OffSec Wireless Professional study guide
OffSec Wireless Professional · Work through your exam, one topic at a time.
The OffSec Wireless Professional (OSWP) is a hands-on certification that, per OffSec, "demonstrates the ability to identify and exploit vulnerabilities in 802.11 networks." It is earned by passing the exam that accompanies PEN-210: Wireless Network Attacks, a Level 200 course with 480 hours of content built from 16 modules, many including videos. The credential suits penetration testers and security professionals who want to extend their skill set into wireless security policies and assessments; OffSec lists no formal prerequisites but strongly recommends comfort with the Linux command line, solid TCP/IP networking knowledge, basic 802.11 and encryption concepts, and some familiarity with standard penetration testing skills. The OffSec Wireless Professional study guide has 5 sections and about 1,974 words.
01Wireless Network Types and Architectures: 802.11 Foundations
The exam tests whether you can read a wireless network the way you read a TCP handshake: which band and channel it lives on, which frames reveal its security configuration, and how the 4-way handshake maps onto the standard. Every later attack depends on these layer-1 and layer-2 facts.
427 words, about 2 min02Reconnaissance and Traffic Capture/Analysis with Aircrack-ng, Kismet and Wireshark
This domain tests a repeatable workflow: survey the airwaves, lock onto a target, force or wait for the frames that matter, then prove in Wireshark that what you captured is actually usable. airmon-ng check kill stops NetworkManager and wpa supplicant from resetting the interface; airmon-ng start wlan0 creates a monitor interface such as wlan0mon.
382 words, about 2 min03Encryption Vulnerabilities and WPS Exploitation
Here the exam checks whether you can pick the right attack for the encryption in front of you and explain why it works - WEP keystream reuse, WPA/WPA2-PSK offline cracking, or the WPS PIN's structural weakness. WEP concatenates a 24-bit IV with the key, runs RC4, then appends a CRC32 ICV.
397 words, about 2 min04Rogue Access Points and Client Deauthentication
This domain tests the classic wireless man-in-the-middle chain: knock a client off its real AP, present a look-alike AP, and harvest credentials or traffic. A deauth is an unauthenticated management frame (subtype 12) carrying a reason code, with the source address spoofed as the AP.
393 words, about 2 min05Adapter Chipsets, Drivers and the mac80211 Framework
The exam expects you to choose hardware that can actually do the job and to diagnose why an adapter that "supports monitor mode" still refuses to inject. Monitor mode receives every frame in the air; injection transmits forged frames.
375 words, about 2 min