Wireless & Wi-Fi Penetration Testing

The most common wireless finding we report is not a broken encryption scheme. It is a guest network that isn’t really isolated. Connect as a visitor, and instead of a walled garden with internet access only, you find a route to internal servers, printers, or the management interfaces of the access points themselves. Guest access should be a dead end. Often it’s a doorway.

They don’t need to break the crypto if they can trick a laptop instead. An evil twin broadcasts your SSID with a stronger signal, a client roams to it automatically, and now the attacker sits between that user and everything they type. We test whether your clients would fall for it and whether your authentication resists it.

First we listen. We map every SSID and access point in range, including ones you didn’t know existed, note the encryption and authentication in use, and identify connected clients. This survey often turns up the surprises: a forgotten test SSID, a personal hotspot bridged to the corporate LAN, an access point still running factory settings.

For pre-shared-key networks we capture the handshake and crack it offline against large wordlists and rule sets. A dictionary word or a company name with a year on the end falls quickly. For WPA2-Enterprise we test the 802.1X exchange, set up rogue authentication endpoints to harvest credentials, and check whether certificate validation is actually enforced on client devices, because when it isn’t, the whole EAP protection collapses.

WPA3 is better, not bulletproof

WPA3 closes several of the classic offline-cracking paths, and we’re glad to see it deployed. It still has transition-mode weaknesses, downgrade opportunities where WPA2 clients are supported alongside it, and it does nothing about a guest network that routes to production. Newer encryption is not a substitute for testing the whole picture.

We deauthenticate clients to force reconnections, stand up evil-twin access points to see whether devices and users connect to them, and test captive portals for credential capture and bypass. This is where we learn whether your people and their laptops are the weak link, and it’s usually the most eye-opening part of the report.

Once connected to each network we test where it actually reaches, mapping guest-to-internal exposure and any lateral movement the wireless foothold allows. Then we write it up: what we broke, how, what it would let an attacker do, and the specific configuration changes that shut each path down.

A single Wi-Fi password shared across the whole company, printed on a whiteboard and unchanged since the office opened, is the classic. Once it leaks, and it always leaks, anyone in range is on your network. Cracking a weak PSK from a captured handshake is often a matter of minutes.

As above, this is the finding that surprises clients most. A guest SSID that can reach internal hosts turns the friendliest part of your network into the softest way in. Proper isolation and client-to-client blocking are simple to configure and frequently absent.

Employees plug in consumer routers to fix coverage, contractors leave kit behind, and old access points stay powered long after they should. Each is an unmanaged entry point with unknown settings, and each one sits inside your walls where your firewall can’t see it.

WPA2-Enterprise is only as strong as the client’s willingness to check the server certificate. When devices connect without validating it, a rogue authentication server harvests domain credentials directly, and one captured login can open far more than the Wi-Fi.

A short, non-technical read on what an attacker could do from your car park and how serious it is, with the priority fixes stated plainly.

Every finding with its impact, a CVSS score, the exact reproduction steps, and a concrete configuration fix your network team can apply. Captured evidence, cracked-key statistics and network diagrams are included where they help.

An attestation letter for auditors, clients and insurers, plus a free retest once you have reconfigured, to confirm the changes hold and the guest network really is a dead end now.

PCI DSS 4.0 sets specific expectations for wireless: quarterly scanning for rogue access points under requirement 11.2 and testing of any wireless in or connected to the cardholder data environment. ISO 27001 Annex A controls on network security and the SOC 2 common criteria both benefit from documented wireless testing. Testing methodology follows OWASP and the PTES wireless guidance.

Where personal data can be reached over the air, GDPR Article 32’s expectation of appropriate technical measures applies to your wireless just as much as your servers, and NIS2 pushes essential-service operators toward regular testing of exactly these exposed surfaces.

Automated wireless assessment tools flood you with warnings about supported cipher suites and theoretical downgrade risks, most of which don’t matter in your environment. A person filters that noise. We report the handshake we actually cracked and the guest network we actually reached, not a page of caveated maybes, and we tell you which of the scary-sounding config options are genuinely a problem for you and which are safe to leave alone.

Modern offices and sites carry far more than laptops on the air: badge readers, cameras, building-management sensors, warehouse scanners and printers, many on their own wireless with weak or default credentials. Where these sit in scope, we test them too, because an attacker who owns a camera network often owns a quiet vantage point inside your walls.