portal evasion (not just MAC filtering), and client phishing with a fake website.
• Gives the attacker 6 virtual WiFi adapters (wlan0 to wlan5), backed by 71 mac80211_hwsim radios that drive the many simultaneous APs and clients.
• Built-in monitoring and intrusion detection with the nzyme WIDS.
• Deploy it your way: download a prebuilt VM, build your own with Vagrant (VirtualBox, VMware or Hyper-V), or run the containers directly on a Linux host or Kali.
• Works on both x86-64 and ARM hosts, including Apple Silicon (M1, M2, etc.).
• Guided challenges through the CTFd platform at lab.wifichallenge.com.
• Prebuilt APs, clients and nzyme images published on Docker Hub to avoid building from scratch.

For direct access to download the VM and complete the challenges, go to the CTFd web site:

WiFiChallenge Lab CTFd

Highlights of the move from v1.x to v2.x:

• Remove nested VMs, replaced with Docker.
• Add new attacks and rework existing ones to be more realistic:
  • WPA3 bruteforce and downgrade
  • Multiple Enterprise (MGT) APs
  • Real captive portal evasion (instead of just MAC filtering)
  • Phishing client with a fake website
• Rework the WPS PIN attack: removed in v2.0 as outdated and oversimplified, then reintroduced in v2.2 with a custom mac80211_hwsim for a more realistic scenario.
• Use Ubuntu as the OS instead of Debian (back to Debian in version 2.3).
• Use Vagrant to build the VM so it is easy to replicate.
• More virtual WiFi adapters:
  • More APs
  • More clients
• Monitoring and detection using the nzyme WIDS.

Changes after v2.0 can be found at Changelog.md

Pick the method that fits your host:

• Option 1 - Prebuilt VM: the fastest way to start on x86-64.
• Option 2 - Build a VM with Vagrant: reproducible VirtualBox, VMware, Hyper-V or QEMU builds.
• Option 3 - Install on a Debian 12 VM: recommended for Apple Silicon (M1, M2) and other custom VMs.
• Option 4 - Run the containers directly: for Kali or any Linux host already inside a VM.

Download the version for your platform:

• From GitHub releases
• From Proton Drive

Boot it, log in with user/user, and continue at lab.wifichallenge.com.

Set VERSION to the release you downloaded, then unpack the OVA:

VERSION="v2.5"   # match the file you downloaded
unzip "WiFiChallenge Lab ${VERSION}.VirtualBox.zip" -d wifichallenge-lab
cd wifichallenge-lab
tar -xvf "WiFiChallenge Lab ${VERSION}.ova"

Convert the VirtualBox disk to qcow2. The OVA contains a single compressed, monolithic VMDK; use the disk image explicitly instead of a *.vmdk wildcard:

VMDK="WiFiChallenge Lab ${VERSION}-disk001.vmdk"
QCOW2="$PWD/wifichallenge-lab.qcow2"

qemu-img info -f vmdk "$VMDK"
qemu-img check -f vmdk "$VMDK"
qemu-img convert -p -m 1 -f vmdk -O qcow2 "$VMDK" "$QCOW2"

Only after qemu-img convert completes successfully, validate the new image:

qemu-img check -f qcow2 "$QCOW2"

You can keep the QCOW2 in the current directory. The qemu:///system connection must be able to read it; if QEMU reports a permission error, either move it to /var/lib/libvirt/images/ or grant the QEMU user access to the containing directories and file.

If you prefer the standard libvirt images folder:

sudo mv "$QCOW2" /var/lib/libvirt/images/
QCOW2="/var/lib/libvirt/images/wifichallenge-lab.qcow2"

If the host supports TUN/TAP, make sure the default libvirt network is running:

sudo modprobe tun 2>/dev/null || true
sudo virsh --connect qemu:///system net-list --all
sudo virsh --connect qemu:///system net-start default 2>/dev/null || true
sudo virsh --connect qemu:///system net-autostart default

Import and start the VM:

virt-install \
  --connect qemu:///system \
  --name wifichallenge-lab \
  --memory 4096 \
  --vcpus 2 \
  --disk path="$QCOW2",format=qcow2,bus=sata \
  --import \
  --os-variant debian12 \
  --network network=default,model=e1000 \
  --graphics spice \
  --noautoconsole

If the host has no usable TUN/TAP support and virt-install reports Unable to open /dev/net/tun, omit the network interface:

virt-install \
  --connect qemu:///system \
  --name wifichallenge-lab \
  --memory 4096 \
  --vcpus 2 \
  --disk path="$QCOW2",format=qcow2,bus=sata \
  --import \
  --os-variant debian12 \
  --network none \
  --graphics spice \
  --noautoconsole

Requirements:

• A host with at least 4 CPU cores and 4 GB of RAM.
• Vagrant.
• VirtualBox, VMware or Hyper-V.

Clone the repository and open the vagrant folder:

git clone https://github.com/r4ulcl/WiFiChallengeLab-docker
cd WiFiChallengeLab-docker/vagrant

Edit the Vagrantfile to set the memory and CPU to your needs:

nano vagrantfile

Then bring up the VM for your provider:

vagrant up vmware_vm                      # VMware
vagrant up virtualbox_vm                  # VirtualBox
vagrant up hyper-v_vm --provider=hyperv   # Hyper-V (run in an admin console)
vagrant up qemu_vm --provider=qemu        # QEMU/KVM (Linux; requires vagrant-qemu)

On Apple Silicon (M1, M2) and other hosts without Vagrant support, create a Debian 12 VM yourself (for example with UTM) and run the installer as root:

cd /var/
git clone https://github.com/r4ulcl/WiFiChallengeLab-docker
bash /var/WiFiChallengeLab-docker/vagrant/install.sh

Reboot, log in with user/user, and continue at lab.wifichallenge.com.

If you are already inside a Linux VM such as Kali, start the APs, clients and nzyme with Docker Compose:

git clone https://github.com/r4ulcl/WiFiChallengeLab-docker
cd WiFiChallengeLab-docker
docker compose --file docker-compose.yml up -d

• The tools are installed and can be found in the tools folder of the root home.
• There are 6 antennas available for the attacker, wlan0 to wlan5.
• Do Not Disturb mode can be disabled when you want the APs and clients to start transmitting.

• Start the docker-compose.yml file and use the virtual WLAN.
• Use your own tools and configurations to attack.

To modify the configuration, download the repository and edit the APs and clients files (in the VM the path is /var/WiFiChallengeLab-docker). The files are divided into APs, Clients, and Nzyme.

To rebuild the images with your changes, edit docker-compose.yml, commenting out the image: line for each service and uncommenting its build: line. Then run docker compose build to create a new version.

See OPEN_SOURCE_REFERENCES.md for the upstream projects, repositories, and licenses used in the lab. Update it when adding tools or changing install scripts.

• Raúl Sampedro (@rsrdesarrollo) - Update the Nzyme Docker configuration to support ARM architecture

• Oscar Alfonso (OscarAkaElvis / v1s1t0r, airgeddon author) - Collaboration in testing and script improvement

GNU General Public License v3.0