<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: performing-wireless-penetration-testing
name: performing-wireless-penetration-testing
description: "Techniques and methodologies for performing wireless penetration testing"
subdomain: security-testing
title: "Performing Wireless Penetration Testing"
description: "Techniques and methodologies for performing wireless penetration testing"
tags:
  - wireless
  - Wi-Fi
  - penetration-testing
  - 802.11
  - RF-security
metadata:
  mitre-attack: ["T1557", "T1040"]
---

# Performing Wireless Penetration Testing

> Conduct comprehensive wireless network penetration tests targeting Wi-Fi, Bluetooth, and RF protocols to identify vulnerabilities in wireless infrastructure.

## Overview

Wireless penetration testing assesses the security of wireless networks and protocols including Wi-Fi (802.11), Bluetooth, and other RF communications. This technique covers reconnaissance, attack execution, and post-exploitation for wireless environments.

## Core Concepts

- **Wireless reconnaissance**: Identify SSIDs, BSSIDs, channels, and encryption types
- **Authentication attacks**: WPA2 handshake capture, PMKID extraction, WPS PIN brute force
- **Evil twin attacks**: Rogue access point deployment for credential harvesting
- **Bluetooth attacks**: Device discovery, service enumeration, BlueJacking/BlueSnarfing
- **RF analysis**: Spectrum analysis, signal strength mapping, interference detection

## Workflow

1. Define wireless testing scope and authorized frequency ranges
2. Conduct passive wireless reconnaissance and network mapping
3. Identify target networks and authentication mechanisms
4. Capture WPA2/WPA3 handshakes or PMKID hashes
5. Attempt offline key cracking against captured material
6. Deploy evil twin access point for credential testing
7. Test wireless client isolation and segmentation
8. Assess Bluetooth and other RF protocol exposure
9. Test wireless IDS/WIPS detection capabilities
10. Document findings with signal coverage maps and remediation

## Implementation

```python
from dataclasses import dataclass, field
from datetime import datetime
from enum import Enum
from typing import Optional


class WirelessEncryption(Enum):
    OPEN = "open"
    WEP = "wep"
    WPA = "wpa"
    WPA2_PSK = "wpa2_psk"
    WPA2_ENT = "wpa2_enterprise"
    WPA3 = "wpa3"


@dataclass
class WirelessNetwork:
    ssid: str
    bssid: str
    channel: int
    encryption: WirelessEncryption
    signal_strength: int
    clients: list[str] = field(default_factory=list)
    hidden: bool = False

    @property
    def risk_level(self) -> str:
        if self.encryption in (WirelessEncryption.OPEN, WirelessEncryption.WEP):
            return "critical"
        if self.encryption == WirelessEncryption.WPA:
            return "high"
        if self.encryption == WirelessEncryption.WPA2_PSK:
            return "medium"
        return "low"


class WirelessPenTestEngine:
    """Wireless penetration testing automation framework."""

    def __init__(self, interface: str = "wlan0") -> None:
        self.interface = interface
        self.discovered: list[WirelessNetwork] = []
        self.findings: list[dict] = []

    def add_network(self, network: WirelessNetwork) -> None:
        self.discovered.append(network)

    def high_risk_networks(self) -> list[WirelessNetwork]:
        return [n for n in self.discovered if n.risk_level in ("critical", "high")]

    def add_finding(self, title: str, severity: str, network: str, details: str) -> None:
        self.findings.append({
            "title": title, "severity": severity, "network": network,
            "details": details, "timestamp": datetime.utcnow().isoformat(),
        })

    def test_summary(self) -> dict:
        return {
            "networks_discovered": len(self.discovered),
            "high_risk": len(self.high_risk_networks()),
            "findings": len(self.findings),
            "critical_findings": sum(1 for f in self.findings if f["severity"] == "critical"),
        }
```

## Best Practices

- Always obtain written authorization specifying frequency ranges and target networks
- Use directional antennas to limit testing to authorized areas
- Test WPA2-Enterprise EAP configurations—certificate validation is commonly misconfigured
- Include rogue AP detection testing to validate WIPS effectiveness
- Document signal coverage with heatmaps for physical security correlation
- Test client-side wireless security policies (auto-connect, certificate pinning)

## Detection

```yaml
title: Wireless Penetration Testing Detection
id: 4a74b86f-a363-408d-9809-9228608ec28c
status: experimental
description: Detects suspicious activity related to performing wireless penetration testing techniques in security testing context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*performing*wireless*"
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1040
  - attack.discovery
falsepositives:
  - Authorized security testing tools during scheduled assessment windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Penetration Testing Detection | windows/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557, T1040 |

## Related Techniques

- [Building Security Testing Methodology](../building-security-testing-methodology/SKILL.md)
- [Implementing Compliance Penetration Testing](../implementing-compliance-penetration-testing/SKILL.md)
