Wireless Network Penetration Testing

5.

Reconnaissance and Information Gathering

5.1.

Passive Reconnaissance Techniques

5.1.1.

Silent Network Monitoring

5.1.1.1.

Beacon Frame Analysis

5.1.1.2.

Probe Response Collection

5.1.1.3.

Traffic Pattern Analysis

5.1.2.

Wardriving Methodologies

5.1.2.1.

5.1.2.2.

Data Collection Strategies

5.1.2.3.

GPS Coordinate Logging

5.1.3.

Warflying Techniques

5.1.3.1.

Aerial Survey Methods

5.1.3.2.

Extended Range Considerations

5.1.4.

Database Integration

5.1.4.1.

5.1.4.2.

Local Database Creation

5.1.4.3.

Data Correlation Techniques

5.2.

Active Reconnaissance Methods

5.2.1.

Directed Probe Requests

5.2.1.1.

SSID Enumeration

5.2.1.2.

Hidden Network Discovery

5.2.2.

Client Device Identification

5.2.2.1.

MAC Address Collection

5.2.2.2.

Device Fingerprinting

5.2.2.3.

Vendor Identification

5.2.3.

Network Topology Mapping

5.2.3.1.

Access Point Relationships

5.2.3.2.

Coverage Area Analysis

5.3.

Information Analysis and Profiling

5.3.1.

Network Identification Data

5.3.1.1.

BSSID and ESSID Correlation

5.3.1.2.

Channel Assignment Analysis

5.3.1.3.

Signal Strength Mapping

5.3.2.

Security Assessment

5.3.2.1.

Encryption Method Identification

5.3.2.2.

Authentication Mechanism Detection

5.3.2.3.

WPS Status Verification

5.3.3.

Client Behavior Analysis

5.3.3.1.

Connection Patterns

5.3.3.2.

Preferred Network Lists

5.3.3.3.

Roaming Behavior

5.3.4.

Vendor and Device Intelligence

5.3.4.1.

OUI Database Lookups

5.3.4.2.

Device Capability Assessment

5.3.4.3.

Firmware Version Detection

Previous

4. Laboratory Setup and Tools

Go to top

Next

6. Attack Methodologies