Contact
Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.deMon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline
Request a pentest quote Report an emergencyPenetration Testing
Your wireless network doesn’t stop at the office wall
Nobody needs access to your building to attack your Wi-Fi – a spot within radio range is enough. With wireless penetration testing, we assess encryption, authentication, guest Wi-Fi, and the separation from your internal network, and show you whether Wi-Fi access can turn into access to your systems.
Definition
Wireless penetration testing – also known as a Wi-Fi pentest – is a security assessment of your wireless networks from the perspective of an attacker within range: in the parking lot, in the stairwell, or in the office next door. We investigate whether encryption and authentication can be defeated, whether unauthorized persons can get into your internal network via guest or corporate Wi-Fi, and whether unauthorized access points undermine your security measures.
Wireless networks are a special kind of attack surface. The signal extends beyond the walls of the building – and with a directional antenna, it can be picked up from much farther away. The firewall at your internet gateway plays no role, and many attacks leave hardly any traces in conventional log files. On top of that, devices connect automatically to known network names – and may therefore also connect to a deceptively realistic cloned access point.
We test all common methods: WPA2 and WPA3-Personal with a pre-shared key or SAE, WPA2 and WPA3-Enterprise with 802.1X and EAP methods such as PEAP, EAP-TTLS, or EAP-TLS, as well as guest Wi-Fi with a captive portal. Besides controllers and access points, we also test how your clients behave, because many successful wireless attacks target laptops and smartphones rather than the infrastructure.
Methodologically, we follow OSSTMM and NIST SP 800-115 as well as the modules NET.2.1 “WLAN Operation” and NET.2.2 “WLAN Usage” from the IT-Grundschutz Compendium of the BSI (Germany’s Federal Office for Information Security). Companies that process cardholder data must also regularly search for unauthorized access points under PCI DSS 4.0.1 (Requirement 11.2). A wireless pentest shows how well your controls work in practice, and with the test certificate, you can prove to third parties that an independent assessment took place.
Our approach
A wireless network can only be tested where it transmits. That’s why we come to you – in Germany and internationally. First, we passively capture all wireless networks, access points, and clients in the frequency bands in use, identify encryption and authentication methods, and check how far your signal reaches beyond your premises.
Then we launch targeted attacks. We capture handshakes and test the strength of your pre-shared key offline, set up evil twin scenarios with our own RADIUS server, test your clients’ certificate validation, and try to get from the guest Wi-Fi into internal networks. We use disruptive techniques such as deauthentication attacks only in agreed time windows. Your neighbors’ networks, of course, remain untouched.
Common vulnerabilities
With WPA2-Personal, a captured handshake or an access point’s PMKID is enough to attack the password offline. If it’s short, guessable, or unchanged for years and known to many former employees, the network is effectively open.
If clients don’t consistently validate the RADIUS server’s certificate, they can be made to connect to an evil twin. With PEAP-MSCHAPv2, this yields challenge-response data that can be attacked offline; with EAP-TTLS and PAP, even cleartext passwords – often the users’ domain credentials.
Mixed WPA3/WPA2 operation allows downgrade attacks to the weaker method. Without Protected Management Frames (802.11w), clients can also be deliberately disconnected and redirected to a spoofed access point.
Guests can reach internal servers, printers, or the wireless controller’s web interface, or devices on the guest network can attack each other. Captive portals can also often be bypassed via MAC spoofing.
A router someone brought in and plugged into a network jack, or a forgotten test access point, bypasses your wireless security policies. Without port authentication on the switch, this creates uncontrolled access to the LAN.
Attackers run an access point with your network’s name and present a deceptively real login page. Devices searching for known networks may even connect automatically.
Default passwords, outdated firmware, enabled WPS, weak SNMP community strings, or management interfaces that are reachable from the Wi-Fi.
Printers, scanners, or IoT devices that authenticate only by their MAC address (MAC authentication bypass) are easy to impersonate – anyone who copies the MAC address gets the same network access.
Testing perspectives
A complete wireless test combines the perspectives of an outsider, a guest, and an authorized device. Depending on your goal, the perspectives can also be ordered individually.
Outsider within range
We act like someone in the parking lot who has neither a password nor a user account.
Visitors
We use the guest Wi-Fi the way visitors and external service technicians do.
Authorized device
We test with a company device or a regular user account – for example, to simulate a compromised laptop.
Process
Because we work on site, we carefully plan dates, access, and contacts in advance – otherwise, our proven approach to penetration testing applies.
We clarify sites, SSIDs, frequency bands, testing perspectives, time windows, and exclusions. You receive a fixed-price quote within 24 hours of scoping (on business days).
We passively capture all networks, access points, and clients, map the reach of your signal, and identify unauthorized devices.
We test PSK, SAE, and 802.1X, simulate evil twin attacks, and examine how your clients behave – coordinated and controlled.
From the guest and corporate Wi-Fi, we check which internal systems are reachable and how far an attacker can get from there.
You receive an executive summary, findings with CVSS ratings, and concrete configuration recommendations for controllers, RADIUS, and clients.
After you’ve made the changes, we retest the fixed vulnerabilities free of charge. After the test is complete, you also receive a test certificate.
Reporting
Our report describes every finding with evidence, a risk rating, and an actionable recommendation – from the right EAP method to certificate profiles for your clients to firewall rules between Wi-Fi and LAN. That way, your network team knows exactly what to do, and senior management knows where the security of your wireless networks stands.
Find out before someone within radio range does. We plan the test so that it disrupts your operations as little as possible.
FAQ
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
Yes, for the actual wireless tests, we need to be within range of your networks. That’s why we come to your sites – internationally, too. Individual parts, such as reviewing controller or RADIUS configurations, can also be handled remotely if needed.
WPA3 is a big step forward: SAE protects against offline attacks on the password, and Protected Management Frames are mandatory. In practice, however, WPA3 often runs in transition mode alongside WPA2, which enables downgrade attacks. With WPA3-Enterprise, correct certificate validation by the clients also remains critical.
In an evil twin attack, an attacker sets up a Wi-Fi network with the same name as your corporate or guest network. If devices connect to it, the attacker can intercept traffic, harvest login credentials via a fake portal page, or – if 802.1X is poorly configured – capture domain credentials. We test whether your clients fall for such fakes.
Yes – and we strongly recommend it, because for outsiders, the guest Wi-Fi is often the easiest way into your network. We check whether it’s cleanly separated from the corporate network, whether guests are isolated from one another, whether the captive portal can be bypassed, and whether internal systems or management interfaces are reachable.
Most tests are passive or affect only our own test devices. We use active techniques that can briefly disconnect clients, such as deauthentication attacks, only after consultation and in agreed time windows. We don’t use jammers.
A site survey determines whether your wireless network works reliably everywhere – it’s used to plan access point locations, channels, and transmit power. A wireless pentest, on the other hand, asks whether it’s secure: we actively try to overcome authentication and segmentation and demonstrate which vulnerabilities can be exploited. We also capture the reach of your signal beyond your premises as a security aspect.
Yes, as an option. We check which Bluetooth and BLE devices are visible in your environment, how they’re paired, and whether services are accessible without authentication. For your own products with a Bluetooth interface, we recommend an in-depth IoT penetration test.
As a guideline, we recommend an annual assessment. A test is also worthwhile when something fundamental changes in your wireless network – for example, when switching to WPA3 or EAP-TLS or replacing your Wi-Fi hardware. Regardless of that, searching for unauthorized access points belongs in day-to-day operations; for environments with cardholder data, PCI DSS 4.0.1 requires it at least every three months.
Tell us about your sites and networks. We’ll get back to you to arrange a no-obligation initial consultation and send you a fixed-price quote within 24 hours of scoping (on business days).
Diese Seite gibt es auch auf Deutsch.