<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-wireless-network-reconnaissance
description: >-
  Perform wireless network reconnaissance to discover access points, clients,
  signal strength, encryption types, and vulnerabilities in WiFi networks
  for physical security assessments.
domain: cybersecurity
subdomain: osint-recon
tags:
  - wireless
  - wifi
  - aircrack-ng
  - wardriving
  - bluetooth
  - rf-recon
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: >-
  aircrack-ng suite, kismet, bettercap, hcxdumptool,
  hcxpcapngtool, wigle.net, iwlist, iw.
metadata:
  mitre-attack:
    - "T1595.002"  # Active Scanning: Vulnerability Scanning
    - "T1040"      # Network Sniffing
    - "T1557"      # Adversary-in-the-Middle
---

# Performing Wireless Network Reconnaissance

## Overview

Wireless network reconnaissance identifies WiFi access points, connected
clients, encryption protocols, and signal characteristics within range of
the target. Techniques include passive monitoring, active probing, WPS
enumeration, and correlating findings with WiGLE.net wardriving data.
Results inform physical security assessments and wireless penetration tests.

## Prerequisites

- Wireless adapter supporting monitor mode (Alfa AWUS036ACH recommended)
- aircrack-ng suite (airmon-ng, airodump-ng, aireplay-ng)
- kismet for advanced wireless monitoring
- hcxdumptool and hcxpcapngtool for PMKID capture
- bettercap for network reconnaissance
- WiGLE.net API key (optional, for wardriving correlation)

```bash
sudo apt install aircrack-ng kismet hcxdumptool hcxtools bettercap
```

## Quick Reference

| Task | Command |
|------|---------|
| Monitor mode | `sudo airmon-ng start wlan0` |
| Scan networks | `sudo airodump-ng wlan0mon` |
| Target AP | `sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF wlan0mon` |
| Deauth | `sudo aireplay-ng -0 5 -a AA:BB:CC:DD:EE:FF wlan0mon` |
| PMKID capture | `sudo hcxdumptool -i wlan0mon --enable_status=1 -o dump.pcapng` |
| Convert hash | `hcxpcapngtool -o hash.22000 dump.pcapng` |
| WPS scan | `sudo wash -i wlan0mon` |
| Kismet | `sudo kismet -c wlan0mon` |
| Stop monitor | `sudo airmon-ng stop wlan0mon` |

## Workflow

### Step 1: Enable Monitor Mode

```bash
# Check wireless interfaces
iwconfig

# Kill interfering processes
sudo airmon-ng check kill

# Enable monitor mode
sudo airmon-ng start wlan0
# Creates wlan0mon interface
```

### Step 2: Passive Network Discovery

```bash
# Scan all channels — discover APs and clients
sudo airodump-ng wlan0mon

# Focused scan on specific channel
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# Write to file for analysis
sudo airodump-ng --output-format csv,netxml -w scan_results wlan0mon
```

### Step 3: Network Analysis

Key intelligence from airodump-ng output:
- **BSSID**: Access point MAC address
- **ESSID**: Network name (SSID)
- **Channel**: Operating frequency
- **ENC/NERF/AUTH**: WPA2/WPA3, CCMP/TKIP, PSK/MGT
- **PWR**: Signal strength (closer = stronger)
- **#Data**: Traffic volume indicators
- **Stations**: Connected client devices

### Step 4: PMKID Capture (WPA2/WPA3)

```bash
# Capture PMKID without deauth (passive)
sudo hcxdumptool -i wlan0mon --enable_status=1 -o pmkid_dump.pcapng \
  --filterlist_ap=targets.txt --filtermode=2

# Convert to hashcat format
hcxpcapngtool -o hash.22000 pmkid_dump.pcapng

# Crack with hashcat (if authorized for testing)
hashcat -m 22000 hash.22000 wordlist.txt
```

### Step 5: WPS Enumeration

```bash
# Discover WPS-enabled networks
sudo wash -i wlan0mon

# Check WPS lock status
sudo wash -i wlan0mon -C
```

### Step 6: WiGLE.net Correlation

```bash
# Query WiGLE for known networks near location
curl -s -u "$WIGLE_USER:$WIGLE_KEY" \
  "https://api.wigle.net/api/v2/network/search?latrange1=40.0&latrange2=40.1&longrange1=-74.0&longrange2=-73.9" \
  | jq '.results[] | {ssid, netid, encryption}'

# Search by SSID
curl -s -u "$WIGLE_USER:$WIGLE_KEY" \
  "https://api.wigle.net/api/v2/network/search?ssid=TargetSSID"
```

### Step 7: Cleanup

```bash
# Stop monitor mode
sudo airmon-ng stop wlan0mon

# Restart network manager
sudo systemctl restart NetworkManager
```

## Detection Opportunities

- Deauth attacks cause client disconnections — detectable by WIDS/WIPS
- Monitor mode interface creates identifiable radio signatures
- Probe requests from attacker devices reveal MAC addresses
- Rogue AP detection systems identify unauthorized scanning

## Verification

- [ ] Wireless adapter in monitor mode and functional
- [ ] All nearby access points catalogued with encryption types
- [ ] Connected clients identified per access point
- [ ] WPS-enabled networks flagged for additional testing
- [ ] Signal strength mapped for physical proximity assessment
- [ ] Monitor mode disabled and network services restored

## References

- [Aircrack-ng](https://www.aircrack-ng.org/)
- [Kismet](https://www.kismetwireless.net/)
- [hcxdumptool](https://github.com/ZerBea/hcxdumptool)
- [WiGLE.net](https://wigle.net/)
- [Bettercap](https://www.bettercap.org/)

---
v1.0 | Validated: 2026-03-17
