Sally and I recently ventured to an on-site wireless engagement with a very security-mature customer. Long story short, the level of protection that WPA2 Enterprise with certificate validation provides is worth the investment. If your wireless is running just pre-shared keys and provides access to critical infrastructure, it is time to invest in full wireless PKI.

The question Sally and I tried to answer before traveling was the obvious one before any engagement: “What should we bring?” Joff, being one of the almighty seers at BHIS recommended that “…if it can wireless, bring it.”

After a couple of days spent on site, my emptied backpack ended up looking like this:

Sally’s look like so (she is way more orderly!)

So, I ended with a couple of Raspberry Pi’s, several battery packs, a couple of Ubiquiti devices, one 5GHz client and another 2.4GHz AP, another Engenius AP for testing PoE and port security (yes, this customer had all ports on lock-down too).

Full List:

3. Various antennae for use with vehicle-based and on-foot investigations of the area
   • Alfa black 1000mW / 1W 802.11g/n High Gain Adapter
   • Alfa black 7dBi RP-SMA Panel
   • Alfa gray AWUS036NH
   • Alfa gray AWUS051NH
   • Joylive Yagi wireless antenna – 2.4gHZ 802.11b/g
4. Multitude of small wifi adapters
5. Raspberry Pi all running Kali with a custom hostapd config
   • The Pi 3’s have an onboard wireless NIC, which was configured to broadcast a hidden cell for remote access
   • Another hostapd config broadcasts an 802.1X network that matched the customer’s and offers a self-signed cert for authentication
   • The Alfa Panel Antenna worked fantastic here! I could walk around and overwhelm the signal strength of the ceiling mount APs and cause clients to jump over and attempt mutual authentication. That said, no hashes were gathered in the fake EAP tunnel, due to client configuration.
6. Raspberry Pi running Kismet with an Alfa antenna and Kismet for capturing PSK handshakes
7. Hardware access point of convenience for use testing physical ports and Rogue AP countermeasures.
8. NetSpot software for the heat map.
9. Proxmark 3 RFID Cloner
10. Rubber ducky with the WLAN profile retrieval script. This was deemed to be outside the scope of our engagement.
11. Wi-Fi Pineapple
12. Portable Keyboards
13. USB Hubs; both powered and not powered
14. TP Link Wireless N Mini Router
15. Engenius EAP350
16. Portable Power Packs (to wander freely with devices); Solar Charger, 10000mAh Solar Power Bank (20 bucks on Amazon)
17. Josh Wright’s Hacking Wireless Exposedfor reference

Not pictured:

Wifi pineapple, laptops
Burner mobile device
Yagi antenna
Coffee
Jordan
Sally