Performing Wireless Reconnaissance

As with any type of penetration test using the Cyber Kill Chain, the first stage is to gather as much information about the target as possible by performing reconnaissance. Reconnaissance in wireless penetration testing allows you to discover nearby wireless clients, wireless routers, and access points, perform fingerprinting on wireless devices, and even determine the manufacturer of an access point. By gathering information about a wireless network and its device, you can research security vulnerabilities that can help you exploit and compromise the wireless network.

The following diagram shows the Cyber Kill Chain and its stages:

Figure 14.11: Cyber Kill Chain

When performing reconnaissance on a wireless network, the penetration tester does not need to be associated with or connected to the targeted wireless network, but they do need to be within the vicinity of the target. Using a wireless network adapter that supports packet...