Wireless Network Hacking · Topic 2 of 3
Wireless Threats, Methodology and Tools
Know the main Wi-Fi threats, the wireless hacking methodology from discovery to compromise, and what Aircrack-ng, Kismet, Reaver and similar tools do.
- 5 min
- A rogue AP is unauthorized on the corporate network, and an evil twin imitates a legitimate SSID.
- Deauthentication uses unprotected management frames, which 802.11w (PMF) protects.
- The methodology runs from discovery and GPS mapping through traffic analysis and attacks to cracking.
What it is
Wireless threats are attacks that exploit the open nature of radio, weak encryption settings or careless users. The wireless hacking methodology is the ordered set of phases an ethical hacker follows to test a Wi-Fi network. The tools are the programs that perform each phase.
The exam tests whether you can name an attack from a description, put the phases in order and match a tool to its job. It does not ask you to run commands.
How it works
Wireless threats
| Threat | What it is | Typical defense |
|---|---|---|
| Rogue access point | An unauthorized AP plugged into the wired network, often by an employee | Wireless intrusion prevention, port security, regular scans |
| Evil twin | A fake AP that copies a trusted SSID so clients connect to it | Certificate validation, 802.1X, user training |
| Honeypot AP | A free hotspot set up to attract and monitor victims | Avoid unknown networks, use a VPN |
| Deauthentication attack | Forged management frames force clients off an AP, often to capture the handshake when they reconnect | Protected Management Frames (802.11w), required in WPA3 |
| Jamming | Radio noise that blocks the band and causes denial of service | Spectrum monitoring, locating the source |
| MAC spoofing | Copying an allowed MAC address to pass a MAC filter | Do not rely on MAC filtering alone |
| Key reinstallation (KRACK) | Replaying handshake messages to reinstall a key in WPA2 | Patch clients and APs |
| WPS PIN attack | Brute forcing the eight digit PIN | Disable WPS |
| Misassociation and ad hoc connections | A client joins the wrong network or a peer to peer link that bypasses controls | Disable ad hoc mode and auto connect |
| War driving | Driving around to find networks and map them | Strong encryption, reduced signal leakage |
Related terms: war chalking marked open networks with chalk symbols, and war walking and war flying use the same idea on foot or by drone.
The wireless hacking methodology
The EC-Council order has five phases. Know them as a sequence.
- Wi-Fi discovery: find networks in range, either passively by listening or actively by probing. Record SSID, BSSID, channel and encryption.
- GPS mapping: record the location of each network found, for survey and reporting.
- Wireless traffic analysis: capture frames in monitor mode to learn the encryption, clients and handshake details.
- Launch wireless attacks: for example deauthentication, fake AP creation, MAC spoofing or jamming.
- Crack the encryption: recover a WEP key or test a WPA or WPA2 passphrase against a captured handshake with a wordlist.
After cracking, the tester compromises the network by joining it and testing what lies behind it. Monitor mode is a mode of the wireless adapter that lets it capture all frames in range, not only those addressed to it.
Wireless hacking tools
| Tool | Purpose |
|---|---|
| Aircrack-ng suite | A set of tools for monitoring, capture, injection and cracking. Includes airmon-ng (monitor mode), airodump-ng (capture), aireplay-ng (injection such as deauthentication) and aircrack-ng (key recovery). |
| Kismet | A passive wireless detector, sniffer and intrusion detection system for Wi-Fi, Bluetooth and other radios |
| Wireshark | A packet analyzer that reads captured wireless frames |
| inSSIDer and NetStumbler | Network discovery and signal survey tools. NetStumbler is an older Windows tool. |
| Reaver | Tests WPS PIN weaknesses |
| Wifite | Automates several wireless audit tools |
| Fern WiFi Cracker | Graphical tool that audits Wi-Fi security |
| hashcat | Cracks captured handshake hashes with GPU speed |
| coWPAtty | Tests a WPA-PSK handshake against a dictionary |
| WiGLE | A public database of mapped networks from war driving |
A worked example
A tester is asked to assess a branch office Wi-Fi network. First they survey the building and find five SSIDs, one of which is unexpected. The BSSID is not in the asset list, and its channel does not match the company plan.
Tracing the signal shows a small device plugged into a wall port in a meeting room. It is a rogue access point, and it bridges the corporate LAN to anyone who joins it. The finding is reported with the location, and the countermeasure is port security plus wireless intrusion prevention that alerts on unknown BSSIDs.
How the exam asks about this
- "Which attack forces clients off an access point so a handshake can be captured?" → Deauthentication.
- "Which tool suite includes airodump-ng and aireplay-ng?" → Aircrack-ng.
- "What is a fake AP using a legitimate SSID called?" → An evil twin.
What to remember for the exam
- A rogue AP is unauthorized on the corporate network, and an evil twin imitates a legitimate SSID.
- Deauthentication uses unprotected management frames, which 802.11w (PMF) protects.
- The methodology runs from discovery and GPS mapping through traffic analysis and attacks to cracking.
- Aircrack-ng is a suite, and Kismet is passive.
- Reaver targets WPS, and hashcat targets captured hashes.
Do not confuse a rogue access point with an evil twin. The rogue AP is an unauthorized device on your network, and the evil twin is an attacker's copy of your SSID.
Common mistakes
Calling any fake hotspot a rogue AP. The exam separates unauthorized internal devices (rogue) from copied networks (evil twin) and free traps (honeypot).
Thinking MAC filtering stops attackers. MAC addresses are visible in the air and are easy to copy.
Assuming Kismet injects traffic. Kismet is passive. Injection is the job of aireplay-ng.
Check yourself
What does monitor mode do?
It lets the adapter capture all wireless frames in range, not only those sent to it.
Which standard protects management frames from forged deauthentication?
802.11w, called Protected Management Frames.
Which phase comes right after Wi-Fi discovery in the EC-Council methodology?
GPS mapping.
Topic 2 of 3 in Wireless Network Hacking
Test yourself on Wireless Network Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.