---
name: rt-exploit-wireless
description: "Wireless security assessment skill for authorized WiFi, Bluetooth, and RFID posture review with facility scope controls, non-interference rules, evidence handling, and remediation."
---

# rt-exploit-wireless - Wireless Security Assessment

## Overview

Wireless testing evaluates radio-facing access controls, guest isolation, enterprise authentication, rogue device monitoring, and facility exposure. Because wireless tests can affect nearby third parties, authorization must be precise.

## Prerequisites

- Approved physical locations.
- Approved SSIDs, devices, bands, and test times.
- Non-interference requirements.
- Client notification to SOC/facilities.
- Rules for capture files and device identifiers.

## Assessment Areas

| Area | Checks |
|---|---|
| WiFi | WPA mode, 802.1X, guest isolation, weak PSK process. |
| Enterprise Auth | Certificate validation, EAP method, onboarding. |
| Rogue Networks | Detection and response process. |
| Bluetooth | Discoverability, pairing policy, sensitive devices. |
| RFID/NFC | Badge technology review if explicitly approved. |
| Monitoring | WIDS/WIPS coverage, alert response, asset inventory. |

## Workflow

1. Confirm location and test boundaries.
2. Inventory authorized wireless networks and visible security settings.
3. Review guest-to-internal segmentation.
4. Review enterprise authentication configuration.
5. Validate rogue detection with approved benign identifiers.
6. Document risk without capturing unrelated third-party traffic.

## Evidence

Store redacted SSID/BSSID lists, screenshots of client-approved tests, segmentation results, and policy observations. Protect capture files as sensitive evidence.

## Remediation

- Use WPA3 Enterprise or strong WPA2 Enterprise.
- Validate server certificates in supplicants.
- Isolate guest networks.
- Rotate and protect PSKs.
- Monitor rogue access points.
- Maintain wireless asset inventory.


## Evidence Handling

Wireless evidence may include identifiers for nearby third parties. Redact unrelated SSIDs/BSSIDs, protect capture files, and store only what is needed to prove the client-owned control gap.

## Finding Examples

| Finding | Severity Driver |
|---|---|
| Guest network reaches internal services | Segmentation failure. |
| Weak enterprise certificate validation | Credential interception risk. |
| Shared PSK reused broadly | Unauthorized access risk. |
| Rogue AP not detected | Monitoring/control gap. |

## Autodoc

```bash
python _rtexit/scripts/autodoc_engine.py log --skill rt-exploit-wireless --phase exploitation --cmd "wireless posture review" --output "redacted wireless risk summary"
```
