In this lesson,
we'll focus on the process
of enumerating wireless devices,
an important part of pentesting
that helps identify potential vulnerabilities
in an organization's wireless infrastructure.
This process involves scanning
for wireless access points,
also called WAPs,
analyzing the configurations,
and then understanding
the surrounding network environment.
We'll explore the concept of war driving
using tools like WiGLE,
and amplifying Wi-Fi signals
to enhance testing accuracy.
First, let's discuss the concept of war driving.
War driving involves actively searching for
open or unsecured wireless access points
by moving through different areas with a laptop,
smartphone, or other wireless-enabled devices.
This method allows pentesters
or attackers to discover WAPs
that might not be visible
from a single location.
Since wireless networks can extend
beyond the physical boundaries of buildings,
attackers can potentially access these networks
from outside their premises.
That's why it's essential
to periodically check for open WAPs
to ensure there are no unauthorized
or misconfigured devices on the network.
When conducting a war driving exercise,
pentesters use tools like Aircrack-ng, Kismet,
or Wifite to scan for open and unsecured WAPs.
These tools can capture packets,
identify SSIDs,
also known as Service Set Identifiers,
and gather detailed information
about the detected networks.
Also, running packet analysis software
during the scan can help save
and analyze the collected data,
providing deeper insights
into the network's security posture.
One good website for mapping
and identifying wireless networks
is the Wireless Geographical Logging Engine or WiGLE.
WiGLE is an online service
that maps and indexes access points,
making it an excellent tool for reconnaissance.
After creating an account on WiGLE,
testers can enter specific locations,
choose date ranges,
and filter for certain types of access points,
such as those labeled "Possible Freenet."
Each dot on the WiGLE map
represents an access point.
The testers can zoom in
to obtain detailed information about these points,
including whether or not they're open or secured.
To use WiGLE effectively,
testers should: enter a location,
such as a city or a specific address,
choose an appropriate date range,
select a filter option, like "Possible Freenet,"
to identify open access points.
WiGLE also offers different viewing modes,
including Standard, Satellite, Nightvision,
Greyscale, and Hybrid,
allowing testers to visualize the physical locations
and surrounding landmarks of the access points.
In addition to mapping wireless networks,
amplifying the Wi-Fi signal
can significantly enhance the accuracy
and range of wireless scanning.
Wi-Fi signal strength
and different antenna designs
offer various levels of signal coverage.
For example, a high-gain antenna,
such as an 11dBi antenna, can be used
for a long-range reconnaissance,
while a lower-gain antenna,
like a 5dBi antenna,
might be more suitable for indoor environments.
Antennas can also be directional,
omni-directional, or parabolic,
each with specific coverage patterns
that can be selected
based on a specific testing requirements.
Imagine that a pentesting team needs to evaluate
the wireless security of a large campus.
They should probably use a combination
of directional and omnidirectional antennas,
so the team can thoroughly scan the area for WAPs,
ensuring that even those located in hidden corners
or behind obstacles are detected.
The information gathered
can then be looked at to identify
unsecured or misconfigured access points,
rogue devices,
and any potential vulnerabilities
in a wireless network.
So, remember,
enumerating wireless devices is a key step
in assessing the security
of an organization's wireless infrastructure.
From my experience,
this process is usually omitted from the contract
since their primary concern today
is surrounding cloud
and network-based vulnerabilities,
and a lot of companies allow
hybrid and fully remote work,
but it is still useful to understand
to have a well-rounded foundation.
By doing things like war driving,
using tools like WiGLE,
and optimizing signal strength
with the right antennas,
pentesters can gather
most of the information they need
about the target's wireless access points.
This information is essential
for identifying security gaps
and strengthening the overall
wireless security posture,
ultimately protecting the organization
from potential wireless attacks.