Penetration TestingWireless Pentest

Wireless Penetration Testing Beginner’s – Setting Up Lab

In this tutorial, we will take a look at the following:

  • Hardware and software requirements
  • Installing Kali
  • Setting up an access point and configuring it
  • Installing the wireless card
  • Testing connectivity between the laptop and the access point

So let the games begin!

Hardware requirements

We will need the following hardware to set up the wireless lab:

  • Two laptops with internal Wi-Fi cards: We will use one of the laptops like the victim in our lab and the other as the penetration tester’s laptop. Though almost any laptop would fit this profile, laptops with at least 3 GB RAM are desirable. This is because we may be running a lot of memory-intensive software in our experiments.
  • One wireless adapter (optional): Depending on the wireless card of your laptop,
    we may need a USB Wi-Fi card that can support packet injection and packet sniffing, which is supported by Kali. The best choice seems to be the Alfa AWUS036H card from Alfa Networks, as Kali supports this out-of-the-box. This is available on for a retail price of £18 at the time of writing. An alternative option is the Edimax EW-7711UAN, which is smaller and, marginally, cheaper.
  • One access point: Any access point that supports WEP/WPA/WPA2 encryption standards would fit the bill. I will be using a TP-LINK TL-WR841N Wireless router for the purpose of illustration in this book. You can purchase it from for a retail price of around £20 at the time of writing.
  • An Internet connection: This will come in handy for performing research, downloading software, and for some of our experiments.

Software requirements

We will need the following software to set up the wireless lab:

  • Kali: This software can be downloaded from the official website located at The software is open-source, and you should be able to download it directly from the website.
  • Windows XP/Vista/7: You will need any one of Windows XP, Windows Vista, or Windows 7 installed on one of the laptops. This laptop will be used as the victim machine for the rest of the book.

Installing Kali Linux

Let’s now quickly take a look at how to get up and running with Kali.

Kali will be installed on the laptop that will serve as the penetration tester’s machine for the rest of the book.

Time for action – installing Kali

Kali is relatively simple to install. We will run Kali by booting it as a Live DVD and then installing it on the hard drive.

Perform the following instructions step by step:

Burn the Kali ISO (we are using the Kali 32-bit ISO) you downloaded onto a bootable DVD.

  1. Boot the laptop with this DVD and select the option Install from the Boot menu: Wireless Penetration Testing Beginner's - Setting Up Lab
  2. If booting was successful, then you should see an awesome retro screen as follows: f booting was successful, then you should see an awesome retro screen as follows:
  3. This installer is similar to the GUI-based installers of most Linux systems and should be simple to follow. Select the appropriate options on every screen and start the installation process. Once the installation is done, restart the machine as prompted and remove the DVD.
  4. Once the machine restarts, a login screen will be displayed. Type in the login as root and the password as whatever you set it to during the installation process. You should now be logged into your installed version of Kali. Congratulations! I will change the desktop theme and some settings for this book. Feel free to use your own themes and color settings!

What just happened?

We are officially done with installing Kali Linux!

Have a go hero – installing Kali on VirtualBox

We can also install Kali within virtualization software such as VirtualBox. If you don’t want to dedicate a full laptop to Kali, this is the best option. Kali’s installation process in VirtualBox is exactly the same. The only difference is the pre-setup, which you will have to create in VirtualBox. Have a go at it! You can download VirtualBox from

One of the other ways in which we can install and use Kali is via USB drives. This is particularly useful if you do not want to install on the hard drive but still want to store persistent data on your Kali instance, such as scripts and new tools. We encourage you to try this out as well!

Setting up the access point

Now we will set up the access point. As mentioned earlier, we will be using the TP-LINK TL-WR841N Wireless Router for all the experiments in this book. However, feel free to use any other access point. The basic principles of operation and usage remain the same.

Time for action – configuring the access point

Let’s begin! We will set the access point up to use Open Authentication with an SSID of Wireless Lab.

Follow these instructions step by step:

1. Power on the access point and use an Ethernet cable to connect your laptop to one of the access point’s Ethernet ports.

2. Enter the IP address of the access point configuration terminal in your browser. For the TP-Link, it is by default You should consult your access point’s setup guide to find its IP address. If you do not have the manuals for the access point, you can also find the IP address by running the route –n command. The gateway IP address is typically the access point’s IP. Once you are connected, you should see a configuration portal that looks like this:

3. Explore the various settings in the portal after logging in and find the settings related to configuring a new SSID.
4. Change the SSID to Wireless Lab. Depending on the access point, you may have to reboot it for the settings to change:

5. Similarly, find the settings related to Wireless Security and change the setting to Disable Security. Disable Security indicates that it is using Open Authentication mode.

6. Save the changes to the access point and reboot it if required. Now your access point should be up and running with an SSID Wireless Lab.

An easy way to verify this is to use the Wireless Configuration utility on Windows and observe the available networks using the Windows laptop. You should find Wireless Lab as one of the networks in the listing:

What just happened?

We have successfully set up our access point with an SSID Wireless Lab. It is broadcasting its presence and this is being picked up by our Windows laptop and others within the Radio Frequency (RF) range of the access point.
It is important to note that we configured our access point in Open mode, which is the least secure. It is advisable not to connect this access point to the Internet for the time being, as anyone within the RF range will be able to use it to access the Internet.

Have a go hero – configuring the access point to use WEP and WPA

Play around with the configuration options of your access point. Try to get it up and running using encryption schemes such as WEP and WPA/WPA2. We will use these modes in later chapters to illustrate attacks against them.

Setting up the wireless card

Setting up our wireless adapter is much easier than the access point. The advantage is that Kali supports this card out-of-the-box and ships with all requisite device drivers to enable packet injection and packet sniffing.

Time for action – configuring your wireless card

Please follow these instructions step-by-step to set up your card:

1. Plug in the card to one of the Kali laptop’s USB ports and boot it. Once you log in, open a console terminal and type in iwconfig. Your screen should look as follows:


As you can see, wlan0 is the wireless interface created for the wireless adapter. Type in ifconfig wlan0 to bring the interface up. Then, type in ifconfig wlan0 to see the current state of the interface:screen-shot-2016-11-02-at-4-34-18-am

2. The MAC address 00:c0:ca:3e:bd:93 should match the MAC address written under your Alfa card. I am using the Edimax that gives me the preceding MAC address 80:1f:02:8f:34:d5. This is a quick check to ensure that you have enabled the correct interface.

What just happened?

Kali ships with all the required drivers for the Alfa and Edimax adapters out of the box. As soon as the machine booted, the adapter was recognized and was assigned the network interface wlan0. Now our wireless adapter is up and functional!

Connecting to the access point

Now we will take a look at how to connect to the access point using the wireless adapter. Our access point has an SSID Wireless Lab and does not use any authentication.

Time for action – configuring your wireless card

Here we go! Follow these steps to connect your wireless card to the access point:

1. Let’s first see what wireless networks our adapter is currently detecting. Issue the command iwlist wlan0 scanning and you will find a list of networks in your vicinity:screen-shot-2016-11-02-at-4-35-57-am

Keep scrolling down and you should find the Wireless Lab network in this list. In my setup, it is detected as Cell 05;

it may be different from yours. The ESSID field contains the network name.

2. As multiple access points can have the same SSID, verify that the MAC address mentioned in the preceding Address field matches your access point’s MAC. A fast and easy way to get the MAC address is underneath the access point or using web-based GUI settings.

3. Now, issue the iwconfig wlan0 essid “Wireless Lab” command and then iwconfig wlan0 to check the status. If you have successfully connected to the access point, you should see the MAC address of the access point in the Access Point: field in the output of iwconfig.

4. We know that the access point has a management interface IP address from its manual. Alternately, this is the same as the default router IP address when we run the route –  command. Let’s set our IP address in the same subnet by issuing the ifconfig wlan0 netmask up command. Verify the command succeeded by typing ifconfig wlan0 and checking the output.

5. Now let’s ping the access point by issuing the ping command. If the network connection has been set up properly, then you should see the responses from the access point. You can additionally issue an arp – a command to verify that the response is coming from the access point. You should see that the MAC address of the IP is the access point’s MAC address we noted earlier. It is important to note that some of the more recent access points might have responses to Internet Control Message Protocol (ICMP) echo request packets disabled. This is typically done to make the access point secure out-of-the-box with only minimal configuration settings available. In such a case, you can try to launch a browser and access the

web interface to verify that the connection is up and running:screen-shot-2016-11-02-at-4-36-33-am

On the access point, we can verify connectivity by looking at the connection logs. As you can see in the following log, the MAC address of the wireless card 4C:0F:6E:70:BD:CB has been logged making DHCP requests from the router:screen-shot-2016-11-02-at-4-37-21-am

What just happened?

We just connected to our access point successfully from Kali using our wireless adapter as the wireless device. We also learned how to verify that a connection has been established at both the wireless client and the access point side.

Have a go hero – establishing a connection in a WEP configuration

Here is a challenging exercise for you—set up the access point in a WEP configuration. For each of these, try establishing a connection with the access point using the wireless adapter.

Hint: check the manual for the iwconfig command by typing man iwconfig to see how to configure the card to connect to WEP.

Noor Qureshi

Experienced Founder with a demonstrated history of working in the computer software industry. Skilled in Network Security and Information Security.

Related Articles

Back to top button