Wireless Lab 01 — Wireless Survey Analyzer

WARMUP: Chapters 2–5 (802.11, handshake, WPA3/802.1X, evil twins).

Threat model

From the parking lot, an attacker passively captures your Wi-Fi and stands up an evil twin (your SSID, a stronger signal) to harvest traffic or credentials. The "attacker" this lab analyzes is a weak or impersonated wireless link: an open/WEP network, a WPA2-PSK with a crackable passphrase, or a rogue AP cloning a managed SSID. The engine turns a scan into posture ratings, crackability verdicts, and rogue/evil-twin findings against an approved BSSID inventory.

What you build (lab.py)

  • classify_posture(ap) → (rating, issues): open-network, wep-broken, weak-passphrase, pmkid-exposed, no-mfp; rating critical/weak/acceptable/strong.
  • crackability(ap) → trivial / offline-feasible / offline-hard / online-only / n/a-enterprise — encoding that WPA2-PSK = passphrase entropy and WPA3-SAE resists offline cracking.
  • detect_rogues(scan, approved) → evil-twin/rogue findings (known SSID on an unapproved BSSID; open clone of a managed SSID = critical).

Attack cases the tests cover

  • Open/WEP = critical + trivial; WPA2-PSK weak/PMKID = offline-feasible; WPA2-PSK strong = offline-hard; WPA3-SAE = strong + online-only; Enterprise = n/a.
  • Missing 802.11w flagged; an evil twin (SSID match, unapproved BSSID) detected; an open clone rated critical; an unknown SSID is not flagged; findings sorted by severity.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Add channel/RSSI anomaly scoring (a known SSID suddenly louder or on a new channel).
  • Flag WPA3 transition mode (downgrade-to-WPA2) and Enterprise without server-cert validation.
  • Ingest a real airodump/Kismet CSV and locate rogues by signal triangulation.

Interview / resume

"Built a Wi-Fi survey analyzer that rates AP posture, judges handshake crackability (WPA2-PSK offline vs WPA3-SAE online), and detects evil-twin/rogue APs against an approved inventory — encoding that a matching SSID proves nothing."

Limitations: analyzes scan metadata (no live capture); crackability is a category, not a time estimate; rogue detection keys on the approved-BSSID inventory.