Skip to content
HackIndex logo

HackIndex

Network Reconnaissance After Wireless Access

3 min read Mar 17, 2026

After gaining access to a wireless network the immediate goal is understanding what is reachable from that segment. Wireless networks often connect to the same internal network as wired clients, giving access to internal services, shared drives, printers, management interfaces, and sometimes direct routes into server VLANs. The steps here establish your position, map the local segment, and identify targets worth pursuing further.

Confirm Network Position

Check the IP address, subnet, and gateway assigned after connecting:

┌──(kali㉿kali)-[~]
└─$ ip addr show wlan0 
3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>
    inet 192.168.1.105/24 brd 192.168.1.255 scope global wlan0
┌──(kali㉿kali)-[~]
└─$ ip route show 
default via 192.168.1.1 dev wlan0
192.168.1.0/24 dev wlan0 proto kernel scope link

Note the subnet and default gateway. Check whether additional routes exist that indicate access to other network segments beyond the directly connected subnet.

Identify the Gateway

Check the gateway's MAC address against its OUI to identify the vendor — this often reveals whether it is a consumer router, enterprise AP controller, or managed switch:

┌──(kali㉿kali)-[~]
└─$ arp -n | grep 192.168.1.1 
192.168.1.1   ether   aa:bb:cc:dd:ee:ff   C   wlan0
┌──(kali㉿kali)-[~]
└─$ curl -s https://api.macvendors.com/AA:BB:CC:DD:EE:FF 
Cisco Systems, Inc.

Discover Live Hosts on the Subnet

A fast ARP scan identifies all live hosts on the local segment without triggering IDS rules that target ICMP flood scans:

┌──(kali㉿kali)-[~]
└─$ nmap -sn 192.168.1.0/24 
Nmap scan report for 192.168.1.1
Host is up (0.003s latency). MAC Address: AA:BB:CC:DD:EE:FF (Cisco)
Nmap scan report for 192.168.1.10
Host is up (0.012s latency). MAC Address: 11:22:33:44:55:66 (HP)
Nmap scan report for 192.168.1.105
Host is up (0.001s latency).

MAC vendor information from the ARP scan gives immediate clues about device types — HP often means printers or servers, Cisco means network infrastructure, Apple means workstations or phones.

Scan for Common Services

Run a service scan against discovered hosts to identify attack surface:

┌──(kali㉿kali)-[~]
└─$ nmap -sV -p 21,22,23,25,53,80,110,139,143,443,445,3306,3389,5900,8080,8443 192.168.1.0/24

Focus on ports 445 (SMB), 3389 (RDP), 22 (SSH), and 80/443 (web interfaces). These are the most common lateral movement paths from a wireless foothold.

Check for Other Reachable Subnets

Test whether the gateway routes traffic to subnets beyond the directly connected one. Try reaching common internal RFC1918 ranges:

┌──(kali㉿kali)-[~]
└─$ for subnet in 10.0.0.1 10.10.10.1 172.16.0.1 172.16.1.1 192.168.0.1 192.168.2.1; do ping -c 1 -W 1 $subnet > /dev/null 2>&1 && echo "$subnet reachable"; done 
10.10.10.1 reachable

A reachable address in a different subnet means the gateway routes between segments. Follow up with a host discovery scan on any reachable subnet to map what is accessible from the wireless segment.

Identify DNS and DHCP Infrastructure

The DNS server assigned by DHCP is often an internal domain controller or DNS resolver. Query it directly to reveal internal domain information:

┌──(kali㉿kali)-[~]
└─$ cat /etc/resolv.conf 
nameserver 192.168.1.10
search corp.local
┌──(kali㉿kali)-[~]
└─$ nslookup -type=SOA corp.local 192.168.1.10

An internal domain name in the search field confirms the wireless segment is part of a corporate Active Directory environment. The DNS server IP is likely a domain controller and a high-value target for further enumeration over SMB and LDAP.

Look for Management Interfaces

Consumer and enterprise routers, switches, and APs expose web management interfaces on common ports. Check the gateway and any other infrastructure-vendor hosts:

┌──(kali㉿kali)-[~]
└─$ curl -sk https://192.168.1.1 | grep -i "<title" 
<title>Cisco RV340 - Login</title>

Management interfaces identified here are targets for default credential checks and known CVE exploitation in subsequent phases.

References