WRAITH OS Mission Exec / Handshake Hunter ENGAGED 00:01:16
MISSION / WIFI / OPSEC HIGH Handshake Hunter Passive capture of WPA/WPA2 4-way handshakes against a scoped AP. No deauth, no injection; client-driven reassociation only.
TARGET DEMO-GUEST (02:00:5e:00:53:01)
SCOPE DEMO-SCOPE-001 (demo-lab)
ASSET demo-radio-0
PROFILE Stealth / Passive / 300s
VALIDATION IMPLEMENTED
POSTURE STEALTH / CHAMELEON
STATUS ENGAGED
ELAPSED 00:01:16
PREFLIGHT 5/5 READY
OK Policy guard DEMO-SCOPE-001 (demo-lab) approved
OK Hardware demo-radio-0 / monitor
OK Scope DEMO-GUEST (02:00:5e:00:53:01)
OK Posture stealth / passive
OK Vault sealed / demo-key
EMERGENCY CONTROLS
CAPTURE FEED OK
FRAME 000 Fixture telemetry loaded Handshake capture stream is staged for replay.
LIVE TELEMETRY / wlan1mon 17 lines
08:49:58 info wraith.daemon: attach interface wlan1mon
08:49:58 ok wraith.daemon: monitor mode confirmed
08:49:59 cmd > handshake_hunter --scope DEMO-SCOPE-001 --target 02:00:5e:00:53:01 --window 300s --stealth
08:50:00 sig policy_guard: scope check OK - target in DEMO-SCOPE-001
08:50:00 sig policy_guard: posture=STEALTH - deauth/injection DISABLED
08:50:01 info chameleon: MAC rotated to 02:00:5e:00:53:10
08:50:02 info channel lock: 11 @ 2.462GHz
08:50:02 info listening for EAPOL frames ... window=300s
08:50:19 info client 02:00:5e:00:53:7e associated with 02:00:5e:00:53:01
08:50:20 info EAPOL M1 observed (AP -> STA)
08:50:20 info EAPOL M2 observed (STA -> AP)
08:50:21 ok EAPOL M4 observed - 4-way handshake complete
08:50:21 sig HANDSHAKE CAPTURED / frames=4 / quality=CLEAN
08:50:22 info evidence: hs_demo_0001_20260422T085022Z.pcapng - 14.3 KB
08:50:23 ok loot.ingest: 1 handshake -> loot/wifi/handshakes/DEMO-GUEST
08:51:04 warn beacon anomaly: RSSI delta -18dBm (possible client roam)
08:51:12 sig finding: WPA2 handshake captured - escalated to workbench queue
EVENT TIMELINE 7 events
08:50:00 SCOPE Policy guard approved DEMO-SCOPE-001
08:50:01 CHAMELEON MAC rotation confirmed
08:50:02 RADIO Monitor mode on wlan1mon / ch11
08:50:20 EAPOL 4-way handshake progression 1-4
08:50:21 CAPTURE Handshake sealed to vault
08:51:04 RADIO RSSI delta - possible client roam
08:51:12 FINDING Escalated to workbench queue