Wireless Network Testing

Introduction

Every part of this series so far has focused on wired infrastructure, applications, and the human layer — networks, Active Directory, web apps, and social engineering. But there's a perimeter that often gets skipped entirely during security reviews: the air around the building.

Wireless networks broadcast constantly, often extend well beyond the physical walls of an office, and are frequently configured once during setup and never revisited. That combination makes wireless testing one of the more consistently rewarding areas of a VAPT engagement.

What It Is

Wireless network testing is the assessment of an organization's Wi-Fi infrastructure — access points, client devices, and the protocols connecting them — for weaknesses in:

• Encryption (WEP, WPA, WPA2, WPA3 implementation flaws)
• Authentication (weak pre-shared keys, misconfigured enterprise auth)
• Configuration (default credentials, open management interfaces, rogue devices)

Unlike a lot of network pentesting, wireless testing happens over RF rather than cabling, which means an attacker doesn't need to be plugged into anything — they just need to be within signal range.

Why It Matters

Wireless networks matter disproportionately for one simple reason: the attacker doesn't need a foothold on the wired network to start the engagement. A parking lot, a nearby café, or an adjacent office suite is often enough.

Common reasons wireless deployments stay vulnerable longer than wired ones:

• Access points get installed once and rarely revisited during patch cycles
• Guest networks are sometimes bridged to internal VLANs by mistake
• WPA2-PSK passwords are shared across teams and rarely rotated
• Legacy devices (printers, IoT, older laptops) may not support WPA3 and force networks to stay backward-compatible with weaker protocols

A compromised Wi-Fi network is effectively a compromised piece of the internal network — which is why wireless findings frequently feed directly into the lateral movement and Active Directory attack paths covered earlier in this series.

Subtopic 1: WPA2 Cracking

WPA2-PSK remains extremely common despite WPA3's availability, largely due to device compatibility. Its weakness lies in the 4-way handshake, which can be captured and attacked offline.

General workflow:

# Put the wireless adapter into monitor mode
airmon-ng start wlan0
# Capture handshake traffic on a target channel
airodump-ng --bssid <TARGET_BSSID> -c <CHANNEL> -w capture wlan0mon
# Force a client to reauthenticate and capture the handshake
aireplay-ng --deauth 5 -a <TARGET_BSSID> wlan0mon
# Crack the captured handshake offline against a wordlist
aircrack-ng -w rockyou.txt -b <TARGET_BSSID> capture-01.cap

# Put the wireless adapter into monitor mode
airmon-ng start wlan0
# Capture handshake traffic on a target channel
airodump-ng --bssid <TARGET_BSSID> -c <CHANNEL> -w capture wlan0mon
# Force a client to reauthenticate and capture the handshake
aireplay-ng --deauth 5 -a <TARGET_BSSID> wlan0mon
# Crack the captured handshake offline against a wordlist
aircrack-ng -w rockyou.txt -b <TARGET_BSSID> capture-01.cap

The entire attack hinges on password strength — a strong, high-entropy PSK makes offline cracking computationally infeasible, while a dictionary-word password can fall in minutes.

Subtopic 2: Evil Twin Attacks

An evil twin attack involves standing up a rogue access point that impersonates a legitimate network's SSID, tricking client devices into connecting to it instead.

Once a client connects to the evil twin:

• The attacker can perform a captive-portal credential harvest (fake login page mimicking corporate SSO)
• Traffic can be intercepted and manipulated (classic man-in-the-middle)
• Follow-on attacks (session hijacking, downgrade attacks) become possible

Tools like Airgeddon and WiFiPhisher automate much of this workflow — spinning up a cloned AP, deauthenticating clients from the legitimate network, and serving a phishing portal simultaneously.

Subtopic 3: Rogue Access Points

Unlike an evil twin (which impersonates an existing network), a rogue AP is an unauthorized device — often planted physically inside or near a facility — that provides an unmonitored bridge into the internal network.

Rogue APs can appear from:

• An employee plugging in a personal travel router for convenience
• A vendor leaving a misconfigured device behind after installation
• An attacker physically planting a small AP (e.g., disguised as a power adapter) during a red team engagement

Detecting rogue APs typically relies on wireless intrusion detection systems (WIDS), periodic RF sweeps, and correlating MAC address vendor prefixes against an approved asset inventory.

Subtopic 4: Aircrack-ng Suite

Aircrack-ng is the foundational toolkit for most 802.11 wireless assessments, bundling several purpose-built utilities:

This suite is typically the first thing installed for any wireless assessment lab, and pairs well with a monitor-mode-capable adapter (chipsets like Atheros or certain Realtek models are common choices).

Subtopic 5: inSSIDer

inSSIDer takes a different angle from Aircrack-ng — rather than attacking, it's built for passive Wi-Fi analysis and site survey work:

• Visualizing SSIDs, channels, and signal strength across a location
• Identifying channel overlap and co-channel interference
• Spotting unexpected or unauthorized SSIDs broadcasting in a scanned area
• Supporting channel optimization decisions for legitimate network design

In a VAPT context, inSSIDer is most useful during the reconnaissance phase of a wireless assessment — mapping out what's actually broadcasting in and around a facility before deciding where to focus active attacks.

Subtopic 6: Deauthentication Attacks

A deauthentication (deauth) attack exploits the fact that 802.11 management frames are unencrypted and unauthenticated in most legacy configurations — meaning anyone in range can forge a deauth frame and force a client off a network.

# Send deauth frames to a specific client from a target AP
aireplay-ng --deauth 10 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

# Send deauth frames to a specific client from a target AP
aireplay-ng --deauth 10 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

Deauth attacks serve as a building block for several other techniques covered above:

• Forcing WPA2 handshake recapture (Subtopic 1)
• Pushing clients toward an evil twin AP (Subtopic 2)
• Basic denial-of-service against wireless availability

802.11w (Management Frame Protection) directly mitigates this by cryptographically signing management frames — one of the clearer, low-effort wins organizations can implement if their hardware supports it.

Defensive Mapping (Blue Team Perspective)

Tying this back to detection and hardening work:

• WIDS/WIPS deployment to flag rogue APs and evil twins broadcasting known SSIDs from unauthorized hardware
• 802.11w enforcement to blunt deauthentication-based attacks
• Certificate-based enterprise authentication (WPA2/WPA3-Enterprise with EAP-TLS) instead of shared PSKs, removing the offline-crackable handshake entirely
• Network segmentation so a compromised wireless segment (guest or otherwise) cannot reach sensitive internal VLANs
• Regular RF sweeps as part of routine physical security walkthroughs, not just annual assessments

This maps to MITRE ATT&CK's Initial Access tactic, particularly T1200 (Hardware Additions) for physically planted rogue APs, and ties into broader network-based Adversary-in-the-Middle (T1557) techniques once a client is captured on a malicious AP.

This article is part of an ongoing series exploring practical, hands-on VAPT concepts — from reconnaissance to post-exploitation — built entirely within a controlled, isolated lab environment for educational purposes. If you found this useful, follow along for the rest of the series, and feel free to share your own experiences with these tools and techniques.