They Know Where to Stand

#rfsecurity #wireless #pentest #osint

Part 2 of 6: Attack Surface, Wireless Security and OSINT.

Before an attacker reaches your building, car park or Bluetooth-enabled devices, they may already have a working picture of your wireless estate. SSIDs, BSSIDs, encryption standards, hardware vendors and approximate locations can all appear in public-source data — before anyone switches on an adapter near your site.

Why wireless OSINT gets overlooked

Most OSINT checklists focus on domains, breached credentials, employee footprints and cloud misconfigurations. Wireless rarely gets its own line, even though public sources can reveal enough detail to build a meaningful picture of a site’s wireless environment without the researcher sending a single packet.

This matters because everything found here feeds directly into the next two stages of the pipeline: it tells a social engineer what to pretend to be, and it tells a threat modeller what assets and trust boundaries may exist.

Sources worth checking

WiGLE (wigle.net) — A crowdsourced wardriving database built from years of public submissions. A search around a company address can show the density and distribution of recorded wireless activity, reveal naming patterns and help identify where further investigation may be useful. The findings still require validation, because proximity does not establish ownership.

Image 1:Recorded wireless observations across Cornwall and the South West, illustrating the density and geographic spread of publicly available data.

Much of this data is contributed by wireless enthusiasts through everyday wardriving, organised projects and community events. Once uploaded, individual observations accumulate into a persistent public record — one that may remain searchable long after a network has been renamed, replaced or decommissioned.

Image 2: A recent community wardriving leaderboard showing how large numbers of new wireless observations can be collected and contributed during a single event.

Vendor and OUI lookups — The first three octets of a conventional MAC address form its Organisationally Unique Identifier. An OUI database links that prefix to the entity that registered the address block, turning an anonymous BSSID into a vendor or technology lead. Combined with procurement records, job advertisements or technical documentation, it can help narrow the hardware families that may be present and the issues worth investigating.

Image 3: An OUI lookup tool links an observed MAC prefix to the organisation that registered it.

Exposed configuration and documentation — Search engines, code repositories and document-sharing platforms regularly surface network diagrams, access-point configuration exports and even PSKs left in installer documentation, support tickets or public GitHub repositories. This is rarely a wireless-specific leak; it is a broader OSINT hygiene problem, but the impact becomes wireless-specific once the material is found.

Job postings and supplier listings — Job advertisements mentioning specific access-point controllers, MDM platforms or a named wireless vendor tell an attacker which product line to research for known vulnerabilities, with no scanning required.

Physical and social footprint — Site photographs on social media, contractor listings and building directories can reveal physical layout, reception locations and badge or access-control systems, all of which set up the social-engineering stage that follows.

Turning OSINT into a working picture

None of this is exploitation. It is context-building. A useful output at this stage is not a vulnerability list; it is an asset and assumption sheet:

• Likely access-point vendors and approximate hardware age

• Encryption standards apparently in use

• Physical sites with a confirmed wireless presence

• Credentials, configurations or documentation already exposed

• What a rogue actor could plausibly claim to be, based on visible suppliers or contractors

Together, these findings help establish the technologies an attacker may expect to encounter, the assumptions they may build around the site — and where they may try to stand.

Why this matters

Wireless OSINT is passive, accessible and often skipped in favour of jumping straight to active testing. That is a missed opportunity in both directions: for attackers, it offers low-risk reconnaissance; for defenders, it provides an early-warning exercise requiring little more than time.

The data is already public. The only question is whether you examine it before someone else does.

Want to know what is already visible about your wireless estate?

Speak to IntSpired®.