wireless-pentest
Skill2 starsChanged 47 days agoMITView on GitHub
Use when assessing Wi-Fi and wireless network security — WPA2/WPA3 personal and enterprise (802.1X/EAP), rogue/evil-twin access points, PMKID/handshake weaknesses, guest/segmentation issues, and management-network exposure over wireless. Covers authorized wireless assessment methodology, detection, and remediation. Authorized, on-site/scoped engagements only.
In this repository25 other files it gives its agents.
- active-directory-pentestSkill
- agentic-ai-securitySkill
- api-secure-designSkill
- api-security-auditSkill
- cicd-supplychain-securitySkill
- cloud-pentestSkill
- container-k8s-pentestSkill
- detection-engineeringSkill
- entra-cloud-pentestSkill
- iot-embedded-pentestSkill
- llm-app-defenseSkill
- llm-redteamSkill
- mobile-pentestSkill
- network-device-pentestSkill
- network-pentestSkill
- post-exploitationSkill
- privilege-escalationSkill
- recon-osintSkill
- red-team-opsSkill
- report-writingSkill
- social-engineeringSkill
- source-code-reviewSkill
- threat-modelSkill
- vuln-chainingSkill
- web-app-pentestSkill
The file
We split this skill into the rules it gives an agent
1 rule. About 0 are common, 1 is distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈1
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 26
Check EAP method and server-certificate validation on clients (misconfigured clients accept rogue RADIUS → credential theft via evil twin).
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Wireless Network Penetration Testing
Assessment of Wi-Fi and wireless network security for an authorized engagement (typically on-site or within a defined physical/RF scope).
0. Authorization gate
- Written scope: SSIDs, physical location/RF boundary, allowed active tests.
- Rules on deauth/interference (can disrupt legitimate users — often restricted).
- Client-device targeting rules; guest vs corporate scope.
1. Discovery
- Passive survey: enumerate SSIDs/BSSIDs, channels, encryption types, signal footprint, hidden networks.
- Identify WPA2 vs WPA3, Personal (PSK) vs Enterprise (802.1X/EAP), and open/guest networks.
- Map RF footprint vs building boundary (signal leaking to public areas is a finding).
2. WPA2/WPA3-Personal (PSK)
- PMKID / 4-way-handshake capture then offline analysis against a wordlist to assess passphrase strength (offline, your own capture, in scope).
- Finding pattern: weak/guessable PSK, shared PSK across sensitive networks.
- Fix: strong unique passphrases, WPA3-SAE, move sensitive access to Enterprise auth.
3. WPA2/WPA3-Enterprise (802.1X / EAP)
- Check EAP method and server-certificate validation on clients (misconfigured clients accept rogue RADIUS → credential theft via evil twin).
- Fix: enforce server-cert validation via device profiles, use strong EAP (EAP-TLS), lock down which CAs/servers clients trust.
4. Rogue & evil-twin APs
- Detect rogue APs on the corporate network; assess feasibility of evil-twin against misconfigured clients (in scope, controlled).
- Fix: wireless IDS/IPS, client hardening (cert validation), 802.1X on wired ports to stop rogue AP plug-in.
5. Segmentation & post-association
- Once associated (guest or corp), test segmentation: can guest reach corporate/management networks? Client isolation on guest?
- Fix: VLAN segmentation, client isolation on guest, firewall between wireless and sensitive zones.
6. Tooling
Wireless survey tools, aircrack-ng suite, hcxdumptool/hcxtools (PMKID), hostapd-based test APs (controlled), eaphammer/wifiphisher-style tooling for enterprise cert-validation testing (controlled, in scope), hashcat for offline passphrase analysis.
7. Reporting
Per finding: SSID/network, weakness, severity, business impact (unauthorized access / credential theft / lateral movement), remediation. Checklist: references/wireless-checklist.md.
<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.