Wi-Fi / Wireless Security

ACTION REQUIRED (Execute Immediately After Reading)

1. NOW

   : Read precedent-pentest; Wireless attacks carry high legal risks, written authorization and physical scope are mandatory

2. NOW

   : Specify target SSID/BSSID/location in the scope; Scanning neighboring networks is prohibited

3. NEXT

   : Verify adapter monitor mode capability

4. ACT

   : Reconnaissance → Capture → Analysis (Lab environment preferred)

Applicable Scenarios

• Authorized Wi-Fi security assessment
• WPA/WPA2 handshake capture and offline assessment
• Rogue AP / phishing hotspot detection research
• Enterprise wireless isolation and portal security

Workflow

□ iwconfig / airmon-ng enter monitor mode (authorized environment)
□ airodump-ng lock onto target BSSID channel
□ Handshake or PMKID capture (target only)
□ hashcat/aircrack offline password policy assessment
□ Report: Encryption type, isolation, portal bypass, recommendations

Toolchain

References

• references/wireless-lab-rules.md

• ../pentest-tools/

  ../attack-chain/

  (close-range section)

Routing Context

Task Completion Checklist

• Is the target BSSID strictly locked?
• Are hardening recommendations included in the report?
• Checklist completed?