Wireless and Mobile Security Testing
Wireless and Mobile Security Testing
This domain tests WLAN, Bluetooth, and mobile application security. You need to know the handshake and pairing mechanics, the limits of each attack, and how mobile testing differs from web testing.
Core rules and concepts
- WLAN: WPA2-PSK uses a 4-way handshake; capturing it enables offline guessing, not on-line brute force. PMKID capture can avoid waiting for a client. WPA3 uses SAE and resists offline dictionary attacks.
- Attacks: deauthentication to force reconnection, evil twin and rogue AP, captive portal phishing, WPS weaknesses. Deauth is disruptive and must be authorized and time-boxed.
- Bluetooth/BLE: pairing modes, just-works pairing, replay, and unauthorized GATT access.
- Mobile: static analysis of the package, permissions, exported components, hardcoded secrets; dynamic analysis with instrumentation such as Frida. OWASP MASVS/MSTG are the reference checklists.
- Test SSL/TLS pinning, root/jailbreak detection, insecure storage, IPC, deep links, WebViews, and backend API authorization.
- Use test devices and sanitized data; do not retain real user information.
Worked example
An authorized WLAN test captures a WPA2 4-way handshake from an in-scope access point. The tester cracks it offline with a wordlist, finds the passphrase, and reports weak password policy. During a mobile test, the app blocks a proxy due to certificate pinning; Frida disables pinning on a test build, revealing an API that returns another user's profile. The report separates the wireless weakness from the API authorization flaw and recommends unique credentials and server-side object-level checks.
Traps that cost marks
- Claiming WPA3 is crackable with the same offline handshake attack.
- Running deauth attacks without approval or outside a test window.
- Confusing a captured handshake with a cracked key.
- Testing only the mobile app and ignoring its backend API.
- Using production user data or retaining it after the test.