Wireless Penetration Testing: What a Real Assessment Covers

Wireless networks occupy an interesting position in the security testing landscape. Most organizations think they have addressed WiFi security by setting a password and telling employees not to share it. A surprising number have also convinced themselves that wireless is a low-risk surface because attackers need to be physically nearby. The nearby part is true. The low-risk part is not.

A properly scoped wireless penetration test consistently surfaces findings that internal teams and IT vendors did not know about. Here is what one actually looks like and what it tends to find.

The Scope Question Nobody Asks

Most organizations that commission a wireless assessment tell the tester to "test the wireless network." That is not a scope. A building with multiple floors might have dozens of SSIDs across multiple frequency bands, several distinct network segments reachable via wireless, guest networks configured separately from corporate, IoT devices on their own SSID, and legacy access points forgotten in conference rooms that nobody manages anymore.

Before the technical work starts, a good wireless assessment establishes which SSIDs are in scope, what the expected network segmentation model is, what authentication mechanisms are supposed to be deployed, and what should not be reachable from the wireless network at all. These conversations produce useful information regardless of what the test finds afterward.

WPA2-PSK vs. WPA2-Enterprise: Different Attack Surface

Consumer and small business wireless deployments typically use WPA2-PSK, where every device authenticates with the same passphrase. Enterprise deployments typically use WPA2-Enterprise with 802.1X authentication, where each user authenticates with individual credentials, often against Active Directory.

The attack surface is materially different between these two modes.

Against WPA2-PSK, the classic attack involves capturing the four-way handshake that occurs when a client associates with the network, then attempting to crack it offline. The PMKID attack, documented in 2018, made this more efficient by allowing handshake capture without waiting for a client to connect. Whether the passphrase falls to offline cracking depends on how it was chosen. Organizations that rotate wireless passphrases infrequently and share them with large numbers of people create an exposure they rarely think about.

Against WPA2-Enterprise, the authentication exchange is more complex and the credentials used are often domain credentials. A misconfigured enterprise wireless deployment - specifically one where the client is not configured to validate the authentication server's certificate - is vulnerable to credential harvesting via a rogue authentication server. The attacker stands up an evil twin access point, clients connect and attempt to authenticate, and the exchange captures NTLMv2 hashes that can be cracked offline or used in relay attacks. This attack is well-understood and consistently underappreciated.

Evil Twin Attacks in Practice

The evil twin attack deserves its own section because it is effective and because many organizations believe they are not vulnerable to it.

The concept is straightforward. An attacker broadcasts an SSID matching a legitimate network, typically with a stronger signal than the real AP. Client devices configured to auto-connect to known networks will associate with the attacker's AP instead of the real one. What happens next depends on what the attacker wants: traffic interception, credential harvesting, or simply putting devices on a network the attacker controls.

The conditions that make this work exist in most enterprise environments. Employee devices remember SSIDs they have connected to and reconnect automatically. The SSID is public information - it is broadcast by every real AP. Client-side certificate validation for enterprise wireless is often misconfigured or absent. And users do not typically notice they connected to a different AP unless the visual experience changes.

The mitigation is certificate pinning on the client, enforced by device management policy. Organizations that deploy 802.1X wireless without also enforcing certificate validation on the client side have built only half the security control.

Segmentation: Where the Actual Risk Lives

The most consequential findings in wireless assessments are often not about breaking the wireless authentication itself. They are about what is reachable once you are on the network.

Guest wireless networks that provide internet access are supposed to be isolated from corporate infrastructure. They often are not, or the isolation has gaps. A device on the guest network that can reach internal DHCP servers, initiate connections to domain controllers, or access printers and management interfaces is a significant finding regardless of how well the wireless authentication is configured.

IoT devices on dedicated SSIDs create similar issues. A separate SSID does not guarantee network isolation. Whether the IoT segment can initiate connections to corporate systems, whether it uses the same authentication infrastructure, and whether the APs themselves are exposed on any management interface from those segments are all worth checking.

The segmentation question is simple: if an attacker connects to this wireless network, where can they go? The answer should be nowhere interesting. It frequently is not.

The Legacy AP Problem

Enterprise wireless networks grow over time. Buildings get reorganized. APs get installed by facilities, not IT. Some get moved during renovations and their Ethernet cable gets unplugged, but the hardware stays mounted to the ceiling.

What testers find regularly is APs that are not managed by the current wireless controller, are running default credentials on their management interfaces, and may be providing a wireless network that nobody intended to leave operational. These are not sophisticated attack vectors. They are configuration drift that nobody noticed.

A wireless assessment that includes passive radio scanning across the relevant spectrum - not just connecting to the known SSIDs - tends to surface things the organization did not know were broadcasting.

What Good Remediation Looks Like

The findings from a wireless assessment produce a short list of high-value fixes: enforce certificate validation in client device policy via MDM, rotate PSKs if WPA2-PSK is still in use and audit who has access to them, segment networks at the Layer 3 level rather than relying on separate SSIDs alone, and audit the AP inventory against what is actually managed by the wireless controller.

WPA3 adoption changes some of the PSK attack surface, particularly through Simultaneous Authentication of Equals replacing the four-way handshake. Transition in enterprise environments is slow, and much of the attack surface described above applies regardless of the authentication mechanism.

Wireless security tends to drift because the network is invisible. Nobody looks at it the way they look at firewall rules or patch levels. A dedicated wireless assessment every 12 to 24 months is one of the cheaper investments in the security testing portfolio relative to what it tends to find.