/conducting-wireless-network-penetration-test

name: conducting-wireless-network-penetration-test
description: 'Conducts authorized wireless network penetration tests to assess the
  security of WiFi infrastructure by testing for weak encryption protocols, captive
  portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point
  detection, and client-side attacks. The tester evaluates wireless authentication,
  network segmentation, and the effectiveness of wireless intrusion detection systems.
  Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3
  testing, or rogue access point detection.

  '
domain: cybersecurity
subdomain: penetration-testing
tags:
- wireless-pentest
- WiFi-security
- WPA2
- WPA3
- evil-twin
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-06
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1557.004
- T1040
- T1110.002
- T1557
- T1669

Conducting Wireless Network Penetration Test

When to Use

• Assessing the security of enterprise wireless networks including guest, corporate, and IoT WiFi segments
• Testing whether attackers within physical proximity can compromise wireless authentication and access internal networks
• Validating wireless intrusion detection/prevention system (WIDS/WIPS) capabilities against known attack techniques
• Evaluating the effectiveness of WPA3 migration and transition mode configurations
• Testing network segmentation between wireless and wired networks after a wireless network compromise

**Do not use** against wireless networks without written authorization from the network owner, for jamming or denial-of-service attacks against wireless infrastructure unless explicitly authorized, or in environments where wireless disruption could affect life-safety systems.

Prerequisites

• Written authorization specifying target SSIDs, BSSIDs, and physical testing locations
• External WiFi adapter supporting monitor mode and packet injection (Alfa AWUS036ACH, TP-Link TL-WN722N v1)
• Kali Linux or equivalent with up-to-date wireless tools (aircrack-ng suite, hostapd, bettercap)
• Physical access to the testing location during authorized testing hours
• Knowledge of the target's wireless architecture (SSIDs, authentication types, RADIUS infrastructure)

Workflow

Step 1: Wireless Reconnaissance

Discover and map all wireless networks in the target environment:

• Enable monitor mode: `airmon-ng start wlan0`
• Capture wireless traffic: `airodump-ng wlan0mon -w recon --output-format csv,pcap` to discover all SSIDs, BSSIDs, channels, encryption types, and connected clients
• Identify target networks from the authorized scope and note their security configurations (WEP, WPA2-Personal, WPA2-Enterprise, WPA3-SAE, WPA3-Transition)
• Enumerate connected clients and their signal strengths to understand client distribution
• Check for hidden SSIDs by capturing probe requests from clients: `airodump-ng wlan0mon --essid-regex ".*" -c <channel>`
• Identify rogue access points by comparing discovered BSSIDs against the client's authorized AP inventory

Step 2: WPA2-Personal Handshake Capture and Cracking

For WPA2-PSK networks, capture the 4-way handshake and attempt offline cracking:

• Target the specific AP: `airodump-ng wlan0mon -c <channel> --bssid <bssid> -w capture`
• Deauthenticate a connected client to force re-authentication: `aireplay-ng -0 5 -a <bssid> -c <client_mac> wlan0mon`
• Verify handshake capture in airodump-ng (WPA handshake indicator appears)
• Crack the captured handshake:
• Dictionary attack: `aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap`
• GPU-accelerated: `hashcat -m 22000 capture.hc22000 /usr/share/wordlists/rockyou.txt`
• Rule-based: `hashcat -m 22000 capture.hc22000 wordlist.txt -r /usr/share/hashcat/rules/best64.rule`
• For PMKID capture (clientless): `hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng --filtermode=2 --filterlist_ap=<bssid>`

Step 3: WPA2-Enterprise Attack

For 802.1X/EAP networks, attempt credential capture through rogue RADIUS:

• Identify the EAP type in use (PEAP-MSCHAPv2, EAP-TLS, EAP-TTLS) by capturing association requests
• Set up a rogue AP mimicking the enterprise SSID using `hostapd-mana` with a rogue RADIUS server
• Configure hostapd-mana to accept all EAP authentication attempts and capture RADIUS handshakes
• When clients connect to the rogue AP, capture MSCHAPv2 challenge-response pairs
• Crack captured credentials with `asleap` or convert to hashcat format: `hashcat -m 5500 captured_ntlm.txt wordlist.txt`
• If EAP-TLS is in use (certificate-based), document that credential capture is not feasible and the organization has implemented strong wireless authentication

Step 4: Evil Twin Attack

Deploy a rogue access point to intercept client connections:

• Create an evil twin AP matching the target SSID: configure `hostapd` with the same SSID and channel
• Set up a captive portal using `dnsmasq` for DHCP and DNS, and a web server presenting a fake login page
• Deauthenticate clients from the legitimate AP to force reconnection to the evil twin
• Capture credentials submitted through the captive portal
• For WPA3-Transition mode networks: exploit the downgrade vulnerability by creating a WPA2-only evil twin that transition-mode clients will connect to
• Document all captured credentials and the attack path from wireless access to internal network

Step 5: Post-Compromise Network Assessment

After gaining wireless network access, assess network segmentation:

• Connect to the compromised wireless network using captured credentials
• Scan the network segment for accessible hosts and services: `nmap -sn <wireless_subnet>`
• Test if wireless clients can reach internal servers, databases, or management interfaces
• Verify that VLAN segmentation properly isolates guest, corporate, and IoT wireless networks
• Test if wireless-to-wired segmentation is enforced by attempting to access servers on the wired network
• Docu