Wireless:
Post-Exploitation
Decrypt traffic, recon networks, and map AP relationships post-auth
Decrypting WPA Traffic with Airdecap-ng and Wireshark
Decrypt captured WPA/WPA2 wireless traffic using Airdecap-ng and Wireshark after obtaining the PSK or PMKID during post-exploitation analysis.
What this phase covers
Post-exploitation actions take place after access to the wireless network is confirmed. This phase covers two areas: making use of data collected during earlier phases, and understanding what the wireless foothold actually gives you access to.
Decrypting WPA traffic is the first step if you captured frames during reconnaissance and enumeration before the passphrase was known. With the recovered PSK, airdecap-ng decrypts the entire capture offline — any session data, credentials, or application traffic that was transmitted during that window becomes readable. Network reconnaissance maps what the wireless segment connects to — often the same internal LAN as wired clients, with access to file shares, management interfaces, internal DNS, and other services. Manual connection with wpa_supplicant covers connecting with recovered credentials when NetworkManager is not available or for enterprise networks requiring specific EAP configuration. airgraph-ng visualises the full AP and client map from your airodump-ng survey data.
What to look for after joining
The first thing to check after getting an IP address is whether the wireless segment routes into other subnets. An internal DNS suffix in /etc/resolv.conf is an immediate indicator that the network is part of a corporate Active Directory environment. A domain controller reachable over port 389 or 445 means LDAP and SMB enumeration are possible from the wireless foothold. Management interfaces on the default gateway — web UI on port 80 or 443, SSH on 22 — are high-value targets for default credential checks. Recovered WPA Enterprise credentials (CORP\username:password) should be tested against every internal service that accepts domain authentication: VPN, OWA, RDP, and any internal web applications.
From here
Wireless post-exploitation typically transitions into standard internal network assessment techniques. SMB enumeration, LDAP queries, and lateral movement with recovered domain credentials are covered under the Windows platform guides. If the wireless segment is isolated with no route into the internal network, document the scope of access and what data was visible from the wireless segment alone.