Wi-Fi Concepts

# ===== 1) Rules of engagement (excerpt — signed before any test) =====
# Targets:    a dedicated lab SSID + its access points; lab VLAN only
# Off-limits: corporate SSIDs, guest Wi-Fi, neighbour networks, any traffic
#             belonging to anyone except the engagement test devices
# Window:     2026-06-18 09:00 - 17:00 AEST
# Goal:       evaluate access-control, monitoring, segmentation; collect
#             evidence; deliver hardening recommendations
# Stop:       monitoring page, RoE end time, > 30s sustained packet loss for
#             the legitimate lab clients

# ===== 2) Why this matters defensively =====
# Most 'we got hacked over Wi-Fi' stories trace to:
# - WPA2-Personal with a weak PSK
# - WPA-Enterprise without certificate validation on clients
# - Captive portals that allow client-to-client traffic
# - Guest VLAN that can reach internal services
# - Rogue APs trusted by management frames
# Authorised testing catches each before an attacker does.

# ===== 3) Setup (your laptop on the lab network) =====
# Tools (Linux):
sudo apt install -y aircrack-ng kismet wireshark hostapd-wpe wpa_supplicant
# A USB Wi-Fi card that supports MONITOR mode (e.g. Alfa AWUS036ACH)
# Capture interface
sudo ip link set wlan0 down
sudo iw dev wlan0 set type monitor
sudo ip link set wlan0 up

# ===== 4) Discover lab APs and clients =====
sudo airodump-ng wlan0
# Confirm you're targeting ONLY the lab BSSIDs / SSIDs in scope.

# ===== 5) Capture a WPA2-Personal handshake (PSK strength test) =====
sudo airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w lab-handshake wlan0
# (Trigger a reconnect from a TEST client you control. Do NOT deauth random
# clients — only your own lab device. Many regions consider deauth packets
# against unowned devices illegal.)

# Crack OFFLINE with a SCOPED wordlist
hashcat -m 22000 lab-handshake.hccapx /usr/share/wordlists/rockyou.txt
# Report: PSK cracked in X minutes from a Y-word list ->
# RECOMMEND: 14+ char passphrase from a managed password manager;
#            rotate quarterly; consider WPA3-SAE which resists offline.

# ===== 6) Enterprise (802.1X) — certificate validation =====
# Test whether clients accept ANY cert presented by the RADIUS server:
# - Spin up a rogue AP with hostapd-wpe (Wireless Pwnage Edition)
# - Real lab client connects? -> client does NOT validate the cert ->
#   attacker can capture MSCHAPv2 hashes -> crack offline
# - Real lab client refuses?  -> validation is in place ->
#   verify the trust anchor and the server CN/SAN in the supplicant config

# Fix recommendations:
# - Set the supplicant: domain validation + the EXACT server name + CA bundle
# - Issue server certs from an internal CA whose root is pinned in profiles
# - Deploy 802.1X profiles via MDM so users cannot tap-through warnings

# ===== 7) Client isolation on guest / staff Wi-Fi =====
# From a connected lab device, ping / scan OTHER connected lab devices.
# If clients can see each other:
nmap -sn 10.20.30.0/24
# RECOMMEND: 'AP isolation' / 'Client isolation' ON, on guest SSIDs
#            AND on staff SSIDs unless intentionally peer-to-peer.

# ===== 8) Segmentation — can guest reach internal? =====
# Connect to the guest SSID, then:
nmap -p 22,80,443,3306,5432,8080 10.0.0.0/16
# RECOMMEND: guest VLAN may reach the internet ONLY; deny RFC1918 destinations
#            at the firewall; deny mDNS, SMB; allow DHCP/DNS only.

# ===== 9) Rogue AP / Evil Twin =====
# Stand up a rogue AP with the same SSID as the corporate Wi-Fi on the LAB
# laptop only. Check whether your monitoring (WIDS) alerts within minutes:
# - Cisco / Meraki / Aruba / Ubiquiti all have rogue-AP detection
# - Many SMB setups have it OFF by default
# RECOMMEND: enable Wireless IDS; alert on duplicate BSSIDs and known SSIDs
#            from unauthorised radios.

# ===== 10) Deauthentication / Wi-Fi DoS =====
# Most modern APs honour 802.11w (Protected Management Frames) which renders
# deauth attacks ineffective. Test by attempting deauth at a TEST CLIENT and
# see whether it disconnects:
# (Only against your own test client.)
sudo aireplay-ng --deauth 5 -a <BSSID> -c <test client MAC> wlan0
# If the client drops, 802.11w is not enforced. Enable it.

# ===== 11) Reporting =====
cat <<'EOF'
## Finding: WPA2-Personal PSK cracked from offline handshake
Severity:  High (anyone with the PSK can join the network)
Scope:     lab SSID 'shop-lab'
Evidence:  handshake captured 09:42, cracked in 4 minutes from RockYou wordlist
Fix:
  - Rotate to a 14+ char random passphrase
  - Migrate to WPA3-SAE where supported
  - For high-value networks, move to WPA-Enterprise + 802.1X
Defence-in-depth:
  - 802.1X with certificate-validated supplicants
  - Client isolation on guest + staff SSIDs
  - Wireless IDS with rogue-AP alerts
EOF

# ===== 12) Cleanup =====
# - Stop airodump / hostapd-wpe / kismet
# - Remove monitor-mode interface or reset:
sudo ip link set wlan0 down
sudo iw dev wlan0 set type managed
sudo ip link set wlan0 up
# - Delete pcaps + handshakes once they are in the report archive
# - Encrypt the archive and share only via the client's secure channel

# ===== 13) What never to do =====
# - Test against SSIDs you do not have written authorisation for
# - Deauth random devices to capture random handshakes
# - Crack passwords from neighbours / passers-by
# - Persist captured handshakes beyond minimum evidence
# - Stand up an evil twin in a public space

# Modern Wi-Fi pentesting context:
#   - WPA3 SAE > WPA2 PSK > WEP (broken).
#   - Open / Captive-portal networks need an HTTPS app-layer assumption.
#   - WPS PIN is broken; disable.
# Test only networks you own / control.