# Network Reconnaissance After Wireless Access

> Techniques for mapping internal networks post-wireless compromise, covering host discovery, port scanning, and lateral movement preparation using passive and active recon methods.

- **URL:** https://hackindex.io/platforms/wireless/post-exploitation/network-reconnaissance-after-wireless-access
- **Path:** Wireless > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/wireless/post-exploitation.md)
- **Published:** 2026-03-17
- **Updated:** 2026-08-11

After gaining access to a wireless network the immediate goal is understanding what is reachable from that segment. Wireless networks often connect to the same internal network as wired clients, giving access to internal services, shared drives, printers, management interfaces, and sometimes direct routes into server VLANs. The steps here establish your position, map the local segment, and identify targets worth pursuing further.

## Confirm Network Position

Check the IP address, subnet, and gateway assigned after connecting:

```bash
ip addr show wlan0
# 3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP>
#     inet 192.168.1.105/24 brd 192.168.1.255 scope global wlan0
```

```bash
ip route show
# default via 192.168.1.1 dev wlan0
# 192.168.1.0/24 dev wlan0 proto kernel scope link
```

Note the subnet and default gateway. Check whether additional routes exist that indicate access to other network segments beyond the directly connected subnet.

## Identify the Gateway

Check the gateway's MAC address against its OUI to identify the vendor: this often reveals whether it is a consumer router, enterprise AP controller, or managed switch:

```bash
arp -n | grep 192.168.1.1
# 192.168.1.1   ether   aa:bb:cc:dd:ee:ff   C   wlan0
```

```bash
curl -s https://api.macvendors.com/AA:BB:CC:DD:EE:FF
# Cisco Systems, Inc.
```

## Network Reconnaissance After Wireless Access: Host Discovery

A fast ARP scan identifies all live hosts on the local segment without triggering IDS rules that target ICMP flood scans:

```bash
nmap -sn 192.168.1.0/24
# Nmap scan report for 192.168.1.1
# Host is up (0.003s latency). MAC Address: AA:BB:CC:DD:EE:FF (Cisco)
# Nmap scan report for 192.168.1.10
# Host is up (0.012s latency). MAC Address: 11:22:33:44:55:66 (HP)
# Nmap scan report for 192.168.1.105
# Host is up (0.001s latency).
```

MAC vendor information from the ARP scan gives immediate clues about device types: HP often means printers or servers, Cisco means network infrastructure, Apple means workstations or phones.

## Scan for Common Services

Run a service scan against discovered hosts to identify attack surface:

```bash
nmap -sV -p 21,22,23,25,53,80,110,139,143,443,445,3306,3389,5900,8080,8443 192.168.1.0/24
```

Prioritize services by lateral movement potential:

- **445 (SMB)**: file shares, credential relay, PsExec/WMI execution.
- **3389 (RDP)**: direct interactive access if credentials are valid.
- **22 (SSH)**: Linux/network device access.
- **80/443 (HTTP/HTTPS)**: web management interfaces, internal applications.
- **3306 (MySQL)**: database access, often with weak or default credentials.
- **5900 (VNC)**: remote desktop, frequently unencrypted.

## Check for Other Reachable Subnets

Test whether the gateway routes traffic to subnets beyond the directly connected one. Try reaching common internal RFC1918 ranges:

```bash
for subnet in 10.0.0.1 10.10.10.1 172.16.0.1 172.16.1.1 192.168.0.1 192.168.2.1; do ping -c 1 -W 1 $subnet > /dev/null 2>&1 && echo "$subnet reachable"; done
# 10.10.10.1 reachable
```

A reachable address in a different subnet means the gateway routes between segments. Follow up with a host discovery scan on any reachable subnet to map what is accessible from the wireless segment.

## Identify DNS and DHCP Infrastructure

The DNS server assigned by DHCP is often an internal domain controller or DNS resolver. Query it directly to reveal internal domain information:

```bash
cat /etc/resolv.conf
# nameserver 192.168.1.10
# search corp.local
```

```bash
nslookup -type=SOA corp.local 192.168.1.10
```

An internal domain name in the search field confirms the wireless segment is part of a corporate Active Directory environment. The DNS server IP is likely a domain controller and a high-value target for further enumeration over SMB and LDAP.

## Look for Management Interfaces

Consumer and enterprise routers, switches, and APs expose web management interfaces on common ports. Check the gateway and any other infrastructure-vendor hosts:

```bash
curl -sk https://192.168.1.1 | grep -i "<title"
# <title>Cisco RV340 - Login</title>
```

Management interfaces identified here are targets for default credential checks and known CVE exploitation in subsequent phases.

## References

- [Nmap: reference guide](https://nmap.org/book/man.html) - Host discovery, service version detection, and port scan flags