Wireless Network Pentest Checklist

Document corporate, guest, IoT, and any hidden wireless networks to be tested.

Map building layouts to plan testing positions and signal coverage areas.

Ensure monitor-mode capable adapters and directional antennas are available.

Ensure authorization covers wireless packet capture and deauthentication testing.

Understand the intended security architecture for comparison during testing.

Use airodump-ng or Kismet to identify all SSIDs, BSSIDs, channels, and encryption types.

Monitor probe requests and responses to reveal hidden network names.

Identify client MAC addresses, OUI vendors, and probe request patterns.

Test signal strength from parking lots, adjacent buildings, and public areas.

Compare discovered APs against the authorized AP inventory to identify rogues.

Locate the wireless LAN controller and check for accessible management portals.

Perform targeted deauthentication to capture handshakes and crack PSK with hashcat.

Set up a rogue AP with hostapd-mana to test for PEAP/MSCHAPv2 credential capture.

Capture PMKID from AP association responses for offline PSK cracking without deauthentication.

Check for WPA3 transition mode vulnerabilities and Dragonblood attack susceptibility.

Attempt MAC spoofing, DNS tunneling, and portal bypass to access the network without authentication.

Test whether clients accept rogue RADIUS server certificates without proper validation.

Create a convincing rogue AP with matching SSID to harvest credentials from connecting clients.

Verify that wireless clients cannot access restricted wired network segments.

Use ARP spoofing or rogue AP to intercept traffic and test for sensitive data exposure.

Verify that clients on the same wireless network cannot communicate directly with each other.

Test whether wireless network access enables reaching internal servers, databases, or management systems.

Include heat maps showing signal strength outside physical security perimeters.

Provide MAC addresses, locations, and risk assessment for each rogue device.

Recommend WPA3 migration, RADIUS certificate pinning, and wireless IDS/IPS deployment.

Report password quality issues and recommend rotation and complexity improvements.

Shut down all evil twin APs and remove any rogue devices deployed during testing.