# Getting Started: Wireless Assessment Workflow

> How the wireless assessment workflow maps to HackIndex content, and how to use this study path for the OSWP.

- **URL:** https://hackindex.io/learn/oswp-pen-210-study-path/introduction-to-pen-210
- **Certification:** [OSWP (PEN-210) Study Path](https://hackindex.io/learn/oswp-pen-210-study-path.md)
- **Estimated study hours:** 0.25
- **Published:** 2026-09-27
- **Updated:** 2026-09-27

A wireless assessment follows a repeatable workflow. You put your adapter into monitor mode, scan the airspace to map access points and clients, identify the encryption in use, capture the material needed to attack it (a handshake, PMKID, IVs, or credentials), crack or bypass it, then connect to the network and prove access. Every step depends on the one before. This page covers how that workflow maps to HackIndex content, so you know where to find what you need as you work through the OSWP study path.

## Wireless Assessment Workflow

Wireless attacks move through distinct phases:

- **Setup**: identify your chipset and driver, load the right tools, and enable monitor mode on the adapter.
- **Reconnaissance**: passively scan for access points, hidden SSIDs, and connected clients with airodump-ng and Kismet.
- **Enumeration**: fingerprint each target: encryption type, WPS state, personal vs enterprise authentication, and client activity.
- **Vulnerability Discovery**: determine which weakness applies: WEP, WPA/WPA2-PSK, WPS, WPA Enterprise with an unvalidated certificate, or an open network.
- **Exploitation**: capture and crack the key, brute the WPS PIN, stand up a rogue AP or evil twin, or harvest enterprise credentials.
- **Post-Exploitation**: connect to the network manually, decrypt captured traffic, and enumerate what is reachable once you are on it.

## How HackIndex Is Organized

Wireless content lives under the **wireless** platform, grouped by the phases above. When you need to enable monitor mode you go to **wireless > setup**; when you need to capture a WPA handshake you go to **wireless > exploitation**. Each article covers a specific technique with working commands and placeholder variables (`$IFACE`, `$BSSID`, `$CHANNEL`, `$ESSID`) and realistic output, so the focus is on what to run and how to read the result.

## Using This Study Path

The OSWP study path maps PEN-210 topics to HackIndex content. Each module page lists the relevant articles that cover the same skills. It is not a replacement for the official course material, but a free reference with practical commands for every exam topic. Because the exam bans automated tools like wifite, focus on driving the Aircrack-ng suite by hand until each attack is second nature.

> [!NOTE]
> The OSWP exam is manual. Automated wireless attack tools (wifite, wifiphisher, besside-ng) are banned, so you must run each step of the Aircrack-ng workflow yourself and understand what every command does. Practice against your own hardware until you can crack a network without notes.

## References

- [OffSec: PEN-210 Course Overview](https://www.offsec.com/courses/pen-210/) - Official course page with module descriptions and prerequisites.
- [OSWP Exam Guide](https://help.offsec.com/hc/en-us/articles/360046904731-OSWP-Exam-Guide) - Exam rules, scenarios, tool restrictions, and report requirements.