Wi-Fi at 2.4/5/6 GHz connects nearly everything. This page gives a concise field guide:
signal basics, common research workflows (in a lab), defenses, FAQs, and devices that excel at Wi-Fi testing.
Quick-start checklist
Permission & scope: Only test networks you own or have explicit written authorization to assess.
Define goals: Recon only? Lab capture of handshakes? Evil Twin UX testing? Keep it scoped and safe.
Pick band & channels: 2.4 GHz (crowded, long range), 5 GHz (cleaner), 6 GHz (Wi-Fi 6E; reduced legacy noise).
Tooling ready: One recon/sniffer radio + (optionally) a second for AP/attack simulations in a lab.
Wi-Fi is IEEE 802.11. Devices exchange management frames (beacons, probe req/resp, auth/assoc),
control frames (RTS/CTS/ACK), and data frames (payload). Security layers
(WPA2/WPA3) live above association.
Bands & channels: 2.4 GHz (1–14), 5 GHz (36–165), 6 GHz (low/high 6E ranges). Channel width
affects throughput and interference—don’t over-bond in noisy environments.
Association precedes encryption; the 4-way handshake derives session keys for WPA2/WPA3-SAE.
Common research workflows
1) Recon & channel planning (passive)
Scan bands to inventory APs, SSIDs (open/secured/hidden), and clients; record RSSI and capabilities (11n/ac/ax; WPA versions).
For WPA2-PSK: passively wait for client re-assoc, or in a lab, trigger deauth on your own client to force a new 4-way handshake.
Validate capture by checking MICs and replay counters; store PCAPs with metadata (SSID, channel, time).
3) Evil Twin / captive portal UX testing (lab)
Clone SSID/BSSID/channel in an isolated lab. Present a portal for awareness training or UX resilience testing.
Measure client behavior: auto-join? certificate warnings? HSTS blocks? Only perform on your test clients.
4) PMKID capture (WPA2-PSK, lab)
In certain setups, capture PMKIDs from the AP without client interaction. Lab-only and with authorization.
5) 6 GHz & WPA3-SAE behavior
Test client/AP compatibility, transition modes, and roaming. Validate protected management frames (PMF) policies.
Ethics: Deauth, Evil Twin, and credential harvesting must be performed in a controlled lab or explicit engagement scope. Do not touch networks you don’t own or control.
WPA2/WPA3 lab notes
WPA2-PSK: 4-way handshake produces PTK; captures can be used to verify password strength (on test networks only).
WPA3-SAE: Uses Dragonfly handshake; offline guessing is harder. Verify correct SAE groups and PMF enforcement.
Enterprise (802.1X/EAP): Focus on certificate validation, EAP method choice, server config, client profiles, and downgrade resistance.
PMF (802.11w): Mitigates some management-frame abuse. Ensure “required” on sensitive SSIDs when clients permit.
Blue-team & hardening
Strong auth: Prefer WPA3-SAE (or 802.1X) with PMF=required where client base supports it.
RF hygiene: Plan non-overlapping channels; right-size channel widths; avoid excessive transmit power that bleeds beyond premises.
Rogue AP detection: Monitor for BSSID/SSID spoofing, sudden deauth patterns, or unexpected 6 GHz beacons.
Client policy: Disable auto-join to open networks; enforce cert pinning on enterprise; use DNS filtering and HSTS everywhere.
Segmentation: Separate guest/IoT from corporate; egress controls; rate-limit onboarding portals.
