Red Team Wi-Fi: Modern Techniques
Two days on current Wi-Fi assessment techniques, replacing outdated methods. You start with the basics of old and new attacks, then apply them against an organisation as in a red team engagement, based on our recent work.
- Know today's Wi-Fi setups, standards and common attacks
- Monitor, capture and analyse Wi-Fi signals over the air
- Use the right tool at the right moment, with Red Team tricks
- Inject and crack: attack WEP, WPA and WPA2 PSK and enterprise
- Handle WPA3, open networks and rogue APs
- Work across 2.4, 5 and 6 GHz, including Wi-Fi 6E and Wi-Fi 7
- Forge packets with Scapy and exploit stack vulnerabilities
- Pivot from Wi-Fi into the Active Directory
- Red teamers and Wi-Fi pentesters
- Enterprise security teams
- Anyone whose Wi-Fi attack knowledge needs updating
Conferences where we have taught
Our courses have run at these conferences, and most of them can also run privately for your team.
Two days, fingerprint then attack
Observation and fingerprinting first, then the attacks, then going further.
Part 1Fingerprinting and observations
This part will introduce all the essential concepts of Wi-Fi. Indeed, starting with usages, topologies, and standards, attendees get a condensed refresher so they are ready for the attacks later. Then we go through different techniques to identify the other network to focus on our target(s) and investigate for potential openings.
- Scanning networks
- Identifying our targets
- Studying and analysing different frequencies from 2.4 GHz to 6 GHz
- Use of promiscuous mode
- Switching to monitor mode
- Using dedicated tools for efficient Wardriving
- Analyzing packets
- Modifying and forging own packets with Scapy
Part 2Attacks
After learning about monitoring, captures, and packet manipulations, we will see different cases and understand the opportunities an attacker can take when attacking a network. This part will go through old vulnerabilities that can still exist in some context to the newest attack opportunities, including existing tools.
- Identifying the target
- Attacking it efficiently
- Capturing the secret
- Identifying the target
- Sniffing handshakes
- Attacking the target
- Capturing the secret
- Identifying the target
- Targeting a client
- Attacking the network
- Capturing the secret
- Going further inside the Active Directory
Part 3Further attacks
We finish by looking at different ways and other opportunities we can acquire during a penetration test or a Red Team test, including some good Red Team tricks when all these skills are implemented.
In a private session
The content is arranged around your needs, and we can add:
- Fuzzing the Wi-Fi stacks
- Reversing FullMAC firmware
What every attendee takes home
A Wi-Fi kit and a ready-to-attack target, kept by the attendee.
- RF kit
- Wi-Fi dongle and preinstalled Raspberry Pi 4 target
- Slides and scripts
- Full deck and the tools used in class
- Captures
- Cleared for teaching
Prerequisites
A capable laptop
Linux recommended
Linux administration
Required
Pentest or red team experience
A plus, not required
Your trainer
Wireless and hardware security specialist. Published research on 5G security, Open RAN, baseband fuzzing, interception and mapping, and power-line communication (HomePlug AV, domestic PLC, electric vehicles and charging stations). Practical work across Wi-Fi, RFID and other wireless systems.
PublicationsHow it runs and what to know
How it is taught
Hands-on from the start: you work on real radios and real hardware, with the same tools and signal captures we use on engagements. Live courses include a hardware kit you keep; on-demand courses run at your own pace, on this site.
How progress is assessed
Progress is checked through the practical exercises done during the course. A certificate of completion is issued to each participant.
How and when to enrol
Live and tailored sessions are scheduled with you after a short scoping call, usually within a few weeks. On-demand courses start as soon as your purchase is confirmed.
Accessibility
Penthertz is a registered French training organisation (no. 11788588278). If a participant has a disability or a specific need, tell us when scoping and we will adapt the setup where we can.
Run it privately for your team
Priced per group, with content adapted to your needs. Remotely, on your site or at our offices near Paris.