Study guide
16.1 Wireless Attacks and Tools
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
16.1 Wireless Attacks and Tools
Key Takeaways Explain This Topic AI
Domain 4 Attacks and Exploits is 35 percent of PT0-003; objective 4.7 is performing a wireless attack with the matching tool, not reprinting a 2.2 SSID inventory and not a cracking cookbook.
Wireless tests need explicit rules of engagement that name SSIDs, the RF window, and allowed techniques; signal jamming is often illegal and frequently out of scope.
An evil twin clones a legitimate SSID; deauthentication forces a reconnect so clients may join the twin; a captive portal on that rogue AP is how credentials get harvested.
A WPS PIN attack abuses a Wi-Fi Protected Setup protocol weakness; the exam-correct control is WPS disabled on production access points.
WPAD is a proxy-auto-discovery path; WiFi-Pumpkin is a rogue-AP and captive-portal framework; Aircrack-ng is capture, inject, and deauth; WiGLE.net is the wardrive map; InSSIDer is a local SSID/channel GUI; Kismet is a passive wireless sniffer.
Last updated: August 2026
Domain 4, Attacks and Exploits , is 35 percent of CompTIA PenTest+ PT0-003. Objective 4.7 — Given a scenario, perform wireless attacks using the appropriate tools — is the radio matching drill. Objective 2.2 already inventoried service set identifiers (SSIDs), hidden networks, associated clients, and encryption type. Objective 2.4 already matched WiGLE.net , InSSIDer , and Aircrack-ng as identification and capture tools. 4.7 is using the air: wardriving , evil twin , signal jamming , protocol fuzzing , packet crafting , deauthentication , captive portal , and Wi-Fi Protected Setup (WPS) PIN attacks, plus the named tools WPAD , WiFi-Pumpkin , Aircrack-ng , WiGLE.net , InSSIDer , and Kismet .
Wireless work is not implied by a network Classless Inter-Domain Routing (CIDR) range in the statement of work (SoW). The rules of engagement (RoE) must name the SSID , the building or radio-frequency (RF) window, and the techniques that are allowed. A tester who stands up an evil twin because they heard CORP-WIFI from the parking lot has left scope. Signal jamming is worse: in the United States and many other jurisdictions, willful RF interference is often illegal , and even authorized wireless tests frequently leave jamming out of scope . Exam trap: treating a successful jam as a penetration-test finding. It can be a crime.
Wardriving: map access points, do not crack them
Wardriving is collecting wireless access-point (AP) observations while moving — historically a car, now also a walk, a bicycle, or another path the RoE named. You record SSID , BSSID (the AP media-access-control address), channel, encryption, and GPS. What it does: it maps where radios live. When you pick it: the stem is a drive-by or campus walk that produces a map of APs, not a deauthentication flood and not a rogue portal.
WiGLE.net is the public historical wardrive database: SSID, BSSID, and GPS observations other people (and you, if you uploaded) already collected. On 2.4 , WiGLE was a reconnaissance index. On 4.7 , wardriving is the activity and WiGLE is still the map you query or contribute to. Exam trap: treating every WiGLE hit as in-scope. A neighbor's guest network in the same parking garage is not yours because the database plotted it. Trap two: treating wardriving as handshake cracking. Mapping is not a wordlist job, and this guide will not treat it as one.
Evil twin versus the legitimate AP
An evil twin is a rogue AP that clones the SSID (and often the look of the BSSID) of a legitimate AP so clients prefer the twin. What it does: stations associate to you instead of to corporate infrastructure. When you pick it: the stem shows a second AP advertising CORP-WIFI or CORP-GUEST that the client joined, especially when the tester also controls a captive portal on that AP.
Clients choose APs by advertised name and signal, not by a cryptographic proof that the AP is the real one — unless enterprise 802.1X is in use and the client actually validates the authentication-server certificate. Open and pre-shared-key networks are easy twins. Enterprise networks still twin when users click through a certificate warning or when a helper SSID is open.
Exam trap: calling every unauthorized AP an evil twin. A misconfigured lab AP with a unique SSID is a rogue, but the twin is the clone of a legit SSID. Trap two: standing up a twin without RF scope. The SoW for 10.4.0.0/16 does not authorize a rogue AP.
Deauthentication: force the reconnect
Deauthentication (and related disassociation) is an 802.11 management-frame attack that tells a client, or the AP, that the session is over. What it does: the station drops and then reconnects . Testers use that reconnect for two exam-visible reasons: the client may land on the evil twin (stronger signal, same SSID), or the tester may observe the next association on the real SSID. When you pick it: the stem says clients were kicked, then they joined the rogue AP, or the test needed them to reassociate.
Deauth is not signal jamming. Jamming is noise across a band. Deauth is a spoofed management frame . Aircrack-ng is the 4.7 suite that includes injection and deauth-family utilities; you do not need a command recipe, and this guide will not give one. Exam trap: treating deauth as implied by wireless enumeration. 2.2 listed the SSID. 4.7 deauth is an attack and needs the RoE to name it. Trap two: treating deauth as a WPS PIN method. They are different bullets.
Captive portal on a rogue AP
A captive portal is the splash or login page a guest network throws before it grants a path to the Internet — hotel Wi-Fi, airport Wi-Fi, CORP-GUEST . On 4.7, the interesting portal is the one the tester serves on an evil twin : it looks like the corporate or guest login and harvests credentials (or anything users are willing to type). When you pick it: the stem pairs a rogue AP with a fake login page. WiFi-Pumpkin is the named rogue-AP / captive-portal framework. Exam trap: treating every hotel portal as 4.7. The attack is the portal on your twin. Trap two: calling the portal cross-site scripting (objective 4.5). It is social-engineering-adjacent credential collection on a wireless path.
Signal jamming: usually illegal, usually out of scope
Signal jamming is RF denial of service : a transmitter that overwhelms a channel or band so legitimate 802.11 (or other radios) cannot be decoded. What it does: nobody talks. When you pick it: the stem is noise, a jammer, or "the band went unusable," not a deauth reason code. When you do not: almost every professional engagement. Jamming is often illegal (in the U.S., the Federal Communications Commission treats willful interference harshly) and frequently carved out of RoE even when evil twins are allowed. Exam-correct behavior: recognize the term, refuse it when the RoE is silent, and never treat a jam as a clever finding. Trap: "jamming is just loud deauth." Deauth is frames; jamming is energy.
Protocol fuzzing and wireless packet crafting
Protocol fuzzing on 4.7 sends malformed or unexpected 802.11 (or related wireless management and control) fields to see whether an AP, driver, or client crashes or mis-parses. What it does: it tests the parser , not a pre-shared key. When you pick it: the stem is a crash, a reboot, or a weird information-element after unusual frames.
Packet crafting on 4.7 is building custom 802.11 frames — unusual subtype, flags, or tags — not the objective 4.2 Internet Protocol / Transmission Control Protocol / virtual-LAN crafter, and not msfvenom payload generation. When you pick it: you need a wireless frame a stock client would not send. Aircrack-ng (injection) is the 4.7 family; later specialized-system objectives name other crafters for other radios. Exam trap: answering 4.2 Impacket or Hydra for an 802.11 frame. Trap two: treating fuzzing as a WPS PIN attack. PIN is a protocol design weakness, not a crash.
WPS PIN: a protocol weakness, not a wordlist
Wi-Fi Protected Setup (WPS) was meant to let a user join with an 8-digit personal identification number (PIN) or a push button instead of typing a pre-shared key. The PIN design is a protocol weakness : the AP's WPS implementation historically allowed the PIN to be validated in halves , which collapses the search space. What the exam wants: identify WPS PIN attack when the stem shows WPS still enabled on a registrar, and recommend WPS off . WPS should be disabled on production APs. When you pick it: WPS is on, a PIN registrar is advertised, and the question is the wireless attack type . When you do not: WPA3-Enterprise with WPS off; a 4.3 cracking stem; a 2.2 encryption-type inventory with no attack.
This guide will not walk a PIN brute-force or name a cracking wordlist as a how-to. Conceptual identification is enough. Exam trap: treating WPS PIN as "the same as WPA2-PSK cracking." Different bullets. Trap two: treating WPS as a feature you should leave on for ease of testing. The control is off .
4.7 tool matching
WPAD is Web Proxy Auto-Discovery , listed on 4.7 as a tool even though it is a protocol and attack path . Windows (and some other) clients search DHCP or DNS for wpad / wpad.dat and then send web traffic through that proxy. If the tester can answer WPAD — rogue DHCP on a twin, a poisoned name, or a writable wpad record — they become the web proxy and sit on-path for HTTP. When you pick it: auto-proxy, wpad.dat , or "the laptop fetched a proxy script from the tester." It is not Kismet and not a captive-portal HTML form, though a twin can serve both.
WiFi-Pumpkin is a rogue AP / evil-twin / captive-portal framework. When you pick it: you need to stand up the twin and the splash page as one kit.
Aircrack-ng is the capture, inject, and deauth-family suite . On 2.4 it identified and captured. On 4.7 it is still the suite when the stem is injection, deauthentication, or 802.11 capture. It is not a social-engineering toolkit and not a wordlist tutorial in this chapter.
WiGLE.net is the wardrive map . InSSIDer is a local graphical interface for SSIDs, channels, and signal strength (site-survey style). Kismet is a passive wireless sniffer and wireless intrusion-detection system: it finds hidden SSIDs, logs GPS for wardrives, and does not need to associate. When you pick Kismet: passive RF inventory or hidden-net detection. When you pick InSSIDer: a laptop GUI of nearby APs and channels. Exam trap: Kismet as the evil-twin framework (that is WiFi-Pumpkin). Trap two: InSSIDer as the public historical map (that is WiGLE).
Attack or tool What it does When you pick it Exam trap
Wardriving Map APs while moving (SSID, BSSID, GPS) Drive or walk RF survey Not handshake cracking; not a neighbor's SSID
Evil twin Rogue AP clones a legit SSID Clients join the tester's AP Not every rogue name is a twin
Deauthentication Management frames force a drop and reconnect Kick, then twin or reassociate Not jamming; not implied by 2.2 inventory
Captive portal Splash or login on a (often rogue) AP Fake guest or corporate login page Not 4.5 cross-site scripting
- Signal jamming RF energy denial of service Band unusable from noise Often illegal and out of scope
- Protocol fuzzing Malformed 802.11 to crash or misparse AP or driver crash Not WPS PIN
- Packet crafting Custom 802.11 frames Unusual wireless frame Not 4.2 Impacket; not msfvenom
- WPS PIN Abuse WPS PIN protocol weakness WPS still enabled Turn WPS off ; not a wordlist how-to
- WPAD Proxy auto-discovery path to on-path web wpad.dat or auto-proxy Not a sniffer GUI
- WiFi-Pumpkin Rogue AP plus portal framework Twin and splash kit Not WiGLE
- Aircrack-ng Capture, inject, and deauth suite 802.11 inject or capture Not the Social Engineering Toolkit
- WiGLE.net Historical wardrive database SSID, BSSID, GPS map Not the local channel GUI
- InSSIDer Local SSID, channel, and signal GUI Campus survey laptop Not the public map
- Kismet Passive sniffer and wireless IDS Hidden SSID, passive log Not the twin framework
- Worked campus RF
The RoE names CORP-WIFI (WPA2-Enterprise) and CORP-GUEST (open plus portal) on the headquarters building for a Saturday window. A walk that logs BSSID and GPS is wardriving ; checking WiGLE for the same BSSIDs is the map. An extra AP advertising CORP-GUEST that serves a fake Microsoft login is an evil twin plus captive portal — WiFi-Pumpkin if the stem wants the framework. Clients that drop and then join the twin after management frames are deauthentication , conceptually in the Aircrack-ng family. A conference-room AP still has WPS on — that is a WPS PIN finding; the remediation is WPS off , not a cracking cookbook. Laptops that fetched wpad.dat from the twin are WPAD . Kismet passively sees a hidden SSID the GUI missed; InSSIDer shows channel overlap in the boardroom. Nobody jams the band: jamming is out of scope and likely illegal . Sequence on the exam: confirm RF RoE, name the attack type, then pick the tool family.