Introduction to Wireless Security
Wireless networks present unique security challenges. Unlike wired networks, the attack surface extends beyond physical boundaries, allowing attackers to target your network from parking lots, neighboring buildings, or public spaces.
Why Wireless Security Matters
Expanded Attack Surface: Radio waves don't stop at walls
Rogue Access Points: Unauthorized APs creating backdoors
Client Attacks: Targeting end-user devices
Data Interception: Capturing sensitive communications
Wireless Security Protocols Evolution
WEP (Wired Equivalent Privacy)
Status: Completely broken, do not use
Weakness: IV collision allows key recovery in minutes
Attack: aircrack-ng can crack with sufficient packets
WPA (Wi-Fi Protected Access)
Improvement: TKIP with per-packet keys
Weakness: Still vulnerable to dictionary attacks
Attack: Capture handshake, offline brute force
WPA2 (802.11i)
Current Standard: AES-CCMP encryption
Personal (PSK): Pre-shared key, vulnerable to offline attacks
Enterprise (802.1X): RADIUS authentication, more secure
WPA3
Latest Standard: SAE (Simultaneous Authentication of Equals)
Improvement: Protection against offline dictionary attacks
Enhanced Open: OWE for public networks
Wireless Penetration Testing Methodology
Phase 1: Reconnaissance
Passive Discovery:
Monitor wireless channels without transmitting
Identify SSIDs, BSSIDs, encryption types
Map client devices and associations
Detect hidden networks through probe requests
Tools:
Airodump-ng for packet capture
Kismet for wireless monitoring
WiFi Pineapple for automated discovery
Phase 2: Attack Execution
WPA/WPA2 PSK Attacks:
1Handshake Capture:
Monitor target network
Deauthenticate client to force reconnection
Capture 4-way handshake
2Offline Cracking:
Dictionary attacks with rockyou, custom wordlists
Rule-based attacks for password variations
GPU acceleration with hashcat
Enterprise (802.1X) Attacks:
1Evil Twin Attack:
Create fake AP with same SSID
Capture RADIUS credentials
Relay or crack authentication
2RADIUS Impersonation:
Hostapd-wpe for credential harvesting
Capture MS-CHAPv2 hashes
Crack or relay credentials
Phase 3: Client-Side Attacks
Karma/MANA Attacks:
Respond to all probe requests
Lure clients to malicious AP
Intercept traffic, inject payloads
Captive Portal Attacks:
Fake login pages for credential theft
Clone legitimate portals
Social engineering component
Phase 4: Post-Exploitation
Network pivoting from wireless segment
Man-in-the-middle attacks
DNS spoofing and traffic manipulation
Lateral movement to wired network
Common Vulnerabilities
Weak Pre-Shared Keys
Default or simple passwords
Dictionary words with basic substitutions
Short keys (<12 characters)
Misconfigured Enterprise Authentication
No certificate validation
Weak EAP methods (LEAP, EAP-MD5)
Missing server certificate pinning
Rogue Access Points
Employee personal hotspots
Malicious devices planted by attackers
Misconfigured repeaters or extenders
Client Misconfigurations
Auto-connect to open networks
Probe request leakage
Stored network profiles
Enterprise Wireless Security
Secure Architecture
Network Segmentation:
Separate SSID for guest access
VLAN isolation per wireless network
Firewall rules between segments
802.1X Implementation:
RADIUS server (FreeRADIUS, NPS, ISE)
EAP-TLS with client certificates
Server certificate validation
Wireless IDS/IPS:
Detect rogue APs and evil twins
Monitor for deauth attacks
Alert on suspicious client behavior
Security Controls Checklist
Access Point Configuration:
Disable WPS (WiFi Protected Setup)
Use strong, unique PSK per network
Enable management frame protection (802.11w)
Regular firmware updates
Enterprise Controls:
Certificate-based authentication
Network Access Control (NAC)
WIDS/WIPS deployment
Regular wireless assessments
Client Security:
Disable auto-connect features
Clear saved network profiles
VPN for sensitive communications
Certificate pinning in supplicants
Tools for Wireless Testing
Hardware
Alfa AWUS036ACH: Dual-band, injection capable
WiFi Pineapple: Automated assessment platform
HackRF/RTL-SDR: RF analysis beyond WiFi
Software
Aircrack-ng Suite: Complete wireless toolkit
Kismet: Wireless network detector
Bettercap: Network attack framework
Hashcat: GPU-accelerated cracking
Wireshark: Packet analysis
Reporting and Remediation
Assessment Deliverables
Network topology and coverage map
Identified SSIDs and security configurations
Vulnerable networks and attack paths
Captured credentials (with permission)
Rogue AP inventory
Remediation Priorities
1Replace WEP/WPA with WPA2/WPA3
2Implement strong PSK or 802.1X
3Deploy WIDS/WIPS
4Segment wireless from sensitive networks
5Regular security assessments
Conclusion
Wireless security requires ongoing attention as the threat landscape evolves. Regular penetration testing, combined with proper security controls and monitoring, is essential for protecting enterprise wireless networks from increasingly sophisticated attacks.