Portfolio index

Collaborative project record / 04

March–May 2026

Dragonblood

A four-person wireless-security project that reproduced and detected a WPA3 transition-mode downgrade in an authorized test environment.

State
Demonstrated
Collaboration
Four-person team project
Spotlight

Team outcomes remain separate from individual contribution.

Verified contribution

The collaborative context.

Individual contribution

Het's contribution focused on detection and defense, testbed integration, and report and presentation work.

Verified evidence

Controlled validation run
17 disconnect / 20 reconnect eventsRecorded in an authorized four-node environment as defensive detection evidence—not production telemetry.

Technologies and themes

  • WPA3/SAE
  • Detection engineering
  • Python
  • Bash
  • Wireshark/tshark

Defensive case study

The useful signal emerged through correlation: reconnect behavior, identity changes, negotiated security, and handshake evidence had to be read together.

Conceptual correlation modelIllustrative · not captured telemetry

  1. 01 / Authorized reproduction

    Establish the transition-mode behavior

    In an authorized four-node test environment, the team reproduced the WPA3 transition-mode downgrade associated with CVE-2019-9499 and established a controlled basis for defensive analysis.

  2. 02 / Individual contribution

    Separate the downgrade from expected transition behavior

    Het built live and post-run detection correlating deauthentication and reconnect bursts, same-SSID BSSID changes, SAE-to-WPA2 fallback, and PMKID and four-way-handshake evidence. Validation recorded 17 disconnect and 20 reconnect events.

  3. 03 / Defensive response

    Translate observed behavior into monitoring guidance

    The project documented WPA3-only operation, mandatory PMF, and segmented legacy-WPA2 support as defensive controls, supported by Het's contribution to the report and presentation.