OffSec Wireless Professional study plan
OffSec Wireless Professional · Give each week a clear focus.
8 weeks · About 7 hours per week
Wireless network types and architectures (Wi-Fi standards, 802.11 foundations) & Wireless adapter chipset/driver identification and mac80211 framework
Explain how 802.11 frame types (management, control, data) and their subtypes map to association, authentication, and roaming behavior, and diagram the exchange for a client joining a WPA2-PSK BSS.
Distinguish infrastructure, ad hoc, mesh, and monitor-mode operation and state which modes a given adapter can support simultaneously.
Identify the chipset and driver behind at least two adapters you own using lsusb, lspci, dmesg, and ethtool, and record which monitor-mode and packet-injection capabilities each exposes.
Trace the mac80211 stack from cfg80211 down to the driver to explain where monitor mode and frame injection are enabled, and list the kernel modules involved.
Your checkpoint
A one-page reference sheet mapping 802.11 frame types to their role in connection setup, plus an adapter inventory table listing chipset, driver, kernel module, and confirmed monitor/injection support for each device.
Wireless network types and architectures (Wi-Fi standards, 802.11 foundations) & Wireless adapter chipset/driver identification and mac80211 framework
Compare 802.11a/b/g/n/ac/ax on band, channel width, modulation, and throughput, and predict which channels a given AP will use given its configuration.
Configure a Linux wireless interface for monitor mode manually and via airmon-ng, and verify the resulting interface state with iw dev and ip link.
Diagnose two common monitor-mode failures (NetworkManager interference, regulatory domain restrictions) and document the fix for each.
Capture a full client association in monitor mode and locate the beacon, probe request/response, authentication, and association frames in the resulting trace.
Your checkpoint
A working monitor-mode setup on your own adapter plus a capture file containing a complete association handshake, annotated with the frames you identified.
Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)
Build a repeatable capture workflow using airodump-ng to record beacons, associated clients, and probe requests, and explain each column in the output.
Use Kismet to log a survey session and export it, then compare its output to airodump-ng for the same environment.
Apply Wireshark display filters to isolate management frames, deauthentication frames, and EAPOL handshake messages from a capture.
Explain the privacy implications of probe request leakage and identify which fields reveal client behavior.
Your checkpoint
A survey report of your own home or lab network containing an airodump-ng capture, a Kismet export, and a Wireshark-filtered view of the EAPOL exchange, with a short written analysis of what each tool revealed.
Encryption vulnerabilities and WPS exploitation
Explain the WPA2 four-way handshake step by step, including the role of the PMK, PTK, ANonce, SNonce, and MIC, and state exactly which captured frames are needed to attempt an offline dictionary attack.
Describe WPS PIN and PBC modes, the design flaw behind the PIN brute-force weakness, and the mitigation that disables it.
Compare WEP, WPA/TKIP, and WPA2/CCMP weaknesses and identify which are cryptographic versus configuration-driven.
Set up a lab AP you control with WPA2-PSK and capture a handshake, documenting each step you took.
Your checkpoint
A written handshake walkthrough with an annotated capture showing the four EAPOL messages, plus a table of WEP/WPA/WPA2/WPS weaknesses classified by root cause and mitigation.
Encryption vulnerabilities and WPS exploitation & Rogue access points and client deauthentication attacks
Run an offline dictionary attack against your own captured handshake and explain why success depends on passphrase entropy rather than protocol weakness.
Explain how deauthentication and disassociation frames are forged, why unprotected management frames enable this, and how 802.11w/PMF changes the picture.
Build a rogue AP in an isolated lab and describe the association flow a client follows when connecting to it.
Identify the indicators that distinguish a legitimate AP from an evil twin in a capture (BSSID, channel, security configuration, vendor IE).
Your checkpoint
A lab report documenting a successful offline crack of your own weak test passphrase, a deauthentication capture, and a side-by-side comparison of a legitimate AP versus your rogue AP with the distinguishing indicators listed.
Rogue access points and client deauthentication attacks & Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark)
Explain captive-portal and credential-capture rogue AP techniques conceptually and identify the client-side behaviors that make them effective.
Use Wireshark to detect deauthentication floods and rogue AP beacons in a capture, and describe the signature of each.
Describe how an attacker would use a rogue AP to observe traffic and what encryption (HTTPS, VPN) does and does not protect.
Draft detection and mitigation guidance for an organization, covering PMF, WIDS, and client behavior.
Your checkpoint
A detection playbook listing at least five indicators of rogue AP or deauthentication activity, each tied to a specific Wireshark filter or Kismet alert, with the corresponding mitigation.
Encryption vulnerabilities and WPS exploitation & Rogue access points and client deauthentication attacks & Wireless adapter chipset/driver identification and mac80211 framework
Troubleshoot three adapter or driver problems (injection failures, missing monitor mode, channel-hopping issues) and document the diagnostic path for each.
Re-run a full assessment on your lab from reconnaissance through handshake capture and rogue AP, timing each phase.
Cross-check your findings against the exam domains and list any objective you cannot yet explain without notes.
Review the mac80211 and cfg80211 interfaces you used and explain what each command actually changed in the kernel.
Your checkpoint
A timed end-to-end lab run log with per-phase timings and a gap list of at least five objectives you still need to strengthen.
Wireless network types and architectures (Wi-Fi standards, 802.11 foundations) & Wireless reconnaissance and traffic capture/analysis (Aircrack-ng, Kismet, Wireshark) & Encryption vulnerabilities and WPS exploitation & Rogue access points and client deauthentication attacks & Wireless adapter chipset/driver identification and mac80211 framework
Answer practice questions across all five domains and record your accuracy per domain to target final review.
Explain from memory the full chain from adapter selection through reconnaissance, handshake capture, and rogue AP construction.
Close every gap identified in week 7 and re-test yourself on those objectives.
Summarize the mitigations for each major weakness covered (WPS, WEP, unprotected management frames, weak passphrases) in your own words.
Your checkpoint
A final self-assessment sheet showing per-domain practice accuracy, the closed gap list, and a one-page mitigation summary covering every weakness studied.
Milestones
Week 2: Monitor mode works reliably on your adapter, you can explain the mac80211/cfg80211/driver path, and you have captured and annotated a complete client association.
Week 4: You can walk through the WPA2 four-way handshake from memory, identify the frames needed for an offline attack, and explain the WPS PIN flaw and its mitigation without notes.
Week 6: You have completed a full lab cycle - recon, handshake capture, offline crack of your own weak passphrase, deauthentication capture, and rogue AP comparison - and can list detection indicators for each attack.
Week 8: Per-domain practice accuracy is recorded, all week-7 gaps are closed, and you can explain every domain's core objectives and mitigations without reference material.