Wireless Network Security and Penetration Test Training

About Training

Wireless Network Security and Penetration Testing Training is a corporate training program supported by lab environments, focusing on vulnerabilities in wireless technologies and protocols used in corporate networks. It covers security weaknesses in encryption standards and provides comprehensive information on applicable methods to strengthen defenses against such attacks.

Throughout the training, participants are equipped with practical skills to apply up-to-date attack techniques using the latest software, tools, trends, and technologies targeting wireless networks.

By the end of the program, participants will have gained the knowledge to conduct WLAN security audits and understand how to prevent wireless attacks, identify potential risks, detect incidents, and collect relevant information.

The training is delivered online with lab support between 10:00 AM and 5:00 PM on weekdays, completed over 3 days, and participants receive a wet-signed Privia Security certificate of completion.

Training Content

1. Day

Introduction to Wireless Networks

Wireless Network Technologies
Definitions
- AP / Station, MAC, Frame, Beacon, SSID, BSSID, Channel Numbers, Authentication, Association, WEP, WPA, EAP, TKIP, WPA2
Types of Wireless Networks
Wireless Network IEEE Standards (802.11 Family)

Frame Structures

Beacon Frame
Probe Request Frame
Probe Response Frame
Authentication Frame
Association Request Frame
Authentication Response
Disassociation Frame
Deauthentication Frame
Reassociation Request Frame
Reassociation Response Frame
Data Frame
Control Frame

Using Wireless Networks with Linux/Windows OS

Discovering Wi-Fi Networks in the Environment
Connecting to WEP-Protected Networks
Connecting to WPA-Protected Networks

Authentication Types in Wireless Networks

Open Authentication
Shared Authentication

Wireless Network Discovery
Wireless Network Interface Operation Modes

Monitor Mode
Managed Mode
Master Mode
Ad-Hoc Mode

2. Day

Wireless Network Security Test (Wireless Pentest)

Active Discovery Techniques

- Monitoring WLAN-connected clients
- Monitoring nearby Access Points (APs)
Passive Discovery Techniques
- Revealing hidden networks (Hidden SSIDs)
- Identifying connected Wi-Fi clients
- Discovering MAC and IP addresses of clients
- Reading device characteristics of wireless equipment in the environment
Discovery Tools
- NetStumbler
- Kismet
- Wireshark
- Cain and Abel
Wireless Network Vulnerabilities
- Software and protocol vulnerabilities in wireless networks
- Hardware vulnerabilities in wireless equipment
- Attacks targeting wireless networks
- Attacks targeting wireless network users
Wireless Network Sniffing
Bypassing MAC Address Filtering
- Macchanger
- TMAC
WEP Encryption Weaknesses
Access Point (AP) Management Interface Vulnerabilities
Wireless Spoofing Techniques
- MAC Address Spoofing
- IP Spoofing
- Frame Spoofing
- Session Hijacking

3. Day

Encryption Techniques in Wireless Networks

WEP (Wired Equivalent Privacy)

- Working principle of WEP
- Encryption techniques: RC4, XOR, IV
- Interpreting WEP-encrypted traffic with Wireshark
- Discovering WEP-supported networks
- Attack methods:
  - FMS attack
  - Brute Force attack
  - Korek attack
WPA / WPA2
- Working principle of WPA
  - TKIP, HMAC, PSK structures
- Working principle of WPA2
  - CCMP, AES structures
- Methods for infiltrating WPA/WPA2 networks
- Discovering WPA/WPA2-supported networks
- Protocol analysis
- WPS structure and PIN cracking
- Capturing 4-way handshake packets
- Extracting passwords from handshake packets using:
  - Pyrit
  - Aircrack
  - John the Ripper
  - Cowpatty
  - Genpmk
Authentication Methods
- EAP/TLS, PEAP, PEAPv1, PEAPv2, TTLS, EAP-FAST, PEAP-EAP-TLS
DoS Attacks in Wireless Networks
- Tools: Aireplay-ng, mdk3, void11
- Jamming and signal interference
- DoS using deauthentication messages
Threats in Public Wi-Fi Networks
- Attacks on active users using Karmasploit
- Rogue Access Points (Fake APs)
  - Creating fake APs with airbase-ng
  - Monitoring users connected to fake APs
  - Detection methods for fake APs
Practical Applications with Aircrack-ng Suite
- Airmon-ng
- Airodump-ng
- Airbase-ng
- Airolib-ng
- Aireplay-ng
- Airserv-ng
Using Intrusion Detection Systems in Wireless Networks
- WIDS (Wireless Intrusion Detection System)
- WIPS (Wireless Intrusion Prevention System)
- Using Kismet as a WIDS
- Blocking attacks via WIPS