Wireless Pentesting with Purpose

#pentest #security #wireless #rf

Part 5 of 6: Attack Surface, Wireless Security, Pentest.

Everything up to this point, including OSINT, social engineering/proximity testing and threat modelling using DFDs and STRIDE, has produced a set of specific, prioritised hypotheses. This week is where they are tested using free and open-source software together with widely available wireless hardware. The distinction matters: this isn’t a generic tool walkthrough; each test is selected to validate what the threat model has already identified.

The model from last week extended beyond Wi-Fi, so validation now follows those same wireless layers: cellular, Wi-Fi, BLE and wider RF.

The examples below are not intended as an exhaustive list. They are grouped by technology for simplicity; in a real engagement, the exact toolset would be determined by the testing objectives, target environment and authorised scope.

Cellular

LTE Cell Scanner — establishes a starting point for passive cellular assessment by identifying nearby cells and their broadcast characteristics. Potential indicators of a rogue cell or cell-site simulator (IMSI catcher) include an unexpected or missing Cell ID (CID), unusually high received signal power (RXPWR) relative to neighbouring cells, unexpected frequency or channel use, and parameters inconsistent with the known local cellular environment. None is conclusive on its own. Establishing a local footprint should therefore be considered before treating any anomaly as significant.

Image 1: LTE Cell Scanner output showing detected cells and associated broadcast parameters.

Wi-Fi

Kismet — maps nearby access points and clients during Wi-Fi discovery, helping establish what is visible from the tester’s position and whether any AP appears inconsistent with the expected environment. This helps frame the spoofing hypothesis for further testing.

Wireshark — helps examine beacon and Robust Security Network (RSN) information during passive reconnaissance, establishing how protections such as Management Frame Protection (MFP) are configured.

Image 2: Wireshark screenshot showing RSN capabilities with MFP neither capable nor required, leaving deauthentication and disassociation management frames more susceptible to spoofing.

Aircrack-ng suite — supports wireless traffic capture, deauthentication testing and key recovery during active validation. This helps test hypotheses around management-frame exposure, authentication-material capture and wireless credential strength identified during threat modelling.

Image 3: Aircrack-ng successfully recovering a Wi-Fi passphrase from captured authentication traffic.

hcxdumptool / hcxtools — support targeted capture and processing of PMKID and handshake material, helping validate hypotheses around exposed authentication exchanges.

Wifite — automates several of the techniques above, helping apply consistent, repeatable checks across multiple access points during an engagement.

Bettercap — enables MITM testing and network reconnaissance once initial wireless access has been achieved. This helps determine what the foothold makes accessible, how far that access can extend and what additional risk it may expose.

Bluetooth / BLE

nRF Connect — inspects exposed BLE GATT services and characteristics, helping establish what a nearby device makes available before deeper testing begins.

Image 4: Annotated BLE UART capture showing a password transmitted in plaintext. The traffic was captured with the Nordic nRF Sniffer and analysed in Wireshark as part of IntSpired’s Bluetooth Exposure – Part 2 testing.

GATTacker — tests BLE pairing and MITM/tampering hypotheses identified during threat modelling.

RF / SDR

SDR + GNU Radio — captures and examines sub-GHz signals from IoT devices, key fobs and other non-Wi-Fi/BLE technologies identified through OSINT, helping determine which transmissions warrant closer examination.

Image 5: GNU Radio flowgraph using HackRF for 433 MHz RF monitoring and FFT-based spectrum analysis.

Universal Radio Hacker (URH) — takes captured RF signals into deeper protocol analysis, helping examine modulation, packet structure and unknown wireless protocols.

Inspectrum — provides detailed visual analysis of captured IQ data, making repeated transmissions, frequency offsets and timing structure easier to identify and measure.

Image 6: Repeated sub-GHz RF transmissions captured with HackRF and analysed in Inspectrum.

Mapping back to the model

The logic is the same in each case: the threat model defines the relevant attack path and trust boundary, from which a testable hypothesis is formed. The appropriate test is then selected, and the result either confirms, disproves or refines that hypothesis. The examples below show this mapping rather than treating each finding as a standalone result:

Example wireless pentest validation sheet

Image 7: Pentest validation sheet linking trust boundaries and attack paths to threat-model hypotheses, test tools and validation outcomes.

This is the difference between a wireless pentest that produces a list of incidental findings and one that directly answers the questions raised by the threat model.

Why this matters

Access to tooling is rarely the limiting factor in wireless testing. Much of the software used here is free and open source, while capable SDR hardware is widely available. The real differentiator is process: testing without a model can produce findings without context or priority, while modelling without validation leaves assumptions unproven. Used together, each stage turns the previous one into something more actionable.

Next week closes the series by following a confirmed wireless foothold beyond the wireless layer and examining where it can lead across the wider infrastructure.

Need your wireless hypotheses validated, not just scanned?

Speak to IntSpired®