Wireless Pentest

---
name: wireless-pentest
description: "Use when assessing Wi-Fi and wireless network security — WPA2/WPA3 personal and enterprise (802.1X/EAP), rogue/evil-twin access points, PMKID/handshake weaknesses, guest/segmentation issues, and management-network exposure over wireless. Covers authorized wireless assessment methodology, detection, and remediation. Authorized, on-site/scoped engagements only."
---

# Wireless Network Penetration Testing

Assessment of Wi-Fi and wireless network security for an authorized engagement (typically on-site or within a defined physical/RF scope).

## 0. Authorization gate
- [ ] Written scope: SSIDs, physical location/RF boundary, allowed active tests.
- [ ] Rules on deauth/interference (can disrupt legitimate users — often restricted).
- [ ] Client-device targeting rules; guest vs corporate scope.

## 1. Discovery
- Passive survey: enumerate SSIDs/BSSIDs, channels, encryption types, signal footprint, hidden networks.
- Identify WPA2 vs WPA3, Personal (PSK) vs Enterprise (802.1X/EAP), and open/guest networks.
- Map RF footprint vs building boundary (signal leaking to public areas is a finding).

## 2. WPA2/WPA3-Personal (PSK)
- **PMKID / 4-way-handshake capture** then offline analysis against a wordlist to assess passphrase strength (offline, your own capture, in scope).
- **Finding pattern:** weak/guessable PSK, shared PSK across sensitive networks.
- **Fix:** strong unique passphrases, WPA3-SAE, move sensitive access to Enterprise auth.

## 3. WPA2/WPA3-Enterprise (802.1X / EAP)
- Check EAP method and **server-certificate validation** on clients (misconfigured clients accept rogue RADIUS → credential theft via evil twin).
- **Fix:** enforce server-cert validation via device profiles, use strong EAP (EAP-TLS), lock down which CAs/servers clients trust.

## 4. Rogue & evil-twin APs
- Detect rogue APs on the corporate network; assess feasibility of evil-twin against misconfigured clients (in scope, controlled).
- **Fix:** wireless IDS/IPS, client hardening (cert validation), 802.1X on wired ports to stop rogue AP plug-in.

## 5. Segmentation & post-association
- Once associated (guest or corp), test segmentation: can guest reach corporate/management networks? Client isolation on guest?
- **Fix:** VLAN segmentation, client isolation on guest, firewall between wireless and sensitive zones.

## 6. Tooling
Wireless survey tools, aircrack-ng suite, hcxdumptool/hcxtools (PMKID), hostapd-based test APs (controlled), eaphammer/wifiphisher-style tooling for enterprise cert-validation testing (controlled, in scope), hashcat for offline passphrase analysis.

## 7. Reporting
Per finding: SSID/network, weakness, severity, business impact (unauthorized access / credential theft / lateral movement), remediation. Checklist: `references/wireless-checklist.md`.

---
<sub>© 2026 noahfranklin · Part of the [Gideon](https://github.com/noahfranklin/gideon) security suite · MIT License · Original work.</sub>