By completing this course, learners will be able to:

• Understand IEEE 802.11 standards, wireless architectures, frames, and network interactions.
• Analyze common Wi-Fi encryption and authentication weaknesses.
• Use Linux wireless tools, drivers, and stacks for wireless security assessments.
• Capture and analyze wireless traffic using Wireshark, Aircrack-ng, Bettercap, and Kismet.
• Perform wireless reconnaissance and identify access points and connected devices.
• Assess WPS, WPA/WPA2 and WPA Enterprise security weaknesses.
• Identify and assess rogue access points and captive portal security issues.
• Understand wireless attack techniques and apply appropriate security and mitigation measures.
• Prepare for the practical OffSec Wireless Professional (OSWP) certification exam.

Module 1: IEEE 802.11 Wireless Networks

• IEEE 802.11 wireless networking standards
• Wireless network architecture
• Infrastructure and ad-hoc networks
• Wireless components and security considerations

Module 2: IEEE 802.11 Wi-Fi Encryption

• Wi-Fi encryption concepts
• WEP
• WPA
• WPA2
• Common encryption vulnerabilities

Module 3: IEEE 802.11 Linux Wireless Tools, Drivers, and Stacks

• Linux wireless networking
• Wireless tools and drivers
• mac80211 framework
• Wireless configuration, monitoring, and troubleshooting

Module 4: IEEE 802.11 Wireshark Essentials

• Wireless packet capture
• Wireshark fundamentals
• Capturing and analyzing wireless traffic
• Interpreting wireless packets and communications

Module 5: IEEE 802.11 Frames and Network Interactions

• Wireless frame structure
• Network interactions
• Wireless protocols
• Understanding wireless communications

Module 6: IEEE 802.11 Aircrack-ng Essentials

• Aircrack-ng fundamentals
• Wireless packet capture
• Wireless security assessment
• Authentication and client-related attacks

Module 7: IEEE 802.11 Cracking Authentication Hashes

• Wireless authentication hashes
• WPA/WPA2 PSKs
• Capturing authentication information
• Password and key recovery techniques

Module 8: IEEE 802.11 Attacking WPS Networks

• Wi-Fi Protected Setup
• WPS vulnerabilities
• WPS assessment techniques
• Wireless network compromise scenarios

Module 9: IEEE 802.11 Rogue Access Points

• Rogue access point risks
• Detecting unauthorized access points
• Wireless client behavior
• Rogue AP mitigation

Module 10: IEEE 802.11 Attacking WPA Enterprise

• WPA Enterprise security
• Enterprise wireless authentication
• Common weaknesses
• Wireless enterprise attack techniques

Module 11: IEEE 802.11 Attacking Captive Portals

• Captive portal architecture
• Wireless authentication restrictions
• Captive portal security weaknesses
• Assessment and bypass techniques

Module 12: Bettercap Essentials

• Bettercap installation and execution
• Wireless monitoring
• Network interaction
• Man-in-the-middle techniques
• Wireless security assessment

Module 13: Kismet Essentials

• Kismet installation and configuration
• Wireless traffic monitoring
• Detecting access points and wireless devices
• Identifying rogue and unauthorized devices

Module 14: Determining Chipsets and Drivers

• Identifying wireless chipsets
• Understanding driver requirements
• Selecting compatible wireless tools
• Identifying security considerations related to wireless hardware

Module 15: Manual Network Connections

• Manual wireless connections
• Identifying suspicious wireless behavior
• Avoiding insecure automatic connections
• Secure wireless connection configuration

Module 16: Wireless Network Security Assessment

• Applying wireless security assessment methodologies
• Identifying wireless vulnerabilities
• Understanding attack paths
• Applying appropriate defensive and mitigation measures

5 Days

PEN-210 is designed around practical wireless security exercises. The hands-on work includes:

• Setting up a suitable wireless testing environment.
• Configuring an injection-capable wireless adapter.
• Performing wireless reconnaissance.
• Identifying access points and wireless clients.
• Capturing and analyzing 802.11 traffic.
• Working with Wireshark and Aircrack-ng.
• Assessing wireless authentication and encryption.
• Practicing WPS security assessment.
• Creating and identifying rogue access points.
• Assessing WPA Enterprise environments.
• Working with captive portal scenarios.
• Using Bettercap for wireless monitoring and security testing.
• Using Kismet to monitor wireless networks and identify unauthorized devices.
• Identifying wireless chipsets and compatible drivers.
• Completing practical wireless attack scenarios in controlled environments.

Certification: OffSec Wireless Professional (OSWP)

Practical, hands-on examination

3 hours 45 minutes to complete the challenge

Additional 24 hours to submit the required documentation

Three wireless network scenarios are provided

Candidates must obtain the required wireless keys and proof files from the applicable scenarios

The exam requires submission of documentation describing the wireless keys, commands used, and steps taken to obtain the required proof.

• Penetration Testers
• Wireless Security Professionals
• Network Security Analysts
• Cybersecurity Professionals
• Network Administrators
• Security Engineers
• System Administrators
• IT Professionals responsible for wireless infrastructure security

• Comfort with the Linux command line.
• A solid understanding of TCP/IP networking.
• Basic knowledge of wireless networking and 802.11 protocols.
• Familiarity with wireless encryption concepts.
• Basic understanding of penetration testing methodologies.
• Access to a suitable wireless adapter capable of traffic injection for the home-based practical exercises.