Wireless Networks

A wireless network is more than an SSID. PEN-210 covers the architecture and components you attack: the access point, the stations (clients), and the identifiers that tie them together, the BSSID (the AP's MAC address), the ESSID (the human-readable network name), and the channel the cell operates on. Networks run in infrastructure mode (clients associate to a central AP forming a BSS, multiple APs sharing an ESSID form an ESS) or ad-hoc mode (peer-to-peer IBSS with no AP). Knowing which components exist and how they relate tells you what to target and how.

Enumerating APs and Clients

Reading an access point's advertised capabilities (supported rates, cipher suites, WPS state, management frame protection) and mapping which clients are associated to it turns a list of SSIDs into a concrete target picture. Unassociated clients broadcasting probe requests are attack surface in their own right. This is the enumeration that decides which attack path is viable against a given network.

Visualizing Network Relationships

In a crowded environment, a list of BSSIDs and station MACs is hard to reason about. Graphing the AP-to-client relationships from an airodump-ng capture shows at a glance which clients belong to which network and which devices are probing for networks that are not present, the relationships that seed deauthentication, rogue AP, and KARMA attacks later.