Wireless Network Hacking and Penetration Testing

Explore the 802.11 basics, including IEEE wireless local area networks, radio transmissions, and OSI layer 2 access, with standards a, b, g, 11e, and ac, plus frequencies and security.

Explore how Wi‑Fi signals use 2.4 and 5 GHz frequencies, the 14‑channel 2.4 GHz band, and how interference from common devices leads to adopting 5 GHz in dense areas.

Explore how wireless access points act as the central hub for wireless devices, connecting to the wired network and often managed via a controller, with variations in form and setup.

Explore infrastructure mode with a central access point and ad hoc mode as a peer-to-peer network, without a central hub, using a shared network name and channel.

Explore the evolution of 802.11 wireless modes from a/b/g/n/ac, noting data rates, frequencies, and modulation schemes. See how MIMO and channel bonding boost bandwidth up to 780 Mbps.

Understand ssid, essid, and bssid: ssid is the network name, bssid identifies the access point, and essid refers to a network shared across multiple base service sets.

Identify and understand the MAC address, its role as the unique layer 2 identifier on every network interface, and how it differs from IP addresses on a local network.

Select and associate with a wireless network, use cached credentials to reconnect, and switch between networks (including open ones) to obtain different IP addresses and gateways.

Learn how beacon frames broadcast SSIDs and network capabilities to help devices discover available Wi-Fi networks, and how to control or prevent beaconing for security.

Explore how an access point is configured via a web interface, covering basic setup, dhcp, mac address cloning, wireless settings, and device status using custom firmware and vendor references.

Explain how enterprise networks unify access points under a single SSID using a wireless LAN controller, enabling centralized management of hundreds of APs and clients.

Learn to configure wireless networking on Windows with a wireless adapter, connect to WPA2‑personal networks, and review network properties and IP configuration.

Connect to wireless networks on macOS via the status bar and network preferences, view the SSID and security, note the MAC and IP addresses, and forget networks as needed.

learn how to configure Linux wireless networks using GUI tools, install drivers with a wrapper or graphical front end, and even use Windows drivers to get your wireless card working.

Secure your wireless network by implementing strong authentication, using long passphrases, and enabling appropriate encryption. Learn username password authentication and practical protections against attacks.

Learn 802.1X, a port-based authentication system that authenticates devices before network access, using EAP over radius or diameter, and applies to wired and wireless networks to prevent rogue entrants.

Configure and use radius for authentication, authorization, and accounting in wireless networks, handling access requests, possible challenges, and MFA, with radius servers and clients in enterprise deployments.

Explore encryption concepts, including certificate information, public and private keys for asymmetric cryptography, hybrid cryptography exchanging a session key, and symmetric keys for wireless protocols like WEP, WPA, and WPA2.

Understand WEP, wired equivalent privacy, including 64-bit and 128-bit keys and the initialization vector, and why the protocol is crackable and not recommended.

Explore how WPA replaced WEP with TKIP and RC4, introducing WPA personal with a shared key and WPA enterprise with a radius server for username and password authentication.

WPA2 uses CCMP to secure wireless traffic and supports personal and enterprise modes, with enterprise adding a radius server for authentication. Avoid weak pre-shared keys to prevent brute-force attacks.

Explain the shift from WPA to WPA2 with CCMP, including enterprise and radius-based authentication, and show how weak pre-shared keys enable brute-force attacks and why long keys matter.

Explore how authentication messages pass between client and server via the extensible authentication protocol, including pap, chap, ms-chap, and leap, and how eap is transported over tls or eapol.

Disable the SSID broadcast to hide your wireless network, then reconnect by knowing the SSID and joining the network even when it does not appear in Wi-Fi Explorer.

Enable mac filtering on dd-wrt routers to create a blacklist or whitelist, adding specific mac addresses to allow or deny wireless network access.

Implement network segmentation by creating a guest network on a separate subnet with NAT, no bridging, and controlled access for BYOD devices.

Explore why default configurations are dangerous, as shown with dd-wrt routers using root/admin credentials, and learn to change usernames, passwords, and the default ssid to reduce attack risk.

Explore built-in wireless tools across Windows and macOS to view available networks, security types, and performance details, including IP address, MAC address, channel, noise, and diagnostics options.

Explore Kali Linux as a penetration testing distro with wireless attack tools, built-in categories like information gathering and vulnerability analysis, and flexible installation options such as ISO, VM, or ARM.

Explore how to use kismet, a Linux wireless monitoring utility, to start a server, define a capture interface, and view live networks by channel, including cryptography and hidden SSIDs.

Explore the aircrack-ng suite in kali linux to crack wep and wpa networks; enable monitor mode, capture packets, and prepare for the attack process.

Explore Mac OS Wi-Fi Explorer, a tool that reveals nearby wireless networks with network name, BSA ID (MAC address), vendor, signal strength, channel, band, and encryption.

Explore how Wireshark captures wireless traffic in monitor mode, decoding 802.11 frames and radio information to reveal beacons, SSIDs, data rates, and key management details.

Explore the wireless attack toolkit on a Raspberry Pi to simulate beaconing, evil twin attacks, and passive mode landing page attacks that expose client vulnerabilities.

Explore Windows-based Wi-Fi scanning with NetStumbler, noting chipset requirements, driver compatibility, and filtering options; compare with other Windows tools and cross-platform scanners for Mac OS and Linux.

Ettercap enables ARP spoofing to perform man-in-the-middle testing by forwarding packets, sniffing traffic with unified sniffing, and sending gratuitous ARPs to hijack IP-to-MAC mappings.

Explore the sniff tool to capture passwords by performing ARP spoofing and monitoring network traffic on wired and wireless networks. Learn how packet captures and application layer analysis reveal transmitted credentials.

Explore the air pwn tool by configuring a monitor-mode wireless setup, matching http requests with a regex, and injecting frames to hijack open wifi traffic when encryption is absent.

Air replay enables replaying captured frames to the network, enabling authentication attacks, fake authentication, interactive packet replay, ARP request replay, fragmentation attacks, and injection testing, including WPA migration mode.

Launch the fern wifi cracker in Kali Linux to scan for wireless access points and perform a dictionary-based brute-force attack using a word list.

Demonstrates Wi-Fi tap, a tool that creates a virtual interface to inject frames into a wireless network, tunneling packets through a tap or tun interface.

Explore how cow patty performs a dictionary attack on WPA pre-shared keys, using a packet capture and large password lists to test and strengthen wireless network security.

Explore how a Wi-Fi honeypot in Kali Linux creates a phony SSID and MAC addresses to trap and log attackers attempting to connect via open authentication on a wireless network.

Learn to use wireshark to decode raw network packets into readable data, select the correct interface, and start live captures across macOS, Windows, and Linux.

Capture packets with Wireshark by selecting an interface and starting the capture. Save results as cap or pre-cap files and filter for IP packets to refine the capture.

Enable monitor mode on your wifi interface to capture radio traffic, including 802.11 frames and beacon frames, alongside the radio tap header, beyond ethernet in promiscuous mode.

Explore how Wireshark breaks a captured packet into headers—from Ethernet and ARP to IP—revealing destination and source MAC addresses, header length, and vendor translations for Apple and Hewlett-Packard.

Master Wireshark filtering to isolate IP packets, using display and capture filters, build expressions with operators like equal and contains, and follow TCAP or UDP streams to inspect payloads.

Analyze radio traffic with Wireshark in monitor mode, decode beacon and management frames, and identify SSIDs, BSSIDs, channel use, and vendor information from nearby access points.

Explore wardriving as a method to locate wireless networks and rogue access points using tools like kismet, while assessing signal strength and MAC addresses to secure enterprise airspace.

Execute frame injection using aireplay-ng from the aircrack suite, set up a monitor interface, perform broadcast probes and a directed beacon to discover a target network's ssid and bssid.

Explore how radius handles authentication and the limitations of replay protection, including access request and access challenge exchanges, and how diameter and encryption mitigate replay attacks.

Explore how ssl stripping downgrades https to plain text via a man-in-the-middle attack using arp spoofing and network redirection on wifi networks.

Use airodump-ng to capture wireless frames by setting a monitor interface, writing dump files, and filtering by channel, SSID, and MAC addresses to support beacon analysis and fake authentication attacks.

Explains how a fake authentication attack enables a device to associate with a wireless access point, setting up replay and shared-key authentication scenarios with captured data.

Use the gcp replay tool to replay wireless network traffic from captured pcap files, adjusting output interface, packets per second, and timing from the capture to simulate attacks.

Explore how to crack a wireless network protected by WEP by capturing packets with a monitor interface on the target channel, replaying authentication frames, and preparing for password cracking.

The lecture demonstrates cracking a wep network by analyzing captured frames and the BSS ID, showing that 290 initialization vectors are insufficient and more packets are needed.

Crack a WPA pre-shared key with airodump capture and filtering, then cowpatty using a word list and WPA capture; the demo shows WPA1 can be cracked with the right data.

Explore rogue access points and learn how to create your own with hostapd on Kali to test client security and capture frames.

Explore various man-in-the-middle techniques, including arp spoofing, icmp redirect, port stealing, dhcp spoofing, rogue access points, and dns attacks used to intercept and redirect traffic.

Explore how MAC addresses, also called hardware or ethernet addresses, can be changed to bypass MAC filtering using macchanger on Linux, registry edits on Windows, and interface tweaks on macOS.

Explore Bluetooth as a short-range wireless technology in the 2.4 GHz band that connects peripherals like keyboards, mice, speakers, and headsets, with discoverable states and basic pairing concepts.

Explore Bluetooth authentication during pairing with pre-shared pins, secure simple pairing, passkey entry, and out-of-band NFC exchanges to set up connections.

Learn how Bluetooth capabilities are exposed as profiles, such as hands free, human interface device, and health device, and why identifying supported profiles is essential to use the device.

Analyze blue snarfing by running Bluestar against a Nexus 7 to reveal its MAC address, phone book, memory storage, and Bluetooth profile data via the SDP tool.

Use Blue Ranger to ping Bluetooth devices via MAC addresses, testing discoverability and link quality, and compare successful pings with connection errors alongside HDI tool capabilities.

Learn to scan for nearby Bluetooth devices with BT scanner, perform an inquiry scan, read MAC addresses, and identify vendors to enable follow-on tools like blue sonar.

Disable Bluetooth when not in use to prevent attacks and limit discoverability. Verify connection attempts, change pairing pins, and remove unpaired devices in public spaces.

Identify bluetooth devices and generate actionable logs using blue log and bt scanner in kali linux. Capture device details and mac addresses with fange for subsequent enumeration.

Explore WiMax as a wide-area wireless last-mile alternative to cable modems or dsl, highlighting urban deployment, the need for different adapters, and limitations in rural areas.

Explore near-field communication, its use for proximity cards and contactless payments, and how NFC enables out-of-band device configuration and Bluetooth connections, with security considerations.

Ziggy, a low-power personal area network technology based on IEEE 802.15.4, supports home automation and industrial sensing with 10–20 m range and 250 kbps bandwidth.

Explore how RFID uses active and passive tags and readers to transfer data, offering advantages over barcodes for tracking goods, toll collection, badges, and passport security.

Survey topics include 802.11 basics, beaconing and authentication, WEP, WPA, and WPA2 encryption, wireless attacks, Kali Linux tools, password cracking, access points, Bluetooth vulnerabilities, and defending wireless networks.

Set up a testing environment with kali linux in a vm or on hardware, pass through a usb wifi adapter, and explore dd-wrt to deepen wireless testing skills.

Walk through these lessons to gain hands-on experience with wireless technologies, learn pointers to secure personal and corporate information, and explore further training in ethical hacking and related topics.