16.1 Wireless Attacks and Tools

Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.7 — Given a scenario, perform wireless attacks using the appropriate tools — is the radio matching drill. Objective 2.2 already inventoried service set identifiers (SSIDs), hidden networks, associated clients, and encryption type. Objective 2.4 already matched WiGLE.net, InSSIDer, and Aircrack-ng as identification and capture tools. 4.7 is using the air: wardriving, evil twin, signal jamming, protocol fuzzing, packet crafting, deauthentication, captive portal, and Wi-Fi Protected Setup (WPS) PIN attacks, plus the named tools WPAD, WiFi-Pumpkin, Aircrack-ng, WiGLE.net, InSSIDer, and Kismet.

Wireless work is not implied by a network Classless Inter-Domain Routing (CIDR) range in the statement of work (SoW). The rules of engagement (RoE) must name the SSID, the building or radio-frequency (RF) window, and the techniques that are allowed. A tester who stands up an evil twin because they heard CORP-WIFI from the parking lot has left scope. Signal jamming is worse: in the United States and many other jurisdictions, willful RF interference is often illegal, and even authorized wireless tests frequently leave jamming out of scope. Exam trap: treating a successful jam as a penetration-test finding. It can be a crime.

Wardriving: map access points, do not crack them

Wardriving is collecting wireless access-point (AP) observations while moving — historically a car, now also a walk, a bicycle, or another path the RoE named. You record SSID, BSSID (the AP media-access-control address), channel, encryption, and GPS. What it does: it maps where radios live. When you pick it: the stem is a drive-by or campus walk that produces a map of APs, not a deauthentication flood and not a rogue portal.

WiGLE.net is the public historical wardrive database: SSID, BSSID, and GPS observations other people (and you, if you uploaded) already collected. On 2.4, WiGLE was a reconnaissance index. On 4.7, wardriving is the activity and WiGLE is still the map you query or contribute to. Exam trap: treating every WiGLE hit as in-scope. A neighbor's guest network in the same parking garage is not yours because the database plotted it. Trap two: treating wardriving as handshake cracking. Mapping is not a wordlist job, and this guide will not treat it as one.

Evil twin versus the legitimate AP

An evil twin is a rogue AP that clones the SSID (and often the look of the BSSID) of a legitimate AP so clients prefer the twin. What it does: stations associate to you instead of to corporate infrastructure. When you pick it: the stem shows a second AP advertising CORP-WIFI or CORP-GUEST that the client joined, especially when the tester also controls a captive portal on that AP.

Clients choose APs by advertised name and signal, not by a cryptographic proof that the AP is the real one — unless enterprise 802.1X is in use and the client actually validates the authentication-server certificate. Open and pre-shared-key networks are easy twins. Enterprise networks still twin when users click through a certificate warning or when a helper SSID is open.

Exam trap: calling every unauthorized AP an evil twin. A misconfigured lab AP with a unique SSID is a rogue, but the twin is the clone of a legit SSID. Trap two: standing up a twin without RF scope. The SoW for 10.4.0.0/16 does not authorize a rogue AP.

Deauthentication: force the reconnect

Deauthentication (and related disassociation) is an 802.11 management-frame attack that tells a client, or the AP, that the session is over. What it does: the station drops and then reconnects. Testers use that reconnect for two exam-visible reasons: the client may land on the evil twin (stronger signal, same SSID), or the tester may observe the next association on the real SSID. When you pick it: the stem says clients were kicked, then they joined the rogue AP, or the test needed them to reassociate.

Deauth is not signal jamming. Jamming is noise across a band. Deauth is a spoofed management frame. Aircrack-ng is the 4.7 suite that includes injection and deauth-family utilities; you do not need a command recipe, and this guide will not give one. Exam trap: treating deauth as implied by wireless enumeration. 2.2 listed the SSID. 4.7 deauth is an attack and needs the RoE to name it. Trap two: treating deauth as a WPS PIN method. They are different bullets.

Captive portal on a rogue AP

A captive portal is the splash or login page a guest network throws before it grants a path to the Internet — hotel Wi-Fi, airport Wi-Fi, CORP-GUEST. On 4.7, the interesting portal is the one the tester serves on an evil twin: it looks like the corporate or guest login and harvests credentials (or anything users are willing to type). When you pick it: the stem pairs a rogue AP with a fake login page. WiFi-Pumpkin is the named rogue-AP / captive-portal framework. Exam trap: treating every hotel portal as 4.7. The attack is the portal on your twin. Trap two: calling the portal cross-site scripting (objective 4.5). It is social-engineering-adjacent credential collection on a wireless path.

Signal jamming: usually illegal, usually out of scope

Signal jamming is RF denial of service: a transmitter that overwhelms a channel or band so legitimate 802.11 (or other radios) cannot be decoded. What it does: nobody talks. When you pick it: the stem is noise, a jammer, or "the band went unusable," not a deauth reason code. When you do not: almost every professional engagement. Jamming is often illegal (in the U.S., the Federal Communications Commission treats willful interference harshly) and frequently carved out of RoE even when evil twins are allowed. Exam-correct behavior: recognize the term, refuse it when the RoE is silent, and never treat a jam as a clever finding. Trap: "jamming is just loud deauth." Deauth is frames; jamming is energy.

Protocol fuzzing and wireless packet crafting

Protocol fuzzing on 4.7 sends malformed or unexpected 802.11 (or related wireless management and control) fields to see whether an AP, driver, or client crashes or mis-parses. What it does: it tests the parser, not a pre-shared key. When you pick it: the stem is a crash, a reboot, or a weird information-element after unusual frames.

Packet crafting on 4.7 is building custom 802.11 frames — unusual subtype, flags, or tags — not the objective 4.2 Internet Protocol / Transmission Control Protocol / virtual-LAN crafter, and not msfvenom payload generation. When you pick it: you need a wireless frame a stock client would not send. Aircrack-ng (injection) is the 4.7 family; later specialized-system objectives name other crafters for other radios. Exam trap: answering 4.2 Impacket or Hydra for an 802.11 frame. Trap two: treating fuzzing as a WPS PIN attack. PIN is a protocol design weakness, not a crash.

WPS PIN: a protocol weakness, not a wordlist

Wi-Fi Protected Setup (WPS) was meant to let a user join with an 8-digit personal identification number (PIN) or a push button instead of typing a pre-shared key. The PIN design is a protocol weakness: the AP's WPS implementation historically allowed the PIN to be validated in halves, which collapses the search space. What the exam wants: identify WPS PIN attack when the stem shows WPS still enabled on a registrar, and recommend WPS off. WPS should be disabled on production APs. When you pick it: WPS is on, a PIN registrar is advertised, and the question is the wireless attack type. When you do not: WPA3-Enterprise with WPS off; a 4.3 cracking stem; a 2.2 encryption-type inventory with no attack.

This guide will not walk a PIN brute-force or name a cracking wordlist as a how-to. Conceptual identification is enough. Exam trap: treating WPS PIN as "the same as WPA2-PSK cracking." Different bullets. Trap two: treating WPS as a feature you should leave on for ease of testing. The control is off.

4.7 tool matching

WPAD is Web Proxy Auto-Discovery, listed on 4.7 as a tool even though it is a protocol and attack path. Windows (and some other) clients search DHCP or DNS for wpad / wpad.dat and then send web traffic through that proxy. If the tester can answer WPAD — rogue DHCP on a twin, a poisoned name, or a writable wpad record — they become the web proxy and sit on-path for HTTP. When you pick it: auto-proxy, wpad.dat, or "the laptop fetched a proxy script from the tester." It is not Kismet and not a captive-portal HTML form, though a twin can serve both.

WiFi-Pumpkin is a rogue AP / evil-twin / captive-portal framework. When you pick it: you need to stand up the twin and the splash page as one kit.

Aircrack-ng is the capture, inject, and deauth-family suite. On 2.4 it identified and captured. On 4.7 it is still the suite when the stem is injection, deauthentication, or 802.11 capture. It is not a social-engineering toolkit and not a wordlist tutorial in this chapter.

WiGLE.net is the wardrive map. InSSIDer is a local graphical interface for SSIDs, channels, and signal strength (site-survey style). Kismet is a passive wireless sniffer and wireless intrusion-detection system: it finds hidden SSIDs, logs GPS for wardrives, and does not need to associate. When you pick Kismet: passive RF inventory or hidden-net detection. When you pick InSSIDer: a laptop GUI of nearby APs and channels. Exam trap: Kismet as the evil-twin framework (that is WiFi-Pumpkin). Trap two: InSSIDer as the public historical map (that is WiGLE).

Worked campus RF

The RoE names CORP-WIFI (WPA2-Enterprise) and CORP-GUEST (open plus portal) on the headquarters building for a Saturday window. A walk that logs BSSID and GPS is wardriving; checking WiGLE for the same BSSIDs is the map. An extra AP advertising CORP-GUEST that serves a fake Microsoft login is an evil twin plus captive portal — WiFi-Pumpkin if the stem wants the framework. Clients that drop and then join the twin after management frames are deauthentication, conceptually in the Aircrack-ng family. A conference-room AP still has WPS on — that is a WPS PIN finding; the remediation is WPS off, not a cracking cookbook. Laptops that fetched wpad.dat from the twin are WPAD. Kismet passively sees a hidden SSID the GUI missed; InSSIDer shows channel overlap in the boardroom. Nobody jams the band: jamming is out of scope and likely illegal. Sequence on the exam: confirm RF RoE, name the attack type, then pick the tool family.