Wireless (WiFi) Penetration Testing: WPA2/WPA3, Evil Twin, PMKID and Protection

Quick answer: Wireless penetration testing measures whether a company's WiFi infrastructure can be taken over from outside, without ever touching a physical cable. The attack surface crosses the building's walls: from a parking lot or street an attacker can crack the password, deceive users with a rogue access point (Evil Twin) or exploit enterprise 802.1X misconfigurations. Known attacks include KRACK and PMKID on WPA2 and Dragonblood on WPA3; deauthentication and Evil Twin target the human factor. Protection is built with WPA3, Protected Management Frames, strong passwords, properly certificate-validated 802.1X, guest and corporate network segmentation and rogue-AP detection.

While companies invest in external security, WiFi is often overlooked, yet the wireless network is a surface reachable from outside the building that opens a door straight into the internal network. A firewall can stop attacks from the internet, but radio waves do not care about walls, windows or the parking lot. If an attacker cracks the WiFi password from a parking lot without touching a cable, they are now on the internal network and the scenario of this article's sibling, Active Directory internal network penetration testing, begins. NIST's WLAN security guide (SP 800-153) offers recommendations for configuration security and continuous monitoring of wireless networks; but being from 2012, for current encryption it should be read together with the Wi-Fi Alliance WPA3 specification.

What wireless testing measures

The test probes three main axes. First, encryption resilience: whether the WPA2 or WPA3 password can be cracked offline. Second, the human factor: whether a rogue access point can deceive users and collect credentials. Third, enterprise configuration: exploiting certificate-validation and client-configuration errors on networks using 802.1X. The test also covers the separation between guest and corporate networks, network segmentation and paths from WiFi into the internal network. Because reaching WiFi is not valuable on its own; the real risk is reaching the company's actual data from there.

The test requires physical proximity: the team listens to and evaluates signals from around and inside the building within the defined scope. So wireless testing often runs together with a physical and social-engineering assessment.

WPA2 attacks

PMKID: clientless password cracking

Classic WPA2 password cracking used to require capturing the four-way handshake a client produces when joining the network; that is, the attacker had to wait for a user to connect or for a connection to drop and re-establish. The PMKID attack disclosed by Hashcat developer Jens Steube in 2018 changed this: the attacker captures the PMKID value from a single EAPOL frame in the access point's first message and cracks it offline, with no connected client or full handshake needed. The PMKID is generated with HMAC-SHA1 over the PMK and is captured with hcxdumptool and cracked with hashcat. This significantly simplifies the process and is a serious risk for corporate WiFi with weak, dictionary-findable passwords. Defense is to use long random passwords; an unguessable password cannot practically be cracked even if the PMKID is captured.

KRACK: the WPA2 handshake flaw

KRACK (Key Reinstallation Attacks), disclosed by Mathy Vanhoef in 2017, replays messages in WPA2's four-way handshake to force nonce and key reinstallation, leading to decryption of traffic. Older Android and Linux clients (wpa_supplicant) were especially vulnerable; in some cases the key dropped to all zeros. Environments with unpatched devices are tested for this; on modern, updated devices the risk is largely closed, but old IoT and embedded devices may still be vulnerable.

WPA3 attacks: Dragonblood

WPA3 provides stronger authentication than WPA2 and protection against offline password guessing; it is mandatory for new Wi-Fi CERTIFIED devices and enforces Protected Management Frames. This is a major improvement that makes management-frame attacks such as deauthentication harder. However, the Dragonblood vulnerabilities disclosed by Mathy Vanhoef and Eyal Ronen in 2019 showed that WPA3's SAE (Dragonfly) handshake can be open to password-partitioning attacks via timing and cache-based side channels (CVE-2019-9494 timing/cache side channel, CVE-2019-13377 Brainpool curve timing). WPA3 is more secure, but unpatched implementations and the transition mode used for backward WPA2 compatibility introduce new risks; in transition mode an attacker can force a client down to WPA2. The test checks these configurations.

Evil Twin, rogue AP and deauthentication

The most effective wireless attacks do not break encryption, they deceive people. The attacker sets up a rogue access point (Evil Twin) with the same name (SSID) as the company network; this is effective because most devices auto-connect to the stronger signal. With deauthentication frames they drop users off the real network; this is easy on networks without protected management frames. When users connect to the rogue network, a fake captive portal (for example a page saying "re-enter your WiFi password") harvests WiFi or corporate passwords. This scenario is where wireless testing intersects with phishing and social engineering simulation and tests human awareness more than technology; because if the user does not enter their password on the fake page, the attack fails. The Aircrack-ng suite is a complete toolkit for assessing wireless security, including monitoring, deauth, injection, replay and WPA-PSK cracking.

Enterprise WiFi: 802.1X testing

Large organizations use 802.1X (WPA2/WPA3-Enterprise) instead of a single shared password; each user authenticates with their own credential or certificate through a backend RADIUS server. This removes the risk of a shared password leaking, but introduces a new one: clients not properly validating the server certificate. If a client does not check with a certificate whether the RADIUS server it connects to is genuine, the attacker can stand up a rogue RADIUS server and harvest the user's corporate credentials (and even a crackable hash in methods such as MSCHAPv2). The test probes client configuration, certificate validation, EAP method security and resilience to a rogue RADIUS attack. This is the most common and most critical finding in enterprise WiFi.

Common findings

In our field experience the most common findings in corporate wireless networks are: weak, dictionary-findable WPA2 passwords; guest network not fully separated from the corporate network, that is access from guest WiFi to internal servers; clients not validating the server certificate (rogue RADIUS risk); Protected Management Frames disabled (easy deauthentication and Evil Twin); and old, unpatched access points. Most of these findings are critical because they enable a path from WiFi into the internal network.

Protection

  1. WPA3 and Protected Management Frames. Use WPA3 wherever possible and enforce management-frame protection; this makes deauthentication and Evil Twin attacks harder. Use transition mode only when necessary and consciously.
  2. Strong, long passwords. On WPA2/WPA3-Personal networks, long random passwords make PMKID and offline cracking practically impossible.
  3. Properly configured 802.1X. On enterprise networks ensure clients strictly validate the server certificate; this closes the rogue RADIUS attack. Certificate-based authentication is more secure than password-based.
  4. Network segmentation. Fully separate guest WiFi from the corporate network; segmentation prevents an attacker who reaches WiFi from moving into the internal network. This is one of the most important defensive layers.
  5. Rogue AP detection and continuous monitoring. Monitor for same-SSID rogue access points and deauthentication attacks with wireless intrusion detection.
  6. Patching and awareness. Keep client and infrastructure devices current against known vulnerabilities such as KRACK and Dragonblood; train employees against fake captive portal and Evil Twin scenarios.

How we work at DSET

We run wireless tests in an authorized way with scope, physical location and time window defined in writing; for the legal framework see the penetration testing contract and legal authorization. For our methodology see the PTES seven stages. WiFi testing is often planned together with internal network testing, because the wireless network is the door into the internal network.

Frequently Asked Questions

Do you need to come to the office for a WiFi test? Yes, wireless testing requires physical proximity; the team tests from around and inside the building within the defined scope.

We use WPA3, are we safe? WPA3 is a major improvement but not absolute; transition mode, unpatched implementations and 802.1X misconfigurations still carry risk. The test verifies these.

Will the test disrupt the network? Techniques such as deauthentication are applied in a controlled way within scope; tests requiring broad disruption are done with written approval and a suitable window.

Our guest WiFi is separate, is that a problem? Being separate is good, but "separate" is not enough; the test proves whether there is really a path from the guest network to the corporate network. In many companies the guest network is not as isolated as believed.

How often should it be done? At least once a year and after a significant change in the wireless infrastructure (new access points, new authentication method).

Sources

To prove whether your corporate WiFi can be taken over from outside, contact DSET.