Wireless & Adjacent Surfaces

Wireless only on owned networks or networks where a written authorization explicitly covers RF testing. Capturing traffic from a neighbor, café, hotel, workplace guest SSID without permission, or random BSSID is not “practice” — it can be illegal interception or unauthorized access.

Even passive capture can be regulated depending on jurisdiction and content. Active attacks (deauth, evil twin, jamming) are higher risk and often illegal outside authorized tests. Jamming is widely restricted and should not be used as a casual lab trick on shared spectrum in ways that disrupt others.

RoE for wireless must name SSIDs/BSSIDs, physical locations, time windows, allowed techniques (passive only vs deauth, client attacks, rogue AP), and safety constraints for medical or industrial environments.

If a probe request or interesting enterprise SSID appears from outside your lab, ignore it. Curiosity is not scope.

Ideal home lab: a dedicated lab access point (or spare router) on a channel plan you control, a client device you own, and an attacker machine with a compatible wireless NIC. Prefer a spare AP not used for household production traffic.

Use a known lab SSID and strong but intentionally crackable passphrase only when you are practicing cracking; otherwise use production-grade secrets and do not attempt to crack them. Never reuse personal banking or email passwords as lab PSK material.

Faraday bags, distance, low transmit power, and off-hours reduce accidental impact on neighbors. You are still responsible for frames you transmit.

Document BSSID, channel, security mode (WPA2-PSK, WPA3, enterprise), and adapter chipset/driver notes. Wireless troubleshooting is half driver reality.

Open networks provide no encryption; anything above RF can be observed. Captive portals are not encryption. WEP is obsolete and should be reported as critical if found live.

WPA2-PSK (Personal) protects airtime with a shared secret; weak passphrases fall to offline attacks after handshake or PMKID capture. WPA3-Personal improves resistance to offline dictionary attacks when properly implemented, but misconfigurations and transition modes still appear.

WPA2/WPA3-Enterprise uses 802.1X and a RADIUS backend. Assessment shifts toward certificate validation, EAP method strength, client trust behavior, and RADIUS integration — not simple PSK cracking.

Management frame protection, PMF, client isolation, and band steering affect both attack paths and user experience. Report the mode the network actually negotiates, not the marketing label on the box.

Monitor mode and packet capture tools let you observe beacons, probes, and authentication exchanges for in-scope BSSIDs. Verify you are associated with the correct BSSID — multi-AP sites and mesh systems confuse beginners.

The four-way handshake occurs when a client authenticates to a PSK network. Controlled reauthentication of your own lab client is the professional way to obtain a handshake in a test. Mass deauthentication of third parties is often out of scope and can be unlawful or harmful.

PMKID-based techniques can obtain material for offline attacks against some WPA2-PSK configurations without a full client handshake, depending on AP behavior. Still only against authorized targets.

Validate captures before burning GPU time: incomplete handshakes waste hours. Confirm message completeness with your cracking tool’s verification features.

Hash extraction tools convert captures into formats accepted by hashcat or similar. Wordlists and rules simulate realistic password guessing; pure brute force of strong random PSKs is usually infeasible — that is the point of good passphrases.

Success against a lab weak password teaches process. Against a client network, a cracked PSK is high impact: network access, lateral movement to LAN hosts, and often capture of other client traffic depending on isolation.

Evidence: sanitized capture metadata, hash type, wordlist policy used, time-to-crack class, and LAN exposure after association. Do not publish client PSKs in clear text in wide-distribution slides; use controlled vault handling.

If cracking fails, the finding may still be “PSK entropy unknown / not assessed offline within window” rather than “secure forever.” Be precise.

Rogue AP / evil twin demonstrations show how users and devices trust SSIDs and certificates. Only run against consenting lab clients or explicit RoE. Capturing real user credentials from unaware humans is a social engineering activity with separate authorization.

Enterprise assessments evaluate whether clients validate server certificates, whether weak EAP methods are offered, and whether users can be trained to click through warnings — coordinated with the client.

Adjacent surfaces include guest networks bridging to LAN, WPS remaining enabled, default admin passwords on AP web UIs, and management interfaces on the WAN. Many “wireless” findings are really insecure network device administration.

Always close the loop: after lab attacks, restore AP config, remove rogue interfaces, and stop monitor mode so your laptop is not a permanent RF mess.

Home Wi-Fi often hosts work laptops, cameras, medical-adjacent gadgets, and cloud-connected appliances. A weak PSK or exposed router admin UI is a full-lifecycle risk, not a CTF curiosity.

Operators who practice wireless techniques must keep a hard mental wall between lab SSIDs and family production SSIDs. Mis-aimed deauth or association tests can drop video calls, smart locks, or someone else’s work VPN.

Treat the household network as a small enterprise: inventory devices, separate trust tiers, patch the gateway, and monitor for strangers.

If roommates or family share the network, document what is production vs lab. Shared consent matters when experiments generate noise.

Change default admin passwords; disable remote (WAN) administration unless you have a strong need and restrictive controls. Keep router firmware updated from vendor channels you trust.

Prefer WPA3 or WPA2 with a long random PSK stored in a password manager; avoid common phrases and reused passwords. Disable WPS. Disable legacy protocols (WEP, TKIP-only modes) if compatibility allows.

Use a unique SSID that does not advertise your name or address. Hiding the SSID is not a security control; do not rely on it. Reduce power only if it still covers needed areas without inviting edge clients to sticky-roam poorly.

Turn off universal features you do not need: UPnP when not required, WPS, insecure cloud management, and guest features that bridge into LAN.

Put untrusted IoT on a guest or VLAN-like SSID that cannot initiate connections to workstations or NAS. Many consumer routers support “AP/client isolation” and guest networks — use them.

Work devices and password managers deserve the trusted segment. Backups and file shares should not be reachable from the smart fridge VLAN.

Document DHCP ranges and static assignments for easier anomaly spotting. A new MAC on the trusted SSID deserves a question.

For operators, a dedicated lab AP (even a travel router) is cheaper than apologizing for taking down household Wi-Fi during a deauth demo.

Label adapters and scripts with intended interface names. Keep a sticky note or checklist: “Lab BSSID only.” Automation that auto-selects the strongest signal is how accidents happen.

Store captures in engagement-like folders with clear names. Never “just crack” a capture file whose origin you do not remember.

In public spaces, do not run offensive wireless tools “for fun.” Passive observation of networks you do not own can still cross legal and ethical lines. Leave the gear bag closed.

Travel routers and portable lab kits should ship with known-good configs and strong admin secrets. Factory-default travel APs are a gift to hotel-side attackers — including you as the victim.

Evil twin risk works both ways: your family devices may join malicious SSIDs that mimic coffee shops. Prefer known networks, VPN on untrusted networks, and certificate-aware enterprise configs for work.

Bluetooth, Zigbee, and proprietary IoT radios expand the home attack surface. You do not need to attack them to inventory them: what can open a door, record audio, or bridge to LAN?

Physical access to the AP often bypasses wireless crypto entirely (reset buttons, Ethernet admin). Placement and physical security still matter.

Logging: even consumer routers sometimes show connected clients. Review periodically. Advanced homes may run separate firewalls (opnSense, etc.) with better visibility — optional depth, not required for this lesson’s baseline.

Checklist: firmware current, admin secret rotated if shared, WPS off, guest/IoT isolation verified with a phone test, PSK strength, remote admin off, unused features off, device inventory updated.

Test isolation by associating a phone to guest and attempting to reach a trusted LAN IP you own. Failure to connect is success.

After any wireless lab day, confirm production SSID still uses strong settings and that you did not leave a second DHCP server or rogue AP running.

Teach non-operator household members a simple rule: only known SSIDs, no clicking through certificate warnings on work profiles, report strange captive portals.