Wi-Fi Penetration Testing
Wireless infrastructure on-site — weak ciphers (WPA2/3), rogue access points, Evil Twin attacks, guest-network isolation and WPS flaws.
Wi-Fi penetration testing is an on-site assessment of your wireless infrastructure against over-the-air attack techniques. Passeca tests for weak ciphers (WPA2/WPA3 downgrade), rogue and Evil Twin access points, guest-network isolation weaknesses, WPS flaws and enterprise authentication weaknesses — the wireless routes an attacker with physical proximity uses to reach your internal network.
What concrete vulnerabilities do we test for?
Wireless risk lives in the over-the-air protocol and in how SSIDs and VLANs are segmented from your internal network.
Weak ciphers (WPA2 / WPA3)
Legacy or downgraded authentication and key-exchange weaknesses, TKIP use, and WPA3 Dragonfly (SAE) downgrade or timing attacks where the deployment allows it.
Rogue access points
Unauthorised APs planted in the environment — spoofed SSIDs and MACs — that lure clients onto an attacker-controlled network for credential capture.
Evil Twin attacks
A duplicate SSID with a stronger signal that hijacks client connections, enabling credential theft and man-in-the-middle traffic interception.
Guest-network isolation
Guest and corporate SSIDs that allow client-to-client traffic, share a VLAN with production, or lack proper isolation and egress controls.
WPS & management flaws
WPS PIN brute-force (Pixie-Dust / online), default AP admin credentials, exposed management interfaces, and unencrypted management protocols.
EAP / 802.1X weaknesses
Misconfigured enterprise authentication — EAP methods exposing identities, weak or missing server-certificate validation, and credential-leak in handshake.
Methodology for wireless networks
On-site, over-the-air testing with dedicated wireless hardware. Passive reconnaissance first, then active attacks under agreed rules of engagement.
We start with passive reconnaissance — surveying all SSIDs, BSSIDs, channels, encryption modes and signal coverage across the site without transmitting. We then capture authentication handshakes, test for downgrade and cipher weaknesses, and attempt Evil Twin and rogue-AP scenarios to see whether client devices can be lured onto an attacker-controlled network.
Segmentation is validated by attempting to traverse from the guest and corporate SSIDs into internal VLANs, confirming whether client isolation and egress controls hold. WPS, management interfaces and enterprise authentication (EAP / 802.1X) are assessed for configuration and credential-exposure weaknesses.
Example findings from real (anonymised) Wi-Fi tests
Wireless findings typically expose a path from a laptop in the car park to the internal network.
Guest network allowed client-to-client traffic into corporate VLAN
The guest SSID lacked client isolation and shared routing into a corporate segment, letting a guest device reach internal services intended to be segregated.
Evil Twin with stronger signal hijacked corporate clients
A duplicate corporate SSID broadcast at higher power captured client handshakes, enabling offline credential cracking and traffic interception.
WPA3 access points accepted WPA2 downgrade
Mixed-mode APs allowed clients to downgrade to WPA2, re-exposing them to the legacy attack surface the WPA3 rollout was meant to retire.
Default admin credentials on access points
Several APs retained vendor default management credentials reachable from the wired network, offering full device configuration control.
Findings are anonymised and paraphrased. Specific reproduction steps are reserved for the engagement report.
How long does a Wi-Fi pentest take, and what does it cost?
Driven by the number of sites, SSIDs, access points, and buildings requiring RF coverage.
| Engagement size | Typical duration | Price band |
|---|---|---|
| Single site, few SSIDs | 2–3 days on-site | Price on request |
| Single site, corporate + guest + 802.1X | 3–5 days on-site | Price on request |
| Multi-site estate | Per-site, 2–3 days | Price on request |
Use the free pentest scoping tool for a precise estimate.
What's in the report?
- Executive summary — wireless risk in business terms.
- Graded findings — per-SSID and per-AP, with CVSS and business impact.
- Evidence — captures and attack-step documentation.
- Remediation guidance — cipher policy, isolation, rogue-AP detection, segmentation.
- Compliance mapping — PCI DSS, ISO 27001, SOC 2, NIS2.
- Remediation retest — fixes retested within the engagement window.
Which compliance requirements does this satisfy?
| Framework | Relevant requirement | How the pentest maps |
|---|---|---|
| PCI DSS | Req. 11.4 | Penetration testing and segmentation validation, where applicable |
| ISO 27001:2022 | A.8.20 / A.8.29 | Network security & security testing in development and acceptance |
| SOC 2 | CC4.1 / CC6 | Monitoring & logical access |
| DORA | Art. 24–25 | Digital operational resilience testing |
| NIS2 | Art. 21 | Risk-based security measures, evidenced |
Wi-Fi pentest, answered
WPA2 vs WPA3, on-site requirements, Evil Twin and compliance for wireless testing.
What is Wi-Fi penetration testing?
Why is Wi-Fi testing separate from network testing?
What is an Evil Twin attack?
Do you test WPA2 and WPA3?
Do you need on-site access for a Wi-Fi test?
Which compliance requirements does a Wi-Fi pentest satisfy?
How long does a Wi-Fi pentest take?
Tell us your sites and SSIDs — get a day estimate
The free pentest scoping tool converts your wireless estate into a day estimate and price band, then hands to Passeca's offensive-security team for a precise quote.
Related