CoreQ Academy4.7 Given a scenario, perform wireless attacks using the appropriate tools.
Wireless tests check whether the network leaks, can be impersonated or can be broken into, all within the authorised physical area.
Attacks
- Wardriving
- Moving around to map wireless networks and their security.
- Evil twin attack
- A rogue access point imitating a legitimate SSID to capture connections or credentials.
- Signal jamming
- Interfering with radio frequencies to disrupt service; usually illegal outside controlled conditions and rarely in scope.
- Protocol fuzzing
- Sending malformed wireless frames to find implementation bugs.
- Packet crafting
- Building custom wireless frames for tests.
- Deauthentication
- Forcing clients off a network to capture handshakes or push them to an evil twin. Defence: 802.11w protected management frames (required in WPA3).
- Captive portal
- Testing or cloning guest-network login pages to capture credentials.
- Wi-Fi Protected Setup (WPS) personal identification number (PIN) attack
- Brute-forcing the 8-digit WPS PIN, which is validated in halves. Defence: disable WPS.
Tools
- WPAD
- Web Proxy Auto-Discovery; abusing it can redirect client web traffic through an attacker proxy.
- WiFi-Pumpkin
- Rogue access point framework for evil twin and captive portal tests.
- Aircrack-ng
- Suite for monitoring, deauthentication, handshake capture and key cracking.
- WiGLE.net
- Database of mapped wireless networks.
- InSSIDer
- Wi-Fi scanner for networks, channels and signal.
- Kismet
- Passive wireless detector, sniffer and intrusion detection system.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 4.7 of the publicly available CompTIA PenTest+ PT0-003 exam objectives (Exam objectives V3, document version 5.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.