Hacking Wireless Networks, Mobile Platforms, IoT, and OT
Hacking Wireless Networks
Standards and encryption
802.11 networks operate in 2.4 GHz (channels 1–14; 1, 6, 11 are non-overlapping), 5 GHz, and 6 GHz. Encryption evolution: WEP (RC4 with a short IV and CRC32 integrity - broken, crackable in minutes from IV collection), WPA (TKIP, still RC4), WPA2 (CCMP/AES, robust but vulnerable to handshake capture and offline dictionary attack), and WPA3 (SAE/dragonfly handshake, GCMP, forward secrecy). WPA2-Enterprise adds 802.1X/EAP with a RADIUS server, so there is no shared passphrase to crack - the target becomes the credential exchange.
Attacks
WEP cracking (IV collection with aireplay-ng, then aircrack-ng), WPA/WPA2 4-way handshake capture followed by an offline dictionary/rainbow attack, PMKID capture (no client needed), WPS PIN brute force and Pixie Dust, deauthentication to force reconnection (also enables handshake capture), evil twin / rogue AP, MITM, KRACK (key reinstallation), and reconnaissance via war driving/war chalking. Bluetooth attacks: bluejacking (unsolicited messages), bluesnarfing (data theft), bluebugging (control), and bluesmashing.
Tooling
Airmon-ng (monitor mode), airodump-ng (capture), aireplay-ng (injection/deauth), aircrack-ng (crack), Reaver and Bully (WPS), Kismet, Wifite, and Wireshark for analysis.
Traps
MAC filtering and SSID hiding are obscurity, not security; they are trivially bypassed. WPA2-Personal with a strong passphrase resists dictionary attacks even if the handshake is captured - capture is not compromise. Monitor mode is required for capture; managed mode is not enough.
Worked example
You capture a 4-way handshake for a WPA2-PSK network. Rule of thumb: the handshake is only a candidate, so feed it to aircrack-ng against a wordlist; a long random passphrase means the attack fails and you should report the finding as "capture possible" rather than "network cracked."
Mobile Platforms, IoT, and OT
Mobile
Android isolates apps in a sandbox with a unique UID; rooting removes that boundary. Understand the APK layout (AndroidManifest.xml, classes.dex, resources, signature), and tools: apktool (decode/rebuild resources), jadx/dex2jar (decompile), Frida (runtime hooking), MobSF (automated analysis), drozer (attack surface), and ADB for device interaction. iOS jailbreaking removes code-signing restrictions and exposes the filesystem and keychain.
Mobile risks mirror the OWASP MASVS/MASTG: insecure data storage, weak cryptography, insecure communication, insecure authentication, improper platform usage, code quality, anti-tampering, and resilience. Enterprise controls are MDM, containerization, BYOD policy, and app vetting, not just antivirus.
IoT
The three-tier model is perception/sensing → network → application. Protocols: MQTT (1883 plaintext, 8883 TLS), CoAP (UDP 5683, DTLS 5684), Zigbee, Z-Wave, BLE, and LoRaWAN. Typical flaws: default and hardcoded credentials, no update mechanism, unencrypted traffic, and exposed management interfaces - the ingredients of the Mirai botnet. Hardware attacks use UART, JTAG, and SPI; firmware is analyzed with binwalk and strings.
OT/ICS
OT environments use PLC, RTU, HMI, SCADA, historians, and safety instrumented systems, mapped by the Purdue model (levels 0–5). Protocols include Modbus (502), DNP3, and Profinet, most with no authentication or encryption. IT/OT convergence removes air gaps; Stuxnet (centrifuges) and TRITON (safety systems) are the canonical case studies.
Traps
Aggressive scanning can crash fragile OT devices - passive monitoring and change control come first. Rooting/jailbreaking is a precondition for many mobile attacks, not a finding by itself.
Worked example
A device exposes MQTT on 1883 with no credentials. Rule of thumb: 1883 plaintext plus anonymous subscribe equals full telemetry and often command injection - subscribe to # to see all topics before reporting.