Performing AP-less attacks

In an AP-less attack, the access point or wireless router is not present in the vicinity but a wireless client such as a laptop or even a smartphone is broadcasting probes, seeking to establish a connection with a wireless network within its preferred network list. Penetration testers can attempt to retrieve the password/passphrase of a wireless network, even if the wireless router or access point is not present within the vicinity. However, a wireless client must be sending probes to the target wireless network.

As shown in the following diagram, a penetration tester or threat actor simply needs to set up their attacker machine within the vicinity of a probing wireless client to capture the WLAN frames:

Figure 13.25 – Capturing probes

As we mentioned previously, the penetration tester can mimic a wireless network and trick the wireless client into connecting and capturing the WPA/WPA2 handshake.

Please use the following...