Wi-fi Penetration Testing

Your wireless network extends beyond your office walls. So do the risks.

An attacker in a parking lot or adjacent building can probe your wireless infrastructure without setting foot inside. AMATAS Wi-Fi penetration testing identifies authentication weaknesses, rogue access points, and the paths attackers use to pivot from wireless into your wired network.

Wireless networks are one of the most underestimated attack surfaces in enterprise security. A misconfigured access point, a weak authentication protocol, or an unauthorized device broadcasting your SSID can give an attacker a foothold inside your network without ever touching a physical port. AMATAS Wi-Fi penetration testing covers your entire wireless infrastructure – corporate networks, guest Wi-Fi, and the rogue access points your team doesn’t know exist – using the same techniques real attackers use to gain unauthorized access and move into your wired environment.

Coverage

Full wireless infrastructure testing

We assess every layer of your wireless environment – from authentication protocols to unauthorized devices operating outside your control.

Corporate wireless networks

Security assessment of your primary corporate Wi-Fi infrastructure – testing authentication, encryption, and access control configurations.

WPA2/WPA3 Enterprise authentication testing
EAP protocol security assessment
RADIUS server configuration review
Management interface security
Encryption standard validation

Guest & public networks

Assessment of guest Wi-Fi isolation and segmentation – confirming that guest users cannot access internal systems or pivot into your corporate network.

Guest-to-corporate network isolation
Client isolation validation
Captive portal security testing
VLAN segmentation bypass attempts
Internet access control review

Rogue access point detection

Identification of unauthorized wireless devices broadcasting within range of your facilities – including evil twin attacks and unauthorized employee-deployed access points.

Unauthorized AP discovery & mapping
Evil twin AP simulation
Unauthorized bridge & repeater detection
Physical location mapping of rogue devices

Attack techniques

Wireless attack vectors we simulate

Evil twin attacks

Deploying a rogue access point that mimics your corporate SSID to intercept credentials and traffic from unsuspecting clients.

PMKID & handshake capture

Capturing authentication handshakes and PMKID hashes for offline cracking – testing the strength of your pre-shared keys.

EAP downgrade attacks

Forcing clients to authenticate using weaker EAP methods that expose credentials – common in enterprise environments using 802.1X.

Wireless-to-wired pivoting

Using wireless access as a launchpad to attack internal wired network resources – testing how far an attacker can reach from the parking lot.

Deauthentication attacks

Forcing clients to disconnect and reconnect – used to capture fresh handshakes or redirect clients to attacker-controlled access points.

KRACK & protocol exploits

Testing for known vulnerabilities in WPA2/WPA3 implementations – including key reinstallation attacks and Dragonblood vulnerabilities.

When to use it

The right moments for Wi-Fi penetration testing

Annual security assessment

Wireless infrastructure changes over time – new access points, configuration changes, and employee devices introduce new risks annually.

New office or facility

Before going live in a new location – validate that wireless infrastructure is correctly configured and no rogue devices are present.

PCI DSS compliance

PCI DSS requires wireless testing where Wi-Fi is used in or near the cardholder data environment – including rogue AP scanning.

Suspected unauthorized access

If you suspect unauthorized wireless activity or have detected an anomalous device – confirm scope and identify the source.

Compliance support

Regulatory frameworks this service supports

Wi-Fi penetration testing supports compliance with the following frameworks – particularly PCI DSS, which has specific wireless testing requirements.

FAQ

Wi-Fi penetration testing - common questions

Is Wi-Fi penetration testing still relevant if we use WPA3?

Yes – WPA3 significantly improves on WPA2, but it doesn’t eliminate wireless risk. Implementation flaws in WPA3 (such as the Dragonblood vulnerabilities), misconfigured RADIUS servers, insecure EAP methods, guest network isolation failures, and rogue access points are all relevant regardless of the encryption standard in use. Testing remains valuable to confirm your WPA3 deployment is correctly implemented – not just that the standard is enabled.

What is an evil twin attack and how is it tested?

An evil twin attack involves deploying a rogue access point that broadcasts the same SSID as your corporate network, causing client devices to connect to the attacker’s device instead of your legitimate infrastructure. Once connected, the attacker can intercept credentials and traffic. During testing, we simulate this attack in a controlled manner – confirming whether your client devices would connect to a rogue AP and whether your network monitoring would detect the unauthorized device.

We mostly work remotely - is wireless testing still relevant for us?

Yes – if your offices have wireless infrastructure connected to your corporate network, it remains a relevant attack vector regardless of how many employees work remotely. Physical proximity to your building – a parking lot, adjacent floor, or nearby street – can be enough for an attacker to probe your wireless infrastructure. For organizations with minimal office presence, we scope testing to the locations and SSIDs where wireless access represents real risk, and can advise on whether full wireless testing is a priority for your environment.

Does PCI DSS require Wi-Fi penetration testing?

Yes – PCI DSS Requirement 11.2 requires organizations to scan for unauthorized wireless access points at least quarterly, and Requirement 11.4 mandates penetration testing of wireless networks where Wi-Fi is used within or adjacent to the cardholder data environment. Our Wi-Fi penetration testing is structured to satisfy both requirements – covering authorized network assessment, rogue AP detection, and the isolation between wireless and the CDE.

Ready to test your wireless infrastructure?

Talk to our team – we’ll scope the right assessment for your locations, SSIDs, and compliance requirements.

Often combined with segmentation testing

Network Penetration Testing

Internal network testing that follows on from wireless access – showing how far an attacker can move once inside.

Network Segmentation Testing

Confirming that wireless network access cannot reach internal corporate systems or the cardholder data environment.

Firewall & Configuration Assessment

Review of the firewall rules controlling traffic between your wireless and wired network environments.