Performing Wireless Network Penetration Test

# Performing Wireless Network Penetration Test

## Overview

Wireless penetration testing evaluates the security of an organization's WiFi infrastructure including encryption strength, authentication mechanisms, rogue access point detection, client isolation, and network segmentation. Testing covers 802.11a/b/g/n/ac/ax protocols, WPA2-PSK, WPA2-Enterprise, WPA3-SAE, captive portals, and Bluetooth/BLE where in scope.


## When to Use

- When conducting security assessments that involve performing wireless network penetration test
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing

## Prerequisites

- Written authorization specifying wireless scope (SSIDs, BSSIDs, physical locations)
- Compatible wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)
- Kali Linux with Aircrack-ng suite, Bettercap, Wifite, Kismet
- Physical proximity to target wireless networks
- GPS receiver for mapping (optional)

## Phase 1 — Wireless Reconnaissance

### Enable Monitor Mode

```bash
# Check wireless interfaces
iwconfig
airmon-ng

# Kill interfering processes
airmon-ng check kill

# Enable monitor mode
airmon-ng start wlan0
# Interface becomes wlan0mon

# Verify monitor mode
iwconfig wlan0mon
```

### Passive Scanning

```bash
# Discover all networks in range
airodump-ng wlan0mon -w wireless_scan --output-format csv,pcap

# Filter by specific channel
airodump-ng wlan0mon -c 6 -w channel6_scan