Penetration Testing Hub › Penetration Testing Explained

WiFi Penetration Testing: How to Test Your Wireless Network

Your Wi-Fi is the one part of your network an attacker can reach from the car park, the café next door, or a drone on the roof. They don't need to get past reception. This page shows how a tester actually assesses a wireless network, what you can safely check yourself first, what to expect if you bring in a professional, and where DIY should stop.

No sales pitch. If you work through this and still want help, that's the end of the page, not the start of it.

1. How it's done

A wireless assessment follows a predictable arc. Here's the real method, in order.

Reconnaissance — survey the airspace

The tester surveys the radio environment: every SSID and its BSSID (the AP's MAC), the encryption in use, the channels, and crucially how far each network reaches beyond your walls. A network that's perfectly secure at your desk but blasts at full power into the street is a bigger target than you think. Tools that do this: a wireless adapter capable of monitor mode, plus Kismet or airodump-ng for discovery, and a spectrum view to spot interference and hidden networks.

Identify the weak points

With the map drawn, the tester looks for the usual failings: WEP or open networks (still surprisingly common on old kit), WPA2 with a shared password (PSK) on a business network, WPS left enabled, default admin credentials on the access point itself, and guest SSIDs that can somehow reach the internal network.

Controlled testing

This is where care matters. For a PSK network, a tester captures the four-way handshake and tests the password's strength offline — never by hammering the live network. They check for rogue or 'evil-twin' access points impersonating your SSID to harvest credentials, and they verify client isolation (can one guest device see another?). The detail of how a handshake capture works lives in our Hack Log; the point here is that it's done offline and off to one side, not by disrupting your users.

What it usually finds

In real Irish environments the recurring findings are: a weak or guessable pre-shared key (a company name, a phone number, an address), a forgotten open 'setup' or 'printer' SSID nobody remembers enabling, guest Wi-Fi that can route to internal VLANs, and an access point still running its factory admin password. None of these are exotic. All of them are car-park-reachable.

2. What to look for — the self-check

You can run this on your own wireless estate today, before anyone is hired. Tick what's true:

• No WEP or open SSIDs anywhere on the estate.
• Business SSIDs use WPA3, or WPA2-Enterprise (802.1X) with individual logins — not one shared password.
• Any WPA2-PSK key is long and random, not a company name, postcode or phone number.
• WPS is disabled on every access point.
• AP admin passwords have been changed from the default.
• The guest network is genuinely isolated and cannot reach internal VLANs or management interfaces.
• No unexpected SSIDs are broadcasting your organisation's name.
• Firmware is up to date on every access point.
• Management interfaces are not reachable from the guest or client VLAN.

3. What to expect if you hire out

Scoping questions you'll be asked: how many sites and access points, which SSIDs are in scope, whether an on-site visit is needed (wireless testing usually needs someone physically present, or a small device shipped to the site), and what must not be disrupted.

Access to prepare: a point of contact, a list or map of SSIDs and their locations, and — if client-side testing might briefly drop connections — an agreed maintenance window.

Duration: a single-site wireless test is often two to four days including reporting. Multiple sites scale from there.

Production risk: low when scoped properly, but handshake capture and any deauthentication-style testing can briefly interrupt clients, so they're timed for quiet periods and agreed in advance.

The report: findings by severity, reproduction steps, and prioritised fixes — plus a re-test once you've remediated. See our sample report to know exactly what lands on your desk.

4. When you need a pro

Here's where safe DIY stops. Cracking a captured handshake, running deauthentication or evil-twin attacks against live users, and properly testing 802.1X / RADIUS with certificate validation are all things that can knock staff or production devices offline, or stray into legally and technically risky territory. If your Wi-Fi carries payment data, connects OT equipment, or reaches anything sensitive — or if you want 802.1X tested properly — that's a professional engagement with a rollback plan, not a weekend experiment.

This page is educational and not legal advice. Only test systems you own or are explicitly authorised to test.  ·  ↑ Back to top