Wi-Fi Basic Wireless Pentest Checklist

Recon

• What kind of network are you on?

• Is the network encrypted?

  • OWE vs WPA2 Open

• Identify the network gateway

route -n

• Run traceroute to see if traffic is blocked or redirected.
• Also can use traceroute to identify if specific ports are allowed

traceroute -p <port> 8.8.8.8

• Sometimes a partial internet access is necessary to function.

• nmap scan the captive portal server

  • Look for services that can be attacked
  • What versions are running etc

MAC address spoofing

• Use monitor mode

airmon-ng start <interface>

• Scan network for AP and clients

airodump-ng -c <channel> --bssid <bssid> <interface>

• Make a list of the MAC address of connected clients.
• Identify the IP address associated with the MAC by scanning the subnet

sudo nmap -v -n -sn <ip range> | awk '/is up/ {print up}; {gsub (/\(|\)/,""); up = $NF}/MAC Address:/{print " => "$3;}' 

• Change MAC address to a client

sudo ifconfig <interface> down
sudo macchanger -m <mac> <interface>
sudo ifconfig <interface> up

• Spoof the IP associated with the MAC address

sudo ifconfig <interface> <IP> netmask 255.255.255.0
sudo route add default via <gateway>

Bypass via VPN

• It might be possible to bypass via a VPN
• UDP 53
• Verify if UDP 53 is allowed.
  • Does it resolve to a private address?

dig <domain> +short

• Scan the gateway and see if UDP 53 is allowed

nmap -sU -sV -p 53 <gateway>

• Configure VPN client to establish a connection using UDP 53.

Access raw IP

• Try browsing to websites via the raw IP instead of domain name.

SOCKS proxy

• Similar to the VPN method try to configure a SOCKS proxy.

Capturing plaintext credentials or Session Tokens

• If the network is open and the captive portal uses HTTP, we can extract session tokens from the pcaps

airodump-ng -c <channel> --bssid <BSSID> <interface>

• Utilize filters in wireshark

(http.request.method == "POST") or (http.request.method == "GET")

(http.request.method == "POST" && ip.dst == <gateway>) or (http.request.method == "GET" && ip.dst == <gateway>)

Hostile Portal

• Use a rogue AP and setup a hostile captive portal
• Reuse the credentials against the real network

Compromise a connected client

• Scan connected clients for vulnerabilities
  • SSH with default password
  • Web services etc.

Brute-Force attacks

• Try to brute-force things like
  • Name + Hotel room
  • Employee number
  • Voucher codes
  • Username + Password