conducting-wireless-network-penetration-test

Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.

Jump to install

Repository: autohandai/community-skills
Last source activity: March 16, 2026 at 00:59
Detected SKILL.md language: English
Stars: 10
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	conducting-wireless-network-penetration-test
description	Conducts authorized wireless network penetration tests to assess the security of WiFi infrastructure by testing for weak encryption protocols, captive portal bypasses, evil twin attacks, WPA2/WPA3 handshake capture, rogue access point detection, and client-side attacks. The tester evaluates wireless authentication, network segmentation, and the effectiveness of wireless intrusion detection systems. Activates for requests involving wireless pentest, WiFi security assessment, WPA2/WPA3 testing, or rogue access point detection.
domain	cybersecurity
subdomain	penetration-testing
tags	["wireless-pentest","WiFi-security","WPA2","WPA3","evil-twin"]
version	1.0.0
author	mahipal
license	Apache-2.0

Conducting Wireless Network Penetration Test

When to Use

Assessing the security of enterprise wireless networks including guest, corporate, and IoT WiFi segments
Testing whether attackers within physical proximity can compromise wireless authentication and access internal networks
Validating wireless intrusion detection/prevention system (WIDS/WIPS) capabilities against known attack techniques
Evaluating the effectiveness of WPA3 migration and transition mode configurations
Testing network segmentation between wireless and wired networks after a wireless network compromise

Do not use against wireless networks without written authorization from the network owner, for jamming or denial-of-service attacks against wireless infrastructure unless explicitly authorized, or in environments where wireless disruption could affect life-safety systems.

Prerequisites

Written authorization specifying target SSIDs, BSSIDs, and physical testing locations
External WiFi adapter supporting monitor mode and packet injection (Alfa AWUS036ACH, TP-Link TL-WN722N v1)
Kali Linux or equivalent with up-to-date wireless tools (aircrack-ng suite, hostapd, bettercap)
Physical access to the testing location during authorized testing hours
Knowledge of the target's wireless architecture (SSIDs, authentication types, RADIUS infrastructure)

Workflow

Step 1: Wireless Reconnaissance

Discover and map all wireless networks in the target environment:

Enable monitor mode: airmon-ng start wlan0
Capture wireless traffic: airodump-ng wlan0mon -w recon --output-format csv,pcap to discover all SSIDs, BSSIDs, channels, encryption types, and connected clients
Identify target networks from the authorized scope and note their security configurations (WEP, WPA2-Personal, WPA2-Enterprise, WPA3-SAE, WPA3-Transition)
Enumerate connected clients and their signal strengths to understand client distribution
Check for hidden SSIDs by capturing probe requests from clients: airodump-ng wlan0mon --essid-regex ".*" -c <channel>
Identify rogue access points by comparing discovered BSSIDs against the client's authorized AP inventory

Step 2: WPA2-Personal Handshake Capture and Cracking

For WPA2-PSK networks, capture the 4-way handshake and attempt offline cracking:

Target the specific AP: airodump-ng wlan0mon -c <channel> --bssid <bssid> -w capture
Deauthenticate a connected client to force re-authentication: aireplay-ng -0 5 -a <bssid> -c <client_mac> wlan0mon

Term	Definition
Evil Twin	A rogue access point that mimics a legitimate SSID to trick clients into connecting, enabling man-in-the-middle attacks and credential capture
4-Way Handshake	The WPA2 authentication exchange between client and AP that establishes encryption keys; captured handshakes can be cracked offline
WPA3-SAE	Simultaneous Authentication of Equals; WPA3's key exchange protocol that resists offline dictionary attacks and provides forward secrecy
Transition Mode	WPA3 backward compatibility mode that supports both WPA2 and WPA3 clients, potentially vulnerable to downgrade attacks
PMKID Attack	A clientless attack that captures the Pairwise Master Key Identifier from the AP's first EAPOL frame, allowing offline cracking without capturing a full handshake
802.1X/EAP	Enterprise wireless authentication using RADIUS and Extensible Authentication Protocol, providing per-user credentials instead of a shared pre-shared key
Deauthentication Attack	Sending spoofed deauthentication frames to disconnect clients from an AP, forcing them to reconnect and enabling handshake capture or evil twin attacks

## Finding: Weak WPA2-PSK on IoT Network with Inadequate Segmentation

**ID**: WIFI-001
**Severity**: Critical (CVSS 9.4)
**Affected SSID**: IoT-Net (BSSID: AA:BB:CC:DD:EE:FF)
**Encryption**: WPA2-Personal (PSK)

**Description**:
The IoT wireless network uses a weak pre-shared key that was cracked in 3 minutes
using a standard dictionary attack. Once connected to IoT-Net, the tester discovered
that the wireless VLAN is not properly segmented from the internal corporate network,
providing unrestricted access to file servers, the Active Directory domain controller,
and the internal database server.

**Proof of Concept**:
1. Captured WPA2 handshake: airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w iot
2. Cracked PSK in 3 minutes: aircrack-ng -w rockyou.txt iot-01.cap -> Key: Company2024!
3. Connected to IoT-Net and scanned: nmap -sn 10.20.0.0/24
4. Accessible from IoT-Net: DC01 (10.20.0.5:445), FILESVR (10.20.0.10:445), DBSVR (10.20.0.15:3306)

**Impact**:
An attacker within wireless range (tested from the public lobby) can join the IoT
network and gain direct network access to the corporate infrastructure, bypassing
the WPA2-Enterprise authentication required for employee access.

**Remediation**:
1. Implement a complex 20+ character PSK for IoT-Net, rotated quarterly
2. Deploy VLAN segmentation to isolate IoT-Net from the corporate network
3. Implement firewall rules allowing IoT devices to reach only their required services
4. Migrate IoT devices to 802.1X authentication with device certificates where supported
5. Deploy WIDS to detect deauthentication attacks and rogue access points