Chapter 1, Wireless Lab Setup, shows how to create a wireless testing lab using off-the-shelf hardware and open source software. In order to be able to try out the dozens of exercises in this book, you will need to set up a wireless lab. We will first look at the hardware requirements, which include wireless cards, antennas, access points, and other Wi-Fi enabled devices. Then we will shift our focus to the software requirements, which include the operating system, Wi-Fi drivers, and security tools. Finally, we will create a test bed for our experiments and verify the different wireless configurations on it.

Chapter 2, WLAN and Its Inherent Insecurities, focuses on inherent design flaws in wireless networks that make insecure out of the box. We will begin with a quick recap of the 802.11 WLAN protocols using a network analyzer called Wireshark. This will give us a practical understanding about how these protocols work. Most importantly, we will see how client and access point communication work at the packer level by analyzing management, control, and data frames. We will then learn about packet injection and packer sniffing in wireless networks, and look at some tools that enable us to do this.

Chapter 3, Bypassing WLAN Authentication, reveals how you can break WLAN authentication mechanism! We will go step by step, and explore how to subvert Open Authentication and Shared Key Authentication. While doing this, you will learn how to analyze wireless packets and figure out the authentication mechanism of the network. We will also look at how to break into networks with Hidden SSID and MAC Filtering enabled. These are two common mechanisms employed by network administrators to make wireless networks more stealthy and difficult to penetrate, however, these are extremely simple to bypass.

Chapter 4, WLAN Encryption Flaws, describes one of the most vulnerable parts of the WLAN protocol, which is the encryption schemas—WEP, WPA, and WPA2. Over the past decade, hackers have found multiple flaws in these schemas and have written publically available software to break them and decrypt the data. Also, even though WPA/WPA2 are secure by design, misconfiguring these opens up security vulnerabilities, which can be easily exploited. In this chapter, you will understand the insecurities in each of these encryption schemas, and you'll perform practical demos on how to break them.

Chapter 5, Attacks on the WLAN Infrastructure, shifts your focus to WLAN infrastructure vulnerabilities. We will look at vulnerabilities created due to both configuration and design problems. We will also do practical demos of attacks, namely access point MAC spoofing, bit flipping and replay attacks, rogue access points, fuzzing, and denial of service. This chapter will you a solid understanding of how to do a penetration test of the WLAN infrastructure.

Chapter 6, Attacking the Client, might open your eyes if you always believed that wireless client security was something you did not have to worry about! Most people exclude the client from their list when they think about WLAN security. This chapter will prove beyond doubt why the client is just as important as the access point when penetration testing a WLAN network. We will look at how to compromise the security using client-side attacks such as misassociation, Caffe Latte, disassociation, ad-hoc connections, fuzzing, and honeypots.

Chapter 7, Advanced WLAN Attacks, looks at more advanced attacks, now that we have already covered most of the basic attacks on both the infrastructure and the client. These attacks typically involve using multiple basic attacks in conjunction to break security in more challenging scenarios. Some of these attacks include wireless device fingerprinting, man-in-the-middle over wireless, evading wireless intrusion detection and prevention systems, and rogue access point operating using custom protocol. This chapter presents the absolute bleeding edge in wireless attacks out in the real world.

Chapter 8, KRACK Attacks, investigates the new set of vulnerabilities discovered in 2017, regarding the WPA2 handshake. Your knowledge of the WPA2 handshake is refreshed and examined in detail to see how these new attacks apply.

Chapter 9, Attacking WPA-Enterprise and RADIUS, graduates you to the next level by introducing advanced attacks on WPA-Enterprise and the RADIUS server set up. These attacks will come in handy when you have to penetration test large enterprise networks that rely on WPA-Enterprise and RADIUS authentication to provide them with security.

Chapter 10, WLAN Penetration Testing Methodology, is where all the learning from the previous chapters comes together, and we will look at how to do a wireless penetration test in a systematic and methodical way. You will learn about the various phases of penetrating testing—Planning, Discovery, Attack, and Reporting, and apply it to wireless penetration testing. We will also understand how to propose recommendations and best practices after a wireless penetration test.

Chapter 11, WPS and Probes, covers the two new attacks in the industry that have developed since the initial publication—WPS brute-force and probe sniffing for monitoring.