3 min read

Intermediate

Wireless Penetration Testing

Wireless security assessment across WiFi, Bluetooth, and RF — WPA/WPA2/WPA3 cracking, evil twin attacks, BLE exploitation, WPS attacks, captive portal bypass, and advanced wireless attacks.

Why This Matters

Wireless is one of the highest-value attack surfaces on a physical engagement. A single unpatched AP, a rogue device on guest WiFi, or a WPS-enabled router can give an attacker a foothold inside a corporate network in minutes — without ever touching the front door.

Legal Warning

Wireless attacks can affect nearby networks. Only perform these attacks on networks you own or have explicit written authorization to test. Unauthorized wireless attacks are illegal.

Methodology Overview

Wireless attack methodology

Monitor mode and reconnaissance feed two attack families — Wi-Fi 802.11 (WPA2/3, WPS, Enterprise, WEP) and RF/alternative protocols (Bluetooth/BLE, sub-GHz) — whose techniques capture attack material for offline cracking, credential use and pivoting.

Scroll sideways to see the whole diagram

View full size

Guide Sections

Every page in the section, grouped by topic.

Setup & Hardware — 1 guide

Interface Setup Hardware selection, driver installation, monitor mode, and VM passthrough. Hardware setup

Discovery & Reconnaissance — 3 guides

Reconnaissance airodump-ng scanning, hidden SSID probing, and client enumeration. Reconnaissance SDR & RF Hacking RTL-SDR/HackRF signal analysis, replay attacks, and sub-GHz interception. SDR & RF Bluetooth & BLE BLE MITM, device tracking, BlueBorne, and Classic Bluetooth PIN attacks. Bluetooth & BLE

WPA/WPA2 & WPS — 3 guides

WPA Cracking 4-way handshake, PMKID (clientless) capture, and GPU cracking. WPA cracking WEP Cracking Legacy IV-capture and ARP-replay attacks, kept for legacy-system testing. Legacy WEP WPS Attacks Pixie Dust (offline), Reaver PIN brute force, and default vendor PINs. WPS

Rogue AP & Captive Portals — 3 guides

Evil Twin Rogue AP setup, KARMA/MANA, and captive-portal credential harvesting. Evil twin Deauth Attacks Forcing client disconnection, handshake harvesting, and availability testing. Deauth Captive Portals MAC clone, DNS tunnel, and HTTPS bypass for hotel and airport portals. Captive portals

Enterprise & Modern Standards — 2 guides

WPA-Enterprise 802.1X/RADIUS attacks, EAP credential capture, and MSCHAP cracking. Enterprise 802.1X WPA3, Wi-Fi 6 & 7 SAE/Dragonblood side-channels, OWE downgrade, 6 GHz scanning, and Wi-Fi 7 MLO. WPA3 & Wi-Fi 6/7

Advanced Attacks — 1 guide

Advanced Topics KRACK, FragAttacks, SSID Confusion, mesh/Wi-Fi Direct, and drone hijacking. Advanced attacks

Tools & Post-Exploitation — 2 guides

Tools & Hardware Adapters, SDR hardware, Bluetooth sniffers, and the wider wireless toolset. Tooling Post-Exploitation Pivoting, ARP spoofing, NTLM relay, and lateral movement from wireless to wired. Post-exploitation

Related Tools

Interactive companions for wireless capture, cracking, and post-compromise pivoting.

Interactive Tool

Wi-Fi Command Builder

Generate copy-ready aircrack-ng, hcxdumptool, hashcat, reaver, and eaphammer commands for the capture-to-crack workflow.
Interactive Tool

MAC Address Analyzer

Identify adapter and client vendors by OUI while triaging airodump output and spoofing addresses.
Interactive Tool

Hash Generator

Generate and identify hashes when validating captured PMKID/EAPOL material before feeding hashcat.
Interactive Tool

Subnet Calculator

Work out ranges and segmentation once you pivot from a compromised wireless foothold into the wired network.

Legal Disclaimer

Wireless attacks can affect nearby networks and devices. Only perform these attacks on networks you own or have explicit written authorization to test.

Related Topics

Physical Security

Often combined with wireless attacks for full physical/digital assessments.

Internal Network Pentesting

Post wireless compromise, pivot to internal network testing.

IoT Pentesting

Many IoT devices use WiFi, Bluetooth, Zigbee, and other wireless protocols.

Lab Setup

Build isolated wireless labs for safe practice.