Survey and discovery
Every network and device broadcasting in and around your site.
- All SSIDs, including hidden ones
- Encryption and authentication per network
- Signal reach beyond your walls
- Unauthorised access points on your network
Every other part of your perimeter needs a cable or a login. Your Wi-Fi is broadcasting past the walls to whoever is sitting outside with a laptop. Protonyte tests WPA2, WPA3 and 802.1X enterprise networks on site in Karachi and on site across the Gulf: what can be captured, what can be cracked, what a fake access point can collect, and whether the guest network really is separate from everything else.
Wireless fails in two ways, and they need different answers. The first is the network itself: a pre-shared key that can be captured and cracked, an enterprise setup where the client never checks the server certificate, a WPA3 network left in transition mode so it can still be downgraded.
The second is the people. A laptop that has connected to your office Wi-Fi once will usually connect to anything using the same name. Stand a fake access point outside the building with that name and a stronger signal, and devices come to you. What they hand over depends entirely on how the genuine network was configured - which is the part of the report that tends to surprise people.
A survey first, so we are testing the network that exists rather than the one on the documentation, then the attacks that matter for how yours is configured.
Every network and device broadcasting in and around your site.
Whether the passphrase protecting the network can be recovered.
Where enterprise wireless usually goes wrong.
A network with your name on it, run by somebody else.
What a connected device can reach once it is on.
The devices themselves, which are rarely reviewed after install.
Which buildings, which networks, and what we may do with a client device that connects to us.
A walk of the site with the radios on, inside and outside.
Against the configuration we found, not a generic list.
Only where you have agreed to it, and only with your own devices.
What reached outside, what was crackable, what the fake access point collected, and how to close each one.
Two documents and a conversation. Written so the person who signs the invoice and the person who writes the fix can both use them.
The work follows NIST SP 800-115, NIST SP 800-153, PCI DSS wireless requirements and IEEE 802.11, so the coverage can be checked rather than taken on trust, and the report maps to what your auditor or your enterprise customer already recognises.
This page is one part of our penetration testing service. Where a finding needs a different kind of engagement to answer properly, we say so in the report rather than selling you the test we happen to be running.
No. Wi-Fi is radio, so somebody has to be within range with the right hardware. We test on site in Karachi as standard and travel for engagements in the UAE, Saudi Arabia and Qatar, usually combined with an internal network test in the same visit to keep the travel on one invoice.
Often, yes. Most WPA3 deployments run in transition mode so older devices still work, and transition mode can be pushed back down to WPA2. Beyond that, the enterprise side - certificate validation on the clients, RADIUS behaviour, what a device does when it sees a familiar name - is unchanged by WPA3.
Deauthentication is sometimes needed to capture a handshake, and it is brief and targeted. We agree in advance whether it is allowed at all, and if your environment cannot tolerate it we use passive capture and PMKID methods instead.
Always, and it is frequently where the finding is. We connect as an ordinary guest and try to reach the corporate network, other guests, and the management interfaces of the access points. PCI DSS treats wireless as in scope and expects that boundary to be proved.
Finding them is part of the job. A rogue access point plugged into a wall port by a well-meaning employee bypasses every other control you have, and the survey is what turns it up.
Tell us what you need tested. Our team will reply with a clear scope and quote.
An assistant, not a person, so check anything important with us. Please do not type passwords or card numbers here. Messages are kept so we can answer you better.