Internal Network Penetration Testing
Comprehensive testing from inside your network: Active Directory, credential exposure, lateral movement, segmentation, and the realistic paths from a network jack to domain or data compromise.
Service 06
Wireless penetration testing
Your wireless network extends past your walls, into the parking lot and the office next door. We test it from where an attacker would actually stand.
Overview
The problem we are solving
Wireless networks are often configured once and left alone. Pre-shared keys outlive the employees who knew them, enterprise authentication trusts certificates it should not, and guest networks quietly route to places they should never reach.
Testing happens on site and covers your corporate, guest, and any specialty networks, along with the clients that connect to them. We look at both sides: whether the network can be broken into directly, and whether your users' devices can be tricked into connecting to an attacker instead.
Wireless testing pairs naturally with an internal network test, since a wireless foothold is often the fastest way onto the internal network.
Coverage
What we test
Scope is agreed up front; these are the areas an engagement typically covers.
- Discovery & mapping
- Identifying every network and access point in range, including rogue and unauthorized devices, and how far your signal reaches outside the building.
- WPA2/WPA3-Personal
- Pre-shared key strength, handshake and PMKID capture and cracking, and key reuse across sites.
- WPA2/WPA3-Enterprise
- 802.1X and EAP configuration, certificate validation on clients, and credential capture through rogue access points.
- Evil-twin & client attacks
- Whether corporate devices and users will connect to a lookalike network, and what an attacker can capture when they do.
- Guest & segmentation
- Captive portal bypass, client isolation, and whether guest and IoT networks can reach corporate systems.
- Wireless to internal pivot
- What a wireless foothold actually reaches on the internal network, and how quickly it could lead further.
Methodology
How the engagement runs
-
01
Scoping & site planning
Agree sites, networks, SSIDs in scope, testing windows, and any rules about testing from outside the building.
-
02
Survey & discovery
On-site survey of networks, access points, clients, and signal coverage, including rogue devices.
-
03
Network attacks
Testing authentication and encryption of each in-scope network, and cracking captured material offline where applicable.
-
04
Client & evil-twin attacks
Controlled rogue access point testing against in-scope devices and users, following agreed rules of engagement.
-
05
Reporting
Ranked findings, a map of networks and coverage, and remediation guidance for your wireless platform.
-
06
Debrief & validation handoff
A walkthrough with your network team, with validation steps for every finding. Retesting is available if you would rather we confirm the fixes.
Deliverables
What you receive
- Full technical report with ranked findings, evidence, and reproduction steps
- Inventory of discovered networks and access points, including rogue devices
- Segmentation results for guest and specialty networks
- Remediation guidance specific to your wireless platform
- Validation steps for every finding, so your team can confirm and close out each fix on its own
- Live debrief with your network team
Aligned to
- Penetration Testing Execution Standard (PTES)
- NIST SP 800-153 (Wireless LAN Security)
- MITRE ATT&CK
Questions
Frequently asked
Does this have to be on site?
Yes. Wireless testing requires being within range of your networks. Multiple sites can be covered in one engagement.
Will this disrupt our Wi-Fi?
Most testing is passive or targeted at specific test clients. Any technique that could disconnect users is agreed in advance and kept to a minimum.
Related
Often scoped together
Social Engineering Assessments
Authorized phishing, vishing, smishing, and pretexting campaigns that measure how your people and processes respond to the attacks most breaches actually start with.
Get started
Ready to scope wireless?
Scoping conversations are free and usually take twenty minutes. You will speak directly with the consultant who would do the work.
Request an assessment
or reach out directly, (608) 520-0719 sales@infocus-security.com