Wi-Fi security, as it runs in the field
We test enterprise and product Wi-Fi the modern way: WPA2, WPA3 and enterprise EAP, across 2.4, 5 and 6 GHz (Wi-Fi 6E and Wi-Fi 7), up to pivoting into the internal network.
What an attacker could do
We check it before they do, with the same equipment.
Get onto your network
Reach the internal network from outside the building, over the air.
Steal credentials
Capture enterprise EAP credentials with an evil-twin access point.
Crash the stack
Fuzz the Wi-Fi stack until a device crashes or misbehaves.
Pivot
Move from a captured client into the Active Directory.
What we test
- Enterprise Wi-Fi (WPA2, WPA3, enterprise EAP)
- Wi-Fi in your own products and access points
- 2.4, 5 and 6 GHz (Wi-Fi 6E and Wi-Fi 7)
- Rogue access points and evil-twin setups
- The defences that matter, verified: Protected Management Frames (802.11w), WPA3-SAE without downgrade, enterprise EAP server-certificate validation, and OWE for open networks.
- The Wi-Fi stack and drivers in devices and access points: we hunt for the bugs an attacker could use over the air to crash or take them over
How to work with us
Trainings on this subject
All trainings
Two days on current Wi-Fi assessment techniques, replacing outdated methods. You start with the basics of old and new attacks, then apply them against an organisation as in a red team engagement, based on our recent work.
Talk to us about your project
We scope the work in a first call, then send a fixed-price proposal: intrusion tests, vulnerability research, fuzzing, test benches, trainings. Offices near Paris, Monday to Friday, 9:00 to 19:00.