Wi-Fi penetration test checklists De-Authentication Attack PMKID Attack Cracking WPA 4-Way Handshake Identify hidden SSIDs WPA Reconnaissance WPA Enterprise Reconnaissance WPA Enterprise Brute-Force attack WPA WPS attack

Reconnaissance

• SSID discovery
• BSSID/AP discovery
• Client discovery
• Identify WPS-enabled APs and versions

Open networks

• Client isolation
• Cleartext traffic capture and inspection
• Captive portal bypass
• Captive portal vulnerabilities

WEP

• IV reuse
• Replay attacks
• WEP to WPA migration issues
• Key recovery

WPA/WPA2 (PSK)

• Handshake capture
• PMKID capture
• PSK complexity
• KRACK
• WPS brute-forcing
• Evil twin/Rogue AP

WPA/WPA2 Enterprise

• Enumerate information such as usernames
• Capture EAP certificate
• Brute-Force username and passwords
• EAP downgrade attack
• Enterprise Evil twin/rogue AP
• PEAP relay
• [

WPA3

• Transition mode (WPA2/WPA3 mixed)
• Dragonblood
• OWE
• SAE handshake resilience

Post-Exploitation

• PSK reuse
• Lateral movement
• Client isolation
• Network segregation
• Traffic exfiltration
• Logs and detection

Configuration / Policy Review

Authentication & Encryption

• Verify the current mode
• Verify deployment is correct

PSK management

• Verify PSK strength
• Check PSK distribution
• Change frequency
• Is PSK the same at different locations?
• Is PSK based on company name/company information?

Access Points

• Is the AP accessible?
• Could it be tampered with?
• What is the SSID? Is it based on company name or company information?

WPA2-Enterprise

• Review EAP method, avoid EAP-MD5, LEAP
• Validate certificate
• RADIUS server configuration

Network segregation

• Validate network separation
• Especially guest isolation

Firmware

• Is AP/Controller firmware up to date?

WPS

• is disabled?

Management protocols

• HTTPs/SSH in use?
• Insecure protocols disabled?
• Unnecessary services disabled?

Logging and monitoring

• Ensure sufficient logging
• Ensure centralized collection for logs
• Ensure alerting for deauth attacks
• Ensure alerting for Rogue AP
• Evaluate the effectiveness of rogue detection respo