Footprinting Tools

To successfully penetrate a wireless network, you need to understand the physical footprint of the network. How far outside of the target s facility does the wireless network reach? The easiest way to accomplish this is by using Kismet in conjunction with GPSMap s circle map functionality (see Figure 7.3).

Figure 7.3: GPSMap Circle Map Identifying a Network Range

To do this, use Kismet to locate the target WLAN. Once you have identified the target, drive around it a few times to get good signal data and four strong Global Positioning System (GPS) coordinates. Then use GPSMap to plot the signal strength of the access points that have been discovered. There are several valuable options for GPSMap. The command line to generate circle maps is:

gpsmap  r  S2  P0  e *.gps<a name="539"></a><a name="beginpage.745204DB-F4D1-4AD1-AC74-0D0DD020B365"></a>

• -r indicates that range circle maps should be generated.

• -S2 indicates that the map should be downloaded from TerraServer, which provides satellite image maps; however, there are other map servers you can use.

• -P0 indicates the opacity, or the amount of background, you can see through the map.

• -e indicates that a point should be plotted denoting the center of the network s range.

Intelligence Gathering Tools

Unlike wired penetration tests, customers often want penetration testers to locate and identify their wireless networks, especially if they have...