<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wireless-network-audit
description: >-
  Audit wireless network security including WPA2/WPA3 configuration assessment, rogue AP
  detection, client isolation verification, 802.11 protocol analysis, and wireless IDS
  deployment using aircrack-ng, Kismet, and Zeek.
domain: cybersecurity
subdomain: network-security
tags:
  - wireless
  - wifi
  - wpa3
  - rogue-ap
  - aircrack-ng
  - kismet
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557.004", "T1200", "T1587.001"]
  nist-csf: ["DE.CM-1", "PR.AC-5", "PR.DS-2"]
  uuid: a1b2c3d4-1006-4a00-b006-f00d00000006
---

# Performing Wireless Network Audit

## Overview

Wireless networks expand the attack surface beyond physical boundaries. Auditing wireless
security requires assessing encryption strength, detecting rogue access points, validating
client isolation, testing deauthentication resilience, and monitoring for evil twin attacks.
This skill covers 802.11 reconnaissance, WPA2/WPA3 assessment, rogue AP detection, and
wireless IDS deployment.

Mode: `[MODE: RED]` for penetration testing; `[MODE: BLUE]` for monitoring.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter supporting monitor mode (Alfa AWUS036ACH, TP-Link TL-WN722N v1) | Required |
| aircrack-ng suite installed | Required |
| Kismet 2023+ for wireless IDS | Required |
| Wireshark/tshark for 802.11 frame analysis | Required |
| Physical proximity to target wireless infrastructure | Required |

## Key Concepts

### Wireless Reconnaissance

```bash
# Enable monitor mode
airmon-ng start wlan0

# Scan for access points and clients
airodump-ng wlan0mon --band abg --write scan_results --output-format csv,pcap

# Target specific channel and BSSID
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w target_capture

# Identify hidden SSIDs via probe responses
tshark -i wlan0mon -Y "wlan.fc.type_subtype == 0x05" -T fields \
  -e wlan.sa -e wlan.ssid
```

### WPA2/WPA3 Security Assessment

```bash
# Check encryption type from scan
airodump-ng wlan0mon | grep -E "WPA3|WPA2|WEP|OPN"

# Capture WPA2 4-way handshake
airodump-ng wlan0mon -c 6 --bssid AA:BB:CC:DD:EE:FF -w handshake

# Verify handshake capture
aircrack-ng handshake-01.cap

# Test WPA3-SAE transition mode vulnerability
# Check if AP accepts WPA2 downgrade
aireplay-ng --deauth 5 -a AA:BB:CC:DD:EE:FF wlan0mon
```

### Rogue AP Detection with Kismet

```bash
# Start Kismet in IDS mode
kismet -c wlan0mon --override wardrive

# Define allowed AP list
cat > /etc/kismet/kismet_alerts.conf << 'EOF'
alert=ADVCRYPTODISABLED,5/min,1/sec
alert=APSPOOF,10/min,1/sec
alert=BSSTIMESTAMP,10/min,1/sec
EOF

# Query Kismet API for detected APs
curl -s http://localhost:2501/devices/views/phydot11_accesspoints/devices.json | \
  jq '.[] | {ssid: .dot11.device.last_beaconed_ssid_record.dot11.ssid,
             bssid: .kismet.device.base.macaddr,
             encryption: .dot11.device.last_beaconed_ssid_record.dot11.ssid_crypt_set}'
```

### Suricata Wireless-Adjacent Detection

```
# Detect deauthentication flood (captured via bridge)
alert udp any any -> any any ( \
  msg:"Wireless - possible deauth attack indicator (high disconnect rate)"; \
  threshold:type both, track by_src, count 50, seconds 10; \
  sid:3001040; rev:1; \
  metadata:mitre_attack_technique T1557.004;)
```

## Workflow

### Step 1: Pre-Engagement Scoping

Document authorized SSIDs, BSSIDs, channels, and physical assessment boundaries.

### Step 2: Passive Reconnaissance

Identify all APs, clients, encryption types, and channel utilization.

### Step 3: Security Assessment

Test encryption strength, client isolation, and management frame protection.

### Step 4: Rogue AP Detection

Compare discovered APs against authorized inventory. Flag unknown BSSIDs.

### Step 5: Report Findings

Document vulnerabilities, signal coverage issues, and remediation steps.

## Detection

```yaml
title: Wireless Network Audit Detection
id: 51ef5dc5-c7cd-4075-826a-fd152ba9bf86
status: experimental
description: Detects suspicious activity related to performing wireless network audit techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557.004
  - attack.t1200
  - attack.t1587.001
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Wireless Network Audit Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557.004, T1200, T1587.001 |

## Verification

- [ ] All APs use WPA3 or WPA2 with AES-CCMP minimum
- [ ] No rogue or unauthorized access points detected
- [ ] Client isolation prevents lateral movement
- [ ] Management Frame Protection (MFP/802.11w) enabled
- [ ] Deauthentication resilience validated
- [ ] Guest network properly segmented from production

## References

- [Aircrack-ng Documentation](https://www.aircrack-ng.org/doku.php)
- [Kismet Wireless IDS](https://www.kismetwireless.net/docs/)
- NIST SP 800-153: Guidelines for Securing WLANs
- CIS Controls v8 — Control 12: Network Infrastructure Management
