Wireless penetration testing

Common findings (examples)

These are patterns we often see. They are not a scorecard for your site.

• A guest network that can reach internal print or file servers.
• A shared pre-shared key reused across every office, never rotated after staff leave.
• Enterprise clients that accept any certificate for the corporate SSID.
• An unauthorised access point plugged into a wall port and bridging into the LAN.
• Device or IoT SSIDs with no isolation and default credentials on the controllers.

What we need from you

• Site addresses, floors and any restricted areas.
• SSID list and a contact who can approve access on the day.
• Whether you want guests, staff or device networks in scope.
• Written agreement on disruptive techniques and out-of-hours windows.
• Optional read-only access to wireless controllers for configuration review.

Typical timeline

Duration depends on the number of sites, floors and SSIDs. A single office with a few networks is often a short engagement; multi-site work with enterprise authentication and a pivot into the LAN takes longer. We agree dates after the scope call.

Standards and method

Testing follows the wireless and network assessment practices described in NIST SP 800-115. Configuration checks draw on common industry control language (including CIS wireless and network controls where they apply to your gear).

On site we combine passive survey, authenticated client testing and, where you allow it, controlled active techniques. Captures stay on encrypted storage and are destroyed or returned according to the engagement agreement.

Scope options

• Single site. One office or warehouse, all SSIDs you name, with or without a pivot into the LAN.
• Multi-site. The same method across several locations, with a combined report and per-site annexes.
• Controller review only. Read-only review of wireless controllers and policies when an on-site survey is not yet approved.
• Combined with internal testing. Wireless findings that lead into the LAN can be handed to an internal network and Active Directory engagement so the path is followed all the way.

What stays out of scope by default

• Staff home routers and personal hotspots.
• Neighbouring networks you do not own.
• Destructive radio jamming.
• Physical break-in to plant rooms or cabinets (unless a separate physical scope is agreed).

Reporting that network owners can use

Each wireless finding names the SSID, the approximate location and the evidence (capture, screenshot or reproduction steps). Severity follows what a nearby attacker could reach — a guest network that opens an internal file share ranks higher than a weak guest portal with nowhere to go. Remediation is written for the team that owns the controllers and for the team that owns the LAN behind them, so the fix does not stall between two owners.

If wireless testing is booked with an internal network engagement, the report cross-links paths that continue past the access point so you are not left with two disconnected PDFs.

Working around live sites

Hospitals, factories and trading floors often cannot accept noisy testing in business hours. We plan quiet survey windows, mark exclusion zones on a floor plan and keep a stop contact on call. If a controller change or a cutover is planned the same week, tell us — we would rather shift days than collide with your change window.

Scope and rules

• Scope call. Sites, floors, SSIDs, permitted times, exclusion zones and whether disruptive techniques (for example deauthentication) are allowed.
• Survey. A walk of what is broadcast in and around each site, including neighbouring and rogue signals.
• Authentication and client testing. Enterprise and personal modes, certificate checks and client behaviour under spoofed networks.
• Segmentation checks. What each network can actually reach, not what the diagram says.
• Controlled pivot. Where agreed, attempts to move from wireless into internal systems, within the written rules.
• Report and retest. Findings with evidence, a walkthrough and a retest of fixes that are ready within 6 months of the original test (up to 10 issues).