Core Technologies

• The first technology to understand is WLAN technology

• There are two types of scanners

• Active scanners rely on the SSID broadcast beacon

• Passive scanners utilize monitor mode (rfmon) and can identify cloaked access points

• There are four primary types of encryption used on wireless networks

  1. Wired Equivalent Privacy (WEP) encryption

  2. WiFi Protected Access (WPA/WPA2) encryption

  3. Extensible Authentication Protocol (EAP)

  4. Virtual Private Networking (VPN)

• There are attack mechanisms against each type of encryption used on wireless networks

  1. WEP is vulnerable to FMS attacks and chopping attacks

  2. WPA is vulnerable to dictionary attacks.

  3. Cisco s LEAP is vulnerable to dictionary attacks

  4. VPNs are usually not directly vulnerable, but can be compromised using indirect means

Open Source Tools

• Footprinting tools

• GPSMap is a tool, included with Kismet, that is perfect for determining the wireless footprint of your target organization.

• Intelligence gathering tools

• Just like on any penetration test, Internet search engine queries and USENET newsgroup searches are perfect for intelligence gathering.

• Scanning tools

• There are two WLAN scanning tools included with Auditor.

  1. Wellenreiter

  2. Kismet

• Enumeration tools

• Due to its ability to determine associated client information, Kismet is the perfect wireless enumeration tool for penetration testers.

• Vulnerability assessment tools

  1. Determining the encryption type is one of the best ways to ascertain the vulnerability status of a wireless network. Auditor provides two tools that are perfect for this.

  2. Kismet shows the strength of encryption in use.

  3. Since Kismet isn t always accurate in determining WPA, Ethereal can be used to determine...