# Wireless

> Wireless pentesting covering monitor mode setup, passive recon, AP and client enumeration, PMKID capture, WEP/WPA cracking, rogue APs, and post-auth traffic decryption

- **URL:** https://hackindex.io/platforms/wireless
- **Type:** Platform
- **Tags:** wireless, wifi, wpa, network, rf, 802.11
- **Published:** 2026-03-17
- **Updated:** 2026-07-13

Wireless network pentesting targets WiFi infrastructure, Bluetooth devices, and other radio-frequency protocols. WiFi remains one of the most common entry points into corporate and home networks, and misconfigured or weak wireless security frequently provides initial access that bypasses perimeter defenses entirely.

Wireless attacks focus on WPA/WPA2 handshake capture and cracking (dictionary, rule-based, and brute force), WPA3 Dragonfly handshake downgrade attacks, evil twin and rogue access point deployment for credential harvesting, deauthentication attacks for client disconnection and handshake capture, WPS PIN brute forcing, and client-side attacks against probe requests and automatic network association. Proper hardware (external WiFi adapters with monitor mode and packet injection support) is essential.

This section covers wireless pentesting techniques: reconnaissance and enumeration of access points, clients, and encryption types, exploitation of weak PSK configurations, protocol downgrade attacks, rogue AP and man-in-the-middle setups, post-exploitation on captured networks including ARP poisoning and traffic interception, and Bluetooth attack vectors. Core tooling includes aircrack-ng, Bettercap, Wifite, hcxdumptool, hashcat, and Wireshark.

## Phases

- [Setup and Hardware](https://hackindex.io/platforms/wireless/setup.md): Monitor mode setup, adapter selection, drivers, and chipsets (6 guides)
- [Reconnaissance](https://hackindex.io/platforms/wireless/reconnaissance.md): Guides on passive scanning, WPS discovery, and frame analysis (5 guides)
- [Enumeration](https://hackindex.io/platforms/wireless/enumeration.md): AP clients, auth types, PMKID capture, and remote sniffing (4 guides)
- [Vulnerability Discovery](https://hackindex.io/platforms/wireless/vulnerability-discovery.md): Guides for finding weak wireless configs and attack surfaces (7 guides)
- [Exploitation](https://hackindex.io/platforms/wireless/exploitation.md): WEP/WPA cracking, evil twins, EAP harvest, rogue APs, WPS attacks (15 guides)
- [Post-Exploitation](https://hackindex.io/platforms/wireless/post-exploitation.md): Decrypt traffic, recon networks, and map AP relationships post-auth (4 guides)